auditd — Privilege Escalation Tracking

Set up auditd to detect and record any modification to sudoers and auth files.

A advanced Linux challenge worth 20 points. Solve it hands-on in a real Linux environment in your browser - no local setup, no fake shells.

The Challenge

A compliance audit requires proof that /etc/sudoers has not been tampered with.

Your tasks:

• Write audit rules to /etc/audit/rules.d/hardening.rules:

-w /etc/sudoers -p wa -k sudoers_change -w /etc/passwd -p wa -k auth_change -w /etc/shadow -p wa -k auth_change

• Load rules: auditctl -R /etc/audit/rules.d/hardening.rules 2>/dev/null || true
• Simulate a write: echo "" >> /tmp/sudoers_test (then check if auditd is recording)
• Write the rule file path and rules to /tmp/audit_report.txt
• Run check to validate