Linux Security's Ensure login and logout events are collected check does not work on Debian/Ubuntu

[tas50]

Describe the bug

Our remediation steps include these lines on Debian/Ubuntu systems:

Here's the file after following these steps:

root@ip-172-31-41-52:/home/ubuntu# cat /etc/audit/rules.d/50-logins.rules
-w /var/log/lastlog -p wa -k logins
-w /var/log/tallylog -p wa -k logins
-w /var/log/faillog -p wa -k logins

The problem is the query only checks for the locations that we recommend on RHEL based systems:

props.mondooLinuxSecurityAuditFiles.any(_.contains(/^(\s+)?\-w\s+\/var\/run\/faillock\s+\-p\s+wa\s+\-k\s+logins(\s+)?$/))
props.mondooLinuxSecurityAuditFiles.any(_.contains(/^(\s+)?\-w\s+\/var\/log\/lastlog\s+\-p\s+wa\s+\-k\s+logins(\s+)?$/))

This query needs to handle platforms properly since the recommendations differ

[mm-weber]

Can be solved best with a variant

[mm-weber]

Fixed her:
#455