# Ensure latest version of pam is installed

Necessity: Pluggable Authentication Modules (PAM) are a critical foundation for authentication and session management on Linux systems. Vulnerabilities within PAM packages can lead to severe security breaches, including authentication bypass, privilege escalation, and unauthorized system access. Failing to install the latest version leaves the system exposed to known exploits that have been addressed by security patches.

Auditing and Remediation: The audit script verifies if the system's core PAM package ('libpam-runtime') is at the latest version available from its configured software repositories. It reports whether the system is 'up-to-date' or if an 'update-available' is pending. The remediation script ensures the package lists are refreshed and then installs the latest version of 'libpam-runtime', effectively applying all available security patches for the component.

Recommended State Rationale: 
- Basic: The only acceptable state is 'up-to-date'. Any other status indicates that the system is missing security patches and is potentially vulnerable.
- Moderate & Strict: There is no functional difference between security levels for this control. The authentication framework is a foundational security component that must be kept current. The risk of running an outdated version is high regardless of other security measures in place. Therefore, all security postures mandate that the latest version be installed.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['up-to-date']` |
| **Moderate** | `['up-to-date']` |
| **Strict** | `['up-to-date']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks if the core PAM package, 'libpam-runtime', is up-to-date. The script must first silently refresh the package lists (e.g., using 'apt-get update'). It should then determine if an upgrade is available for 'libpam-runtime'. If an upgrade is pending, the script must return the string 'update-available'. If the package is already at the latest version, it must return 'up-to-date'. The script must not output any other text or formatting.

## Remediation Script Working

bash script that accepts a single positional argument representing the desired state ('up-to-date'). If the argument is 'up-to-date', the script must silently refresh the package lists and then install the latest version of the 'libpam-runtime' package (e.g., using 'apt-get install -y libpam-runtime'). The script must return the boolean 'true' upon successful completion or if the package was already up-to-date, and 'false' if any part of the process fails.

