#!/bin/bash
# auditd setup and hardening

# Function to setup comprehensive audit
setup_comprehensive_audit() {
  log INFO "Configuring comprehensive audit system..."

  # Install required packages
  install_package "auditd"
  install_package "audispd-plugins"

  # Configure main audit settings
  local audit_conf="/etc/audit/auditd.conf"
  cat <<'EOF' | tee "$audit_conf" >/dev/null
log_file = /var/log/audit/audit.log
log_format = RAW
log_group = adm
priority_boost = 4
flush = INCREMENTAL_ASYNC
freq = 50
num_logs = 5
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
max_log_file = 8
max_log_file_action = ROTATE
space_left = 75
space_left_action = EMAIL
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
use_libwrap = yes
tcp_listen_queue = 5
tcp_max_per_addr = 1
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
distribute_network = no
EOF

  # Configure comprehensive audit rules (STIG & CIS Compliance)
  local audit_rules="/etc/audit/rules.d/audit.rules"
  cat <<'EOF' | tee "$audit_rules" >/dev/null
# Delete all existing rules
-D
# Set buffer size
-b 8192
# Failure Mode
-f 2
# Date and Time
-a always,exit -F arch=b64 -S adjtimex,settimeofday -k time-change
-a always,exit -F arch=b32 -S adjtimex,settimeofday,stime -k time-change
-a always,exit -F arch=b64 -S clock_settime -k time-change
-a always,exit -F arch=b32 -S clock_settime -k time-change
-w /etc/localtime -p wa -k time-change
# User, Group, and Password Modifications
-w /etc/group -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
# Network Environment
-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale
-a always,exit -F arch=b32 -S sethostname,setdomainname -k system-locale
-w /etc/issue -p wa -k system-locale
-w /etc/issue.net -p wa -k system-locale
-w /etc/hosts -p wa -k system-locale
-w /etc/network -p wa -k system-locale
-w /etc/netplan/ -p wa -k system-locale
# System Mandatory Access Controls
-w /etc/selinux/ -p wa -k MAC-policy
-w /etc/apparmor/ -p wa -k MAC-policy
-w /etc/apparmor.d/ -p wa -k MAC-policy
# Login/Logout
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins
-w /var/log/auth.log -p wa -k logins
# Session Initiation
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session
# Discretionary Access Control
-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod
# Unauthorized Access Attempts
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S creat,open,openat,truncate,ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
# Privilege Escalation
-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged
-w /usr/bin/sudo -p x -k privileged
-w /usr/bin/su -p x -k privileged
-w /usr/bin/passwd -p x -k privileged-passwd
-w /usr/bin/gpasswd -p x -k privileged-gpasswd
-w /usr/bin/chage -p x -k privileged-chage
-w /usr/bin/usermod -p x -k privileged-usermod
-w /usr/bin/crontab -p x -k privileged-crontab
# Module Loading/Unloading
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -k modules
-a always,exit -F arch=b32 -S init_module,finit_module,delete_module -k modules
# File deletion events
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=4294967295 -k delete
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=4294967295 -k delete
# Scope creep prevention
-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k scope_creep
-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k scope_creep
# Container events
-w /usr/bin/docker -p wa -k docker
-w /var/lib/docker -p wa -k docker
-w /etc/docker -p wa -k docker
-w /usr/bin/containerd -p wa -k containerd
# Systemd monitoring
-w /bin/systemctl -p x -k systemd
-w /etc/systemd/ -p wa -k systemd
# Make audit config immutable
-e 2
EOF

  # Restart audit daemon
  service auditd restart || handle_error "Failed to restart audit daemon" 24

  # Verify audit is working
  if !auditctl -l &>/dev/null; then
    handle_error "Audit system is not functioning properly after configuration" 25
  fi

  log INFO "Comprehensive audit system configured successfully"
}
