Immutable Linux Auditing with Auditd: Complying with Cyber Essentials Plus

Under the UK National Cyber Security Centre (NCSC) Cyber Essentials Plus requirements and ISO/IEC 27001 Control 8.15 (Logging), administrators must ensure that system events, privileged elevation, and unauthorized modification of core security configurations are systematically recorded in an immutable manner.

The Linux Kernel Auditing System (auditd) provides event logging directly from kernel syscalls, ensuring malicious processes cannot disguise their behavior by overriding userspace libraries.

---

1. Audit Rules Blueprint (/etc/audit/rules.d/audit.rules)

Create a deterministic rule set that captures identity manipulation, sudo elevation, and network file modifications:

# Delete all existing rules
-D

# Set buffer size (prevent packet drop under heavy load)
-b 8192

# Failure mode: 1 = printk, 2 = kernel panic
-f 1

## Identity and Access Management Auditing
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

## Sudoers Configuration Changes
-w /etc/sudoers -p wa -k scope_actions
-w /etc/sudoers.d/ -p wa -k scope_actions

## Kernel Module Loading / Unloading
-a always,exit -F arch=b64 -S init_module,finit_module,delete_module -k kernel_modules

## Unauthorized File Access (Access Denied / EACCES / EPERM)
-a always,exit -F arch=b64 -S open,openat,creat -F exit=-EACCES -k access_denied
-a always,exit -F arch=b64 -S open,openat,creat -F exit=-EPERM -k access_denied

## Network & Interface Configuration Modifications
-w /etc/issue -p wa -k system_locale
-w /etc/hosts -p wa -k system_locale
-w /etc/network/ -p wa -k system_locale

## Make the Configuration Immutable (-e 2)
# Once locked, rules cannot be altered until a full system reboot
-e 2

[!IMPORTANT] The final directive -e 2 makes the audit configuration immutable. After applying this rule, neither auditctl nor the root user can disable auditing or alter rules until the server is rebooted. This is an explicit requirement for high-assurance compliance.

---

2. Compiling and Verifying Rules

Load the rule set and confirm the status:

augenrules --load
auditctl -s

The output will confirm enabled 2, validating the immutable lock status:

enabled 2
failure 1
pid 523
rate_limit 0
backlog_limit 8192
lost 0
backlog 0
backlog_wait_time 0

---

3. Querying Audit Trails with ausearch & aureport

To review audit trail records matching our tags:

# Query identity changes
ausearch -k identity --format text

# Summarize failed access attempts
aureport --failed --summary