# Ensure separate partition exists for /var/log/audit

Necessity: Isolating `/var/log/audit` on its own partition is a critical security measure to ensure the availability and integrity of audit logs. It prevents a denial-of-service attack (intentional or unintentional) where excessive log generation could fill the root (`/`) or `/var` partition, causing the entire system to become unstable or crash. A separate partition also allows for applying specific, restrictive mount options (such as `noexec`, `nodev`, `nosuid`) that harden the system by preventing the execution of programs or interpretation of device files from the log directory.

Auditing and Remediation: The audit script verifies the system's current state by checking if the `/var/log/audit` path is listed as a unique mountpoint in the filesystem table. The remediation script performs the complex, one-time task of creating and configuring this separate partition. This involves allocating a disk or partition, creating a filesystem, migrating existing audit logs, updating the system's static filesystem configuration (`/etc/fstab`) to ensure the partition is mounted automatically on boot, and mounting it for immediate use.

Recommended State Rationale: The recommendation is consistent across all hardening levels because this is a foundational, binary control. The system either has a dedicated partition for audit logs or it does not. Basic, Moderate, and Strict security postures all mandate this separation as a best practice (e.g., as defined by CIS Benchmarks). The state is 'Mounted' for all levels, as this configuration is essential for a securely audited system. Further hardening would involve the specific mount options applied to the partition, but the existence of the partition itself is the primary control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Mounted']` |
| **Moderate** | `['Mounted']` |
| **Strict** | `['Mounted']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if `/var/log/audit` is mounted on a separate partition. The script must check the system's mount points and output 'Mounted' if `/var/log/audit` is a distinct mountpoint, and 'Not Mounted' otherwise. The output must only contain the resulting string value, with no additional text or formatting.

## Remediation Script Working

Bash script that configures `/var/log/audit` on a new, separate partition. This is a complex and potentially destructive operation that requires careful planning regarding disk space and device selection. The script must accept one positional command-line argument: the block device to be formatted and used (e.g., `/dev/sdb1`). The script should handle partitioning (if needed), filesystem creation, moving existing data, updating `/etc/fstab`, and mounting the partition. It must return 'true' upon successful completion and 'false' if any step fails.

