Process accounting enabled
Requires that process accounting is active, via auditd, or the acct/psacct service, so that command and process execution is recorded for audit and forensics.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
Process accounting records which commands ran, by whom, when, and for how long. Without it, after an incident you have little visibility into what an attacker (or a misbehaving user) actually executed, crippling forensic investigation and accountability. An active accounting/audit subsystem provides the trail needed to reconstruct activity, attribute actions and detect abuse.
What Pavois checks
Pavois reads the effective runtime state with systemctl is-active auditd acct psacct and requires at least one to be active. Querying systemd's live unit state (not whether a package is installed or a config file exists) confirms the service is genuinely running and collecting data right now.
describe command('systemctl is-active acct psacct 2>/dev/null | grep -qx active && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run systemctl is-active auditd acct psacct, at least one should report active. With auditd, confirm with auditctl -s (enabled 1). With acct/psacct, lastcomm and sa should show recorded command activity.
Inspect & investigate
auditd writes to /var/log/audit/audit.log (query with care, see the project note that ausearch can give false negatives; grep the raw log). acct/psacct stores accounting in /var/log/account/pacct, read with lastcomm, sa and ac. Service status: systemctl status auditd.
Remediation
No automated remediation is shipped, so apply it manually: install and enable an accounting subsystem, apt install acct && systemctl enable --now acct (Debian/Ubuntu) or dnf install psacct && systemctl enable --now psacct (RHEL family), or ensure auditd is installed and systemctl enable --now auditd.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | systemctl enable --now acct 2>/dev/null || systemctl enable --now psacct 2>/dev/null || true |
|---|---|
| name | enable-process-accounting |
| not_if | systemctl is-active acct psacct 2>/dev/null | grep -qx active |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Enabling process accounting is low risk. The trade-offs are operational: accounting/audit logs grow continuously and can fill /var on busy systems, so configure log rotation and size limits (auditd's max_log_file, space_left_action). auditd with verbose rules adds slight overhead under heavy syscall load. No services are interrupted by enabling it.