ACCT-9632 - Auditd configuration file location

This information is provided as part of the Lynis community project. It is related to Lynis control ACCT-9632 and should be considered as-is and without guarantees. Any advice and commands should be tested before implementing them in production environments.

Control details
Category	Accounting
Application

Description

The Linux audit framework consists of an audit daemon (auditd), utilities, audit rules and a configuration file for the daemon. This file (auditd.conf) is generally located in the /etc/audit directory or similar. Lynis tries to determine where this file is located. If this control shows up, the location could not be discovered. This is unusual, as the binaries of the framework are present and the audit daemon is running.

How to solve

Perform a manual search for the auditd.conf file. In case it's on an alternative location and Lynis can't find it, please report this finding to our development team.

Need more details?

Consider the upgrade to Lynis Enterprise to receive additional details and guidance. The Enterprise version helps to you with daily health checks of your environment, learn in-depth system hardening, and resources to protect your systems better.

See demo

About

Lynis is a technical security auditing tool for Unix flavors like Linux, macOS, AIX, Solaris, and *BSD. It is open source software and free to use. Typical usage include system hardening, compliance testing, and vulnerability scanning. The project has an active community, including development via GitHub.

Lynis Enterprise

Do you need to collect data from multiple systems or compliance reporting? Lynis Enterprise uses Lynis to collect the data and make your work easier.

Benefits: automate security audits, detailed reporting, compliance testing.

Centralized management
Improvement plan with priorities
Reporting
Dashboards
Predefined policies
Integration (API)
Improvement snippets for tools like Ansible, Chef, Cfengine, Puppet, and SaltStack

Take the Tour