# Ensure Audit Logging of User and Group Modification Events

- Source: https://support.icompaas.com/support/solutions/articles/62000234896-ensure-audit-logging-of-user-and-group-modification-events
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Linux 2 Benchmark v3.0.0](https://support.icompaas.com/support/solutions/62000112696) › [CIS Amazon Linux 2 Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169265)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: **• Level 2**

Description:  
 Modifications to user and group information, such as adding, deleting, or changing accounts and groups, can impact system security and access control. Collecting audit events for these modifications provides visibility into changes and helps detect unauthorized activity.

Rationale:  
 Auditing user and group modification events supports accountability, enables detection of unauthorized changes, and aids in forensic investigations.

Impact:  
 Pros:

-   Provides visibility into critical account and group management activities.  
    
-   Supports compliance with security policies and regulatory requirements.  
    

Cons:

-   May generate significant audit data; requires effective log management.  
    

Default Value:  
 Audit rules for user and group modifications may not be enabled by default.

Pre-requisites:

-   Root or sudo privileges to configure audit rules.  
    

Remediation:

### Test Plan:

Using Linux command line:

Check current audit rules for user/group modifications:

auditctl -l | grep user\_mod

1.  Verify audit rules exist for syscalls such as useradd, userdel, groupadd, groupdel, or monitoring files like /etc/passwd, /etc/group, /etc/shadow, and /etc/gshadow.  
    

### Implementation Plan:

Using Linux command line:

Add audit rules to monitor user and group modifications:

auditctl -w /etc/passwd -p wa -k user\_mod  
auditctl -w /etc/group -p wa -k user\_mod  
auditctl -w /etc/shadow -p wa -k user\_mod  
auditctl -w /etc/gshadow -p wa -k user\_mod

1.  Persist audit rules by adding them to /etc/audit/rules.d/audit.rules.  
    

### Backout Plan:

Using Linux command line:

Remove or disable audit rules for user/group modifications if necessary:

auditctl -W /etc/passwd -p wa -k user\_mod  
auditctl -W /etc/group -p wa -k user\_mod  
auditctl -W /etc/shadow -p wa -k user\_mod  
auditctl -W /etc/gshadow -p wa -k user\_mod

1.  Reload audit daemon configuration.  
    

References:

-   CIS Amazon Linux 2 Benchmark v3.0.0  
    
-   [Linux Audit Framework  
    ](https://linux-audit.com/)
    
-   [NIST SP 800-53 Revision 5 - AU-6  
      
    ](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final#au-6)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.