Create auditd rules

[m41kc0d3]

see Telekom 2021.07-01 SoC 3.65 Req32-37
Public Telekom Security - Requirements

[schurzi]

I think it would be very beneficial to split this one control into multiple separate controlls.
A good approach for this may be CIS DIL Benchmark, this way we could get meaningful descriptions, explaining the wy and what, and also reference the IDs there for further reading.

[schurzi]

can you please change this to use only_if, like

linux-baseline/controls/os_spec.rb

Lines 153 to 167 in 91a0aa9

	control 'os-05b' do
	impact 1.0
	title 'Check login.defs - RedHat specific'
	desc 'Check owner and permissions for login.defs. Also check the configured PATH variable and umask in login.defs'
	describe file('/etc/login.defs') do
	it { should_not be_writable }
	end
	describe login_defs do
	its('SYS_UID_MIN') { should eq '201' }
	its('SYS_UID_MAX') { should eq '999' }
	its('SYS_GID_MIN') { should eq '201' }
	its('SYS_GID_MAX') { should eq '999' }
	end
	only_if { os.redhat? }
	end

[schurzi]

I think audit is large enough to start an extra file for all the checks and maybe split this up a bit to give it usefull names and descriptions.

[m41kc0d3]

Hi schurzi,
I see there is already an Inspec definition in an other repo in this project. https://github.com/dev-sec/cis-dil-benchmark/blob/master/controls/4_1_configure_system_accounting_auditd.rb

Should I copy them to a new file in this repo an change the the tests to the things I configure in dev-sec/ansible-collection-hardening#468 ?
Or is this a little to much tests?