# Ensure root account access is controlled

Necessity: Disabling direct root login via SSH is a critical security measure. The 'root' account is a universally known username, making it a primary target for brute-force attacks. Allowing direct root login bypasses the accountability provided by individual user accounts and tools like `sudo`, making it difficult to trace administrative actions. Forcing users to log in with their personal accounts first and then elevate privileges creates a clear audit trail and adds a layer of defense, as an attacker would need to compromise a specific user account before attempting to gain root access. Misconfiguration leaves the system highly vulnerable to unauthorized administrative control.

Auditing and Remediation: The audit script examines the SSH daemon's configuration file (`/etc/ssh/sshd_config`) to determine the current state of the `PermitRootLogin` directive. The remediation script modifies this file to enforce the desired setting and then restarts the SSH service to apply the change, thereby controlling how the root account can be accessed remotely.

Recommended State Rationale:
- Basic: `['prohibit-password']` is a significant improvement over allowing password-based root login. It forces the use of cryptographic keys, which are resistant to brute-force attacks. However, it still allows direct login as root, which can obscure the identity of the administrator.
- Moderate: `['no']` is the industry standard and recommended by security benchmarks like CIS. It completely disables direct remote login for the root account, forcing all administrators to log in as a non-privileged user first and then use privilege escalation tools like `sudo`. This approach ensures that all privileged commands are logged and attributed to a specific user, greatly enhancing security and accountability.
- Strict: This state is identical to Moderate as `no` is the most secure and restrictive option available for the `PermitRootLogin` setting. It provides the strongest possible posture for this control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['prohibit-password']` |
| **Moderate** | `['no']` |
| **Strict** | `['no']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the `/etc/ssh/sshd_config` file to find the effective value of the `PermitRootLogin` setting. The script must parse the file, accounting for commented lines, and output only the determined value (e.g., 'no', 'yes', 'prohibit-password'). If the setting is not explicitly defined, it should return the system's default, which is typically 'yes'.

## Remediation Script Working

Develop a Bash script that takes a single positional argument specifying the desired state for `PermitRootLogin` (e.g., 'no'). The script must modify the `/etc/ssh/sshd_config` file to set `PermitRootLogin` to the provided value, uncommenting or adding the line if necessary. After successfully modifying the file, it must restart the `sshd` service. The script must output 'true' upon successful completion or 'false' if any step fails.

