# Ensure audit log files group owner is configured

The necessity of this setting is to protect the confidentiality and integrity of audit logs. Audit logs contain sensitive information about system activity and potential security events. If an unauthorized user can read these logs, they could gain insight into system vulnerabilities or user actions. If they can modify them, they could cover their tracks after a compromise. Restricting log file access to a specific administrative group is a critical step in securing the audit trail. The audit script verifies the current group owner configured in `auditd.conf`, while the remediation script sets it to a desired value and restarts the service to enforce the new permissions. For the recommended states, 'adm' is a standard administrative group often used for log monitoring, providing a good baseline (Basic). Setting the group to 'root' (Moderate and Strict) is more secure as it ensures that only the superuser can access the logs, strictly adhering to the principle of least privilege for the system's most critical security data.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['adm']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `/etc/audit/auditd.conf` file to find the value of the `log_group` parameter. The script must parse the file and output only the value assigned to `log_group`, with no extra text or labels. For example, if the line is `log_group = adm`, the script should output `adm`.

## Remediation Script Working

Bash script that accepts a single positional argument, which is the desired group name for the audit logs. The script must modify the `/etc/audit/auditd.conf` file, setting the `log_group` parameter to the value provided in the argument. If the parameter does not exist, it should be added. The script should then restart the `auditd` service to apply the changes. The script must return `true` on successful modification and service restart, and `false` otherwise.

