Enable auditd Service

Classification:

compliance

Framework:

Control:

Description

The auditd service is an essential userspace component of the Linux Auditing System, as it is responsible for writing audit records to disk.

The auditd service can be enabled with the following command:

$ sudo systemctl enable auditd.service

Rationale

Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Ensuring the auditd service is active ensures audit records generated by the kernel are appropriately recorded.

Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.

Remediation

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Gather the package facts
 package\_facts:
 manager: auto
 tags:
 - CJIS-5.4.1.1
 - NIST-800-171-3.3.1
 - NIST-800-171-3.3.2
 - NIST-800-171-3.3.6
 - NIST-800-53-AC-2(g)
 - NIST-800-53-AC-6(9)
 - NIST-800-53-AU-10
 - NIST-800-53-AU-12(c)
 - NIST-800-53-AU-14(1)
 - NIST-800-53-AU-2(d)
 - NIST-800-53-AU-3
 - NIST-800-53-CM-6(a)
 - NIST-800-53-SI-4(23)
 - PCI-DSS-Req-10.1
 - enable\_strategy
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - service\_auditd\_enabled

- name: Enable service auditd
 block:

 - name: Gather the package facts
 package\_facts:
 manager: auto

 - name: Enable service auditd
 service:
 name: auditd
 enabled: 'yes'
 state: started
 masked: 'no'
 when:
 - '"audit" in ansible\_facts.packages'
 when:
 - ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"audit" in ansible\_facts.packages'
 tags:
 - CJIS-5.4.1.1
 - NIST-800-171-3.3.1
 - NIST-800-171-3.3.2
 - NIST-800-171-3.3.6
 - NIST-800-53-AC-2(g)
 - NIST-800-53-AC-6(9)
 - NIST-800-53-AU-10
 - NIST-800-53-AU-12(c)
 - NIST-800-53-AU-14(1)
 - NIST-800-53-AU-2(d)
 - NIST-800-53-AU-3
 - NIST-800-53-CM-6(a)
 - NIST-800-53-SI-4(23)
 - PCI-DSS-Req-10.1
 - enable\_strategy
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - service\_auditd\_enabled