# Ensure pam_faillock module is enabled

Necessity: The `pam_faillock` module is a critical security control that protects against brute-force password-guessing attacks. It temporarily locks user accounts after a specified number of consecutive failed login attempts, significantly increasing the difficulty for an attacker to gain unauthorized access. Disabling this module leaves user accounts vulnerable to automated attacks that can compromise the system.

Auditing and Remediation: The audit script checks the system's PAM configuration via the `pam-auth-update` utility to determine if the faillock profile is currently active. The remediation script uses the same utility to programmatically enable or disable the faillock profile, thereby activating or deactivating the account lockout mechanism for all PAM-aware services.

Recommended State Rationale: Basic, Moderate, and Strict states all recommend 'Enabled'. Account lockout is a foundational security measure and a requirement in most security frameworks (e.g., CIS Benchmarks). There is no acceptable baseline where this control is disabled. While the specific faillock parameters (such as lockout duration and attempt count) can be tuned for different security levels, the module itself must be enabled to provide any protection. Therefore, 'Enabled' is the universal recommendation for any hardened system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to verify the status of the 'Faillock failure locking' profile using `pam-auth-update`. The script must parse the output of `pam-auth-update --display` and return 'Enabled' if the profile is active (prefixed with `[*]`) or 'Disabled' if it is inactive (prefixed with `[ ]`). The script must only output the resulting string.

## Remediation Script Working

Bash script that accepts one positional argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must execute `pam-auth-update --enable faillock --force`. If 'Disabled', it must execute `pam-auth-update --disable faillock --force`. The script must return `true` upon successful execution or `false` if an error occurs.

