Audit Bundle Laravel Package

## Getting Started

### Minimal Setup
1. **Installation**:
   ```bash
   composer require anglemx/audit-bundle

Ensure the bundle is enabled in config/bundles.php:

Angle\AuditBundle\AngleAuditBundle::class => ['all' => true],

2. Environment Requirements:

   • Verify MAILER_FROM is set in .env for email functionality.
   • Confirm Ubuntu 18.04–22.04 and MySQL are in use (per README).

3. First Use Case: Run the master report command to generate and email all audit reports:

   php bin/console angle:audit:report-email
   

   This triggers all sub-reports (application-updates, database-migrations, etc.) and consolidates them into an email.

Implementation Patterns

Workflow Integration

1. Scheduled Audits: Use Symfony’s cron or a task scheduler (e.g., Supervisor) to run angle:audit:report-email weekly/monthly:

   0 0 * * 1 /usr/bin/php /var/www/bin/console angle:audit:report-email >> /var/www/audit.log 2>&1
   

2. Log File Parsing:

   • Server Updates: Ensure server-update.sh logs to symfony-update.log (root dir) with the required timestamps and Git metadata.
   • SSH Logs: Configure rsyslog to pipe sshd logs to /var/log/sshd.log (as per 60-sshd.conf template).

3. Database Access:

   • Reports like database-users and database-migrations rely on Doctrine ORM. Ensure your EntityManager is configured to connect to the target MySQL instance.
   • For custom queries, extend the bundle’s services (see Extension Points).

4. Email Reports:

   • The report-email command aggregates all sub-reports into a single email. Customize the email template by overriding the AngleAuditBundle:Email:report_email.html.twig template.

Common Use Cases

• Compliance Audits: Use operating-system-access and database-users to review privileged access for ITGC (Information Technology General Controls).
• Change Tracking: Leverage application-updates to audit Git commits/tags during deployments.
• Migration Audits: Run database-migrations post-deployment to verify schema changes.

Gotchas and Tips

Pitfalls

1. SwiftMailer Deprecation:

   • The bundle uses Symfony’s deprecated SwiftMailerBundle. Replace with SymfonyMailer (Symfony 6+) or Symfony’s built-in Mailer:

     # config/packages/mailer.yaml
     framework:
         mailer:
             dsn: '%env(MAILER_DSN)%'
     

   • Update the bundle’s MailerService to use the new Message class if extending.

2. Log File Permissions:

   • Ensure symfony-update.log and /var/log/sshd.log are writable by the Symfony process (e.g., www-data):

     chown www-data:www-data /var/www/symfony-update.log
     chmod 664 /var/www/symfony-update.log
     

3. SSH Log Verbosity:

   • If LogLevel VERBOSE isn’t set in /etc/ssh/sshd_config, the operating-system-access report may miss critical events. Test with:

     sudo tail -f /var/log/sshd.log
     

4. Git Metadata:

   • The server-update.sh script assumes a detached HEAD or tag. If using a branch, ensure git rev-parse --abbrev-ref HEAD captures the correct state.

Debugging

• Command Output: Run sub-commands individually to debug:

  php bin/console angle:audit:database-users --verbose
  

• Log Files: Check symfony-update.log for deployment metadata and /var/log/sshd.log for SSH events.
• Doctrine Queries: For database-migrations or database-users, enable Doctrine debug mode:

  # config/packages/dev/doctrine.yaml
  doctrine:
      dbal:
          logging: true
          profiling: true
  

Extension Points

1. Custom Reports: Extend the bundle by creating a new command (e.g., angle:audit:custom-report) and inject the AuditReportService:

   use Angle\AuditBundle\Service\AuditReportService;
   
   class CustomReportCommand extends Command {
       protected static $defaultName = 'angle:audit:custom-report';
   
       public function __construct(private AuditReportService $auditService) {
           parent::__construct();
       }
   
       protected function execute(InputInterface $input, OutputInterface $output): int {
           $data = $this->auditService->fetchCustomData();
           // Process $data...
       }
   }
   

2. Override Templates: Copy the default Twig templates from vendor/anglemx/audit-bundle/Resources/views/ to templates/AngleAuditBundle/ to customize email/content.

3. Configuration: Override bundle parameters in config/packages/angle_audit.yaml:

   angle_audit:
       log_file_path: '%kernel.project_dir%/var/audit.log'  # Custom log path
       ssh_log_path: '/var/log/custom_sshd.log'             # Override SSH log location
   

4. Database Queries: Modify the DatabaseAuditService to add custom queries. Override the service definition:

   # config/services.yaml
   services:
       Angle\AuditBundle\Service\DatabaseAuditService:
           arguments:
               $customQuery: 'SELECT * FROM custom_audit_table'
   

---