Audit login records and session files

Description

auditd rules in /etc/audit/rules.d/60-cirsec-session.rules:

• writes to the session records /run/utmp, /var/log/wtmp, /var/log/btmp and, on Debian 13, the wtmpdb database in /var/lib/wtmpdb/ (key session);
• writes to /var/log/lastlog and to the pam_faillock counters in /run/faillock/ (key logins).

/run/utmp is used instead of /var/run/utmp: /var/run is a symbolic link to /run and the kernel watches the real path.

Rationale

last, lastb, who and faillock read these files. Every login writes to them, so the records show logins and logouts; an edit outside a login is a sign of an attempt to erase a session.

Impact

Each login and logout produces a few records.

Setting

Audit

1. Run auditctl -l as root. It must list the rules shown below (keys logins, session).
2. Run grep -h . /etc/audit/rules.d/*.rules. The same rules must be present, so they load at boot.

Expected rules, as auditctl -l prints them:

-w /run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/lib/wtmpdb -p wa -k session
-w /var/log/lastlog -p wa -k logins
-w /run/faillock -p wa -k logins

Automated: every check must pass. Scanners report each check by its id.

rules

Rules loaded in the kernel and present in /etc/audit/rules.d.

script: |
  command -v auditctl >/dev/null 2>&1 || { echo "auditctl not found: auditd is not installed"; exit 1; }
  want() {
  cat <<'RULES'
  -w /run/utmp -p wa -k session
  -w /var/log/wtmp -p wa -k session
  -w /var/log/btmp -p wa -k session
  -w /var/lib/wtmpdb -p wa -k session
  -w /var/log/lastlog -p wa -k logins
  -w /run/faillock -p wa -k logins
  RULES
  }
  loaded=$(auditctl -l 2>&1) || { echo "$loaded"; exit 3; }
  disk=$(cat /etc/audit/rules.d/*.rules 2>/dev/null)
  n=0 rc=0
  while IFS= read -r r; do
    [ -n "$r" ] || continue
    n=$((n + 1))
    printf '%s\n' "$loaded" | grep -Fxq -- "$r" || { echo "not loaded: $r"; rc=1; }
    printf '%s\n' "$disk" | grep -Fxq -- "$r" || { echo "not in /etc/audit/rules.d: $r"; rc=1; }
  done <<EOF
  $(want)
  EOF
  [ "$rc" = 1 ] || echo "$n rules loaded and present in /etc/audit/rules.d"
  exit "$rc"

Remediation

1. Write the expected rules to /etc/audit/rules.d/60-cirsec-session.rules (mode 0640).
2. Run augenrules --load. If auditctl -s shows enabled 2, the configuration is locked: reboot to load the new rules.

Rollback

Delete /etc/audit/rules.d/60-cirsec-session.rules and run augenrules --load (or reboot if the configuration is locked).

rules-file

command -v augenrules >/dev/null 2>&1 || { echo "auditd is not installed" >&2; exit 1; }
want() {
cat <<'RULES'
-w /run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/lib/wtmpdb -p wa -k session
-w /var/log/lastlog -p wa -k logins
-w /run/faillock -p wa -k logins
RULES
}
f=/etc/audit/rules.d/60-cirsec-session.rules
t=$(mktemp)
{ echo '# Written by CIRSEC Baselines CB-DEB-AUDIT-027'; want; } >"$t"
if ! cmp -s "$t" "$f"; then
  cb_backup "$f"
  cat "$t" >"$f"
fi
rm -f "$t"
chmod 640 "$f"
if auditctl -s | grep -q '^enabled 2'; then
  echo "audit rules are locked (-e 2): reboot to load $f"
else
  augenrules --load >/dev/null
fi

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• audit.rules(7), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• auditctl(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R73) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-DEB-AUDIT-011 Install and run the audit daemon
• related CB-DEB-AUDIT-029 Lock the audit configuration and load every valid rule

People and lifecycle