STIG: Configure auditd Rules & Retention

MediumLinux Security25-30 min

The brief

Accountability is a STIG requirement: the system must record who changed what. Author the Linux Audit (auditd) rule set so changes to the identity and privilege files are logged, then make the audit configuration tamper-resistant and set the audit logs to be retained (not silently rotated away). Rules live in /etc/audit/rules.d/ and retention in /etc/audit/auditd.conf; grading reads those config files the way an assessor would.

What you'll do

Audit writes/attribute-changes to /etc/passwd (identity)
Audit writes/attribute-changes to /etc/shadow (identity)
Audit writes/attribute-changes to /etc/sudoers (privilege escalation)
Make the audit config immutable (-e 2)
Retain audit logs (auditd.conf max_log_file_action = keep_logs)

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.