# Ensure sshd PermitRootLogin is disabled

Necessity: The 'root' account is a primary target for brute-force attacks due to its universally known username and unrestricted privileges. Disabling direct root login via SSH is a critical security measure that mitigates this risk significantly. It forces attackers to guess both a valid username and a password, increasing the complexity of an attack. Furthermore, it enforces accountability by requiring administrators to log in with their individual, less-privileged accounts and then use privilege escalation tools like `sudo`, creating a clear audit trail of administrative actions.

Auditing and Remediation: The audit script directly queries the running SSH daemon's configuration to determine the effective value of the `PermitRootLogin` directive, ensuring an accurate report of the current state. The remediation script programmatically alters the `/etc/ssh/sshd_config` file to set the directive to the desired value and reloads the SSH service to apply the change immediately.

Recommended State Rationale:
- Basic: `['prohibit-password']` disables password-based authentication for the root user but still allows secure, key-based authentication. This is a significant improvement over allowing password logins as it prevents brute-force password guessing attacks, while still permitting legitimate, automated administrative access using SSH keys.
- Moderate: `['no']` is the industry standard and recommended setting by benchmarks like CIS. It completely disables the ability for the root user to log in via SSH by any method. This enforces the best practice of logging in as a standard user first and then elevating privileges, which compartmentalizes access and enhances system auditing.
- Strict: `['no']` is the most secure configuration possible for this setting. It aligns with the moderate recommendation because there is no more restrictive option. This state ensures that all administrative access follows a two-step process (login as a regular user, then elevate), which is a cornerstone of secure system administration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['prohibit-password']` |
| **Moderate** | `['no']` |
| **Strict** | `['no']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that executes the command `sshd -T | grep -i '^permitrootlogin' | awk '{print $2}'`. The script must output only the resulting value (e.g., 'no', 'yes', 'prohibit-password') with no extra text or labels.

## Remediation Script Working

bash script that accepts a single positional command-line argument representing the desired state for `PermitRootLogin` (e.g., 'no'). The script must modify the `/etc/ssh/sshd_config` file to set `PermitRootLogin` to the provided value. If the line exists (commented or uncommented), it should be updated. If it does not exist, it should be added. After modifying the file, the script must restart the SSH service to apply the change. The script must output `true` on successful completion or `false` if an error occurs.

