4.1.2 Ensure auditd is installed

Information

auditd is the userspace component to the Linux Auditing System. It's responsible for
writing audit records to the disk

Rationale:

The capturing of system events provides system administrators with information to allow
them to determine if unauthorized access to their system is occurring.

Solution

Run the following command to Install auditd

# yum install audit audit-libs

# apt-get install auditd audispd-plugins

# zypper install audit audit-libs

See Also

https://workbench.cisecurity.org/files/2420