# Ensure password failed attempts lockout includes root account

Necessity: The root account possesses the highest level of privileges on a Linux system. A successful brute-force attack against this account would result in a complete system compromise. By default, PAM lockout mechanisms like pam_faillock may not apply to the root user. Enabling this setting ensures that the root account is also locked out after a series of failed login attempts, significantly mitigating the risk of unauthorized access via brute-force attacks.

Auditing and Remediation: The audit script checks the PAM configuration files, specifically the configuration line for the pam_faillock.so module, to verify the presence of the 'even_deny_root' option. The remediation script modifies this configuration line, adding 'even_deny_root' to enable the policy or removing it to disable it.

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'true' because there is no secure scenario where the root account should be exempt from account lockout policies. Basic security posture requires protecting the most privileged account. Moderate and Strict levels reinforce this as a non-negotiable security control. Leaving the root account vulnerable to unlimited login attempts is a critical security flaw, making 'true' the only acceptable state.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['true']` |
| **Moderate** | `['true']` |
| **Strict** | `['true']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the relevant PAM configuration files (e.g., /etc/pam.d/common-auth) to check if the 'auth' line for 'pam_faillock.so' contains the 'even_deny_root' option. The script must return only the string 'true' if the option is present and 'false' if it is not.

## Remediation Script Working

Bash script that accepts a single positional argument ('true' or 'false'). If the argument is 'true', the script must find the 'auth required pam_faillock.so' line in the appropriate PAM configuration file (e.g., /etc/pam.d/common-auth) and add the 'even_deny_root' option if it is not already present. If the argument is 'false', it should remove the option. The script must return the string 'true' upon successful modification and 'false' on failure.

