LowOS hardeningBLWK-LOG-003

Kernel-level process accounting is not installed

What this means

Neither accton nor lastcomm is present, so there's no kernel-level record of every process that ran on this host, who ran it, and how long it took — a different, harder- to-tamper-with data source than shell history or application logs, since it's written by the kernel itself rather than by the process being recorded.

How to fix it

Install process accounting (e.g. apt install acct) and enable it with systemctl enable --now acct.

Check it yourself

Run a scan and look for BLWK-LOG-003 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads process_accounting and reports this check when:

installed == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 4.6

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001