# Ensure local interactive user home directories are configured

Necessity: A home directory is essential for any interactive user account. It serves as the primary storage location for user-specific data, configuration files (dotfiles), and shell history. Without a properly configured home directory, user sessions may fail to initialize correctly, applications can behave unpredictably or crash, and users may be forced to save data in insecure, temporary, or shared locations, posing a security risk. Ensuring every interactive user has a home directory is a fundamental aspect of system integrity and user management.

Auditing and Remediation: The audit script systematically verifies system compliance by parsing the '/etc/passwd' file to identify local interactive users and then checking the filesystem for the existence of their assigned home directory. The remediation script corrects any non-compliance by creating the missing home directories for the identified users, typically using standard system utilities like 'mkhomedir_helper' which ensures correct ownership and permissions are set.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Configured'. This is a binary, foundational setting rather than a tunable parameter. An interactive user account is functionally incomplete and insecure without a home directory. Therefore, there is no lesser acceptable state; the only secure and stable configuration is for all interactive users to have their home directories present. This requirement is consistent across all security hardening standards.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Configured']` |
| **Moderate** | `['Configured']` |
| **Strict** | `['Configured']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks all local users defined in '/etc/passwd' with a UID of 1000 or greater and a valid login shell (i.e., not '/sbin/nologin' or '/bin/false'). For each of these interactive users, the script must verify that their home directory, as specified in '/etc/passwd', exists. The script must output only the string 'true' if all verified users have an existing home directory, and 'false' otherwise.

## Remediation Script Working

Bash script that accepts one positional argument, which must be the string 'configure'. The script will identify all local interactive users (UID >= 1000 and a valid login shell) whose home directory does not exist. For each such user, it will create the home directory with appropriate permissions, for example by using 'mkhomedir_helper <username>'. The script must return 'true' if all missing directories are created successfully or if no action was needed, and 'false' if any creation attempt fails.

