MediumOS hardeningBLWK-LOG-001

auditd is not installed

What this means

No auditd binary was found. Without it, there's no kernel-level record of privileged syscalls (file access, exec, permission changes) — the trail that makes a break-in reviewable after the fact instead of just a guess.

How to fix it

Install auditd (e.g. apt install auditd) and enable it with systemctl enable --now auditd.

Check it yourself

Run a scan and look for BLWK-LOG-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads logging and reports this check when:

auditd_present == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 4.1

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001