diff --git a/.etckeeper b/.etckeeper
index 9efef198..24e9b56a 100755
--- a/.etckeeper
+++ b/.etckeeper
@@ -317,6 +317,15 @@ maybe chmod 0644 'apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/debian-archive-stretch-stable.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/mariadb-keyring-2019.gpg'
+maybe chmod 0750 'audit'
+maybe chmod 0640 'audit/audit-stop.rules'
+maybe chmod 0640 'audit/audit.rules'
+maybe chmod 0640 'audit/auditd.conf'
+maybe chmod 0750 'audit/plugins.d'
+maybe chmod 0640 'audit/plugins.d/af_unix.conf'
+maybe chmod 0640 'audit/plugins.d/syslog.conf'
+maybe chmod 0750 'audit/rules.d'
+maybe chmod 0640 'audit/rules.d/audit.rules'
 maybe chmod 0644 'bash.bashrc'
 maybe chmod 0644 'bash_completion'
 maybe chmod 0755 'bash_completion.d'
@@ -468,6 +477,7 @@ maybe chmod 0644 'debian_version'
 maybe chmod 0755 'default'
 maybe chmod 0644 'default/acct'
 maybe chmod 0644 'default/amavisd-snmp-subagent'
+maybe chmod 0644 'default/auditd'
 maybe chmod 0644 'default/console-setup'
 maybe chmod 0644 'default/cron'
 maybe chmod 0644 'default/dbus'
@@ -894,6 +904,7 @@ maybe chmod 0755 'init.d/amavis'
 maybe chmod 0755 'init.d/amavis-mc'
 maybe chmod 0755 'init.d/amavisd-snmp-subagent'
 maybe chmod 0755 'init.d/apparmor'
+maybe chmod 0755 'init.d/auditd'
 maybe chmod 0755 'init.d/clamav-daemon'
 maybe chmod 0755 'init.d/clamav-freshclam'
 maybe chmod 0755 'init.d/cloud-config'
diff --git a/audit/audit-stop.rules b/audit/audit-stop.rules
new file mode 100644
index 00000000..7e23cff4
--- /dev/null
+++ b/audit/audit-stop.rules
@@ -0,0 +1,8 @@
+# These rules are loaded when the audit daemon stops
+# if configured to do so.
+
+# Disable auditing
+-e 0
+
+# Delete all rules
+-D
diff --git a/audit/audit.rules b/audit/audit.rules
new file mode 100644
index 00000000..d3d6609f
--- /dev/null
+++ b/audit/audit.rules
@@ -0,0 +1,6 @@
+## This file is automatically generated from /etc/audit/rules.d
+-D
+-b 8192
+-f 1
+--backlog_wait_time 60000
+
diff --git a/audit/auditd.conf b/audit/auditd.conf
new file mode 100644
index 00000000..f3fd96c4
--- /dev/null
+++ b/audit/auditd.conf
@@ -0,0 +1,39 @@
+#
+# This file controls the configuration of the audit daemon
+#
+
+local_events = yes
+write_logs = yes
+log_file = /var/log/audit/audit.log
+log_group = adm
+log_format = ENRICHED
+flush = INCREMENTAL_ASYNC
+freq = 50
+max_log_file = 8
+num_logs = 5
+priority_boost = 4
+name_format = NONE
+##name = mydomain
+max_log_file_action = ROTATE
+space_left = 75
+space_left_action = SYSLOG
+verify_email = yes
+action_mail_acct = root
+admin_space_left = 50
+admin_space_left_action = SUSPEND
+disk_full_action = SUSPEND
+disk_error_action = SUSPEND
+use_libwrap = yes
+##tcp_listen_port = 60
+tcp_listen_queue = 5
+tcp_max_per_addr = 1
+##tcp_client_ports = 1024-65535
+tcp_client_max_idle = 0
+transport = TCP
+krb5_principal = auditd
+##krb5_key_file = /etc/audit/audit.key
+distribute_network = no
+q_depth = 400
+overflow_action = SYSLOG
+max_restarts = 10
+plugin_dir = /etc/audit/plugins.d
diff --git a/audit/plugins.d/af_unix.conf b/audit/plugins.d/af_unix.conf
new file mode 100644
index 00000000..a5ba8b1f
--- /dev/null
+++ b/audit/plugins.d/af_unix.conf
@@ -0,0 +1,14 @@
+
+# This file controls the configuration of the
+# af_unix socket plugin. It simply takes events
+# and writes them to a unix domain socket. This
+# plugin can take 2 arguments, the path for the
+# socket and the socket permissions in octal.
+
+active = no
+direction = out
+path = builtin_af_unix
+type = builtin 
+args = 0640 /var/run/audispd_events
+format = string
+
diff --git a/audit/plugins.d/syslog.conf b/audit/plugins.d/syslog.conf
new file mode 100644
index 00000000..e8aebdfe
--- /dev/null
+++ b/audit/plugins.d/syslog.conf
@@ -0,0 +1,14 @@
+# This file controls the configuration of the syslog plugin.
+# It simply takes events and writes them to syslog. The
+# arguments provided can be the default priority that you
+# want the events written with. And optionally, you can give
+# a second argument indicating the facility that you want events
+# logged to. Valid options are LOG_LOCAL0 through 7, LOG_AUTH,
+# LOG_AUTHPRIV, LOG_DAEMON, LOG_SYSLOG, and LOG_USER.
+
+active = no
+direction = out
+path = /sbin/audisp-syslog
+type = always 
+args = LOG_INFO
+format = string
diff --git a/audit/rules.d/audit.rules b/audit/rules.d/audit.rules
new file mode 100644
index 00000000..b86d66f9
--- /dev/null
+++ b/audit/rules.d/audit.rules
@@ -0,0 +1,13 @@
+## First rule - delete all
+-D
+
+## Increase the buffers to survive stress events.
+## Make this bigger for busy systems
+-b 8192
+
+## This determine how long to wait in burst of events
+--backlog_wait_time 60000
+
+## Set failure mode to syslog
+-f 1
+
diff --git a/default/auditd b/default/auditd
new file mode 100644
index 00000000..f4a877df
--- /dev/null
+++ b/default/auditd
@@ -0,0 +1,12 @@
+# Add extra options here
+EXTRAOPTIONS=""
+
+# This option is used to determine if rules & watches should be deleted on
+# shutdown by loading the audit-stop file. This is beneficial in most cases
+# so that a watch doesn't linger on a drive that is being unmounted. If
+# set to no, it will NOT be cleaned up.
+AUDITD_CLEAN_STOP="no"
+
+# This option determines whether or not to call augenrules to compile the
+# audit rules from /etc/audit/rules.d. The default is "yes".
+USE_AUGENRULES="yes"
diff --git a/init.d/auditd b/init.d/auditd
new file mode 100755
index 00000000..2ed72876
--- /dev/null
+++ b/init.d/auditd
@@ -0,0 +1,152 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides:          auditd
+# Required-Start:    $remote_fs
+# Required-Stop:     $local_fs
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Audit Daemon
+# Description:       Collects audit information from Linux 2.6 Kernels.
+### END INIT INFO
+
+# Author: Philipp Matthias Hahn <pmhahn@debian.org>
+# Based on Debians /etc/init.d/skeleton and Auditds init.d/auditd.init
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="audit daemon"
+NAME=auditd
+DAEMON=/sbin/auditd
+PIDFILE=/var/run/"$NAME".pid
+SCRIPTNAME=/etc/init.d/"$NAME"
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/"$NAME" ] && . /etc/default/"$NAME"
+
+# Define LSB log_* functions.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	# Return
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile "$PIDFILE" --exec "$DAEMON" --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --pidfile "$PIDFILE" --exec "$DAEMON" -- \
+		$EXTRAOPTIONS \
+		|| return 2
+        # Call augenrules to compile audit rules.
+        case "$USE_AUGENRULES" in
+                no|NO) ;;
+                *) [ -d /etc/audit/rules.d ] && /sbin/augenrules >/dev/null ;;
+        esac
+	if [ -f /etc/audit/audit.rules ]
+	then
+		/sbin/auditctl -R /etc/audit/audit.rules >/dev/null
+	fi
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile "$PIDFILE" --name "$NAME"
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec "$DAEMON"
+	[ "$?" = 2 ] && return 2
+	# Many daemons don't delete their pidfiles when they exit.
+	rm -f "$PIDFILE"
+	rm -f /var/run/audit_events
+	# Remove watches so shutdown works cleanly
+	case "$AUDITD_CLEAN_STOP" in
+		no|NO) ;;
+		*) /sbin/auditctl -R /etc/audit/audit-stop.rules >/dev/null ;;
+	esac
+	return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+	start-stop-daemon --stop --signal HUP --quiet --pidfile $PIDFILE --name $NAME
+	return 0
+}
+
+case "$1" in
+  start)
+	log_daemon_msg "Starting $DESC" "$NAME"
+	do_start
+	case "$?" in
+		0|1) log_end_msg 0 ;;
+		2) log_end_msg 1 ;;
+	esac
+	;;
+  stop)
+	log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) log_end_msg 0 ;;
+		2) log_end_msg 1 ;;
+	esac
+	;;
+  reload|force-reload)
+	log_daemon_msg "Reloading $DESC" "$NAME"
+	do_reload
+	log_end_msg $?
+	;;
+  restart)
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+		# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  rotate)
+	log_daemon_msg "Rotating $DESC logs" "$NAME"
+	start-stop-daemon --stop --signal USR1 --quiet --pidfile "$PIDFILE" --name "$NAME"
+	log_end_msg $?
+	;;
+  status)
+	pidofproc -p "$PIDFILE" "$DAEMON" >/dev/null
+	status=$?
+	if [ $status -eq 0 ]; then
+		log_success_msg "$NAME is running."
+	else
+		log_failure_msg "$NAME is not running."
+	fi
+	exit $status
+	;;
+  *)
+	echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload|rotate|status}" >&2
+	exit 3
+	;;
+esac
+
+:
diff --git a/rc0.d/K01auditd b/rc0.d/K01auditd
new file mode 120000
index 00000000..d4d8d307
--- /dev/null
+++ b/rc0.d/K01auditd
@@ -0,0 +1 @@
+../init.d/auditd
\ No newline at end of file
diff --git a/rc1.d/K01auditd b/rc1.d/K01auditd
new file mode 120000
index 00000000..d4d8d307
--- /dev/null
+++ b/rc1.d/K01auditd
@@ -0,0 +1 @@
+../init.d/auditd
\ No newline at end of file
diff --git a/rc2.d/S01auditd b/rc2.d/S01auditd
new file mode 120000
index 00000000..d4d8d307
--- /dev/null
+++ b/rc2.d/S01auditd
@@ -0,0 +1 @@
+../init.d/auditd
\ No newline at end of file
diff --git a/rc3.d/S01auditd b/rc3.d/S01auditd
new file mode 120000
index 00000000..d4d8d307
--- /dev/null
+++ b/rc3.d/S01auditd
@@ -0,0 +1 @@
+../init.d/auditd
\ No newline at end of file
diff --git a/rc4.d/S01auditd b/rc4.d/S01auditd
new file mode 120000
index 00000000..d4d8d307
--- /dev/null
+++ b/rc4.d/S01auditd
@@ -0,0 +1 @@
+../init.d/auditd
\ No newline at end of file
diff --git a/rc5.d/S01auditd b/rc5.d/S01auditd
new file mode 120000
index 00000000..d4d8d307
--- /dev/null
+++ b/rc5.d/S01auditd
@@ -0,0 +1 @@
+../init.d/auditd
\ No newline at end of file
diff --git a/rc6.d/K01auditd b/rc6.d/K01auditd
new file mode 120000
index 00000000..d4d8d307
--- /dev/null
+++ b/rc6.d/K01auditd
@@ -0,0 +1 @@
+../init.d/auditd
\ No newline at end of file
diff --git a/systemd/system/multi-user.target.wants/auditd.service b/systemd/system/multi-user.target.wants/auditd.service
new file mode 120000
index 00000000..32f1ce2f
--- /dev/null
+++ b/systemd/system/multi-user.target.wants/auditd.service
@@ -0,0 +1 @@
+/lib/systemd/system/auditd.service
\ No newline at end of file