# Ensure separate partition exists for /home

Necessity: Segregating the /home directory onto its own partition is a critical security and system administration best practice. This separation prevents user-space activities from impacting the core operating system. For example, if a user or process fills their home directory with data, it will not exhaust space on the root filesystem, which could lead to system instability or a complete failure. It also allows administrators to apply specific, more restrictive mount options to the /home partition (such as 'nodev', 'nosuid', and 'noexec') to mitigate risks from user-uploaded or user-compiled files without affecting system operations. Auditing and Remediation: The audit script verifies the system's mount table to determine if the device mounted at /home is distinct from the one mounted at the root directory (/). Remediation is a complex, manual process that must be performed by a system administrator during system installation or through careful disk management on a live system. It is not suitable for automation due to the high risk of data loss. Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'true' because this is a foundational control. There is no intermediate state; the partition is either separate or it is not. Implementing this control provides a fundamental layer of separation between user data and system files, which is essential for a securely configured and stable system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['true']` |
| **Moderate** | `['true']` |
| **Strict** | `['true']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks if /home is mounted on a separate partition. The script must output only 'true' if it is a separate partition and 'false' if it is not, with no additional text or formatting.

## Remediation Script Working

This control cannot be remediated via an automated script. The process of creating a new partition, migrating data, and updating the fstab file is a manual administrative task that carries a high risk of data loss if not performed correctly. The script should take no action and must return 'false' to indicate that automated remediation is not supported.

