# Ensure pam_faillock module is enabled

Necessity: The pam_faillock module provides a critical security function by locking user accounts after a specified number of consecutive failed login attempts. This is a primary defense mechanism against automated brute-force password guessing attacks. An attacker with unlimited login attempts could eventually compromise an account. Misconfiguration or disabling this module leaves the system highly vulnerable to such attacks.

Auditing and Remediation: The audit script checks the system's authentication configuration to verify that the pam_faillock feature is active. The remediation script utilizes the 'authconfig' utility, which is the standard command-line tool on CentOS for modifying the system authentication configuration, to either enable or disable the pam_faillock module by altering the Pluggable Authentication Modules (PAM) stack.

Recommended State Rationale: The recommended state for all levels is 'Enabled' because account lockout is a fundamental security control. 
- Basic: Enabling pam_faillock is the minimum requirement for protecting against brute-force attacks. There is no secure baseline that permits this module to be disabled.
- Moderate: This state remains 'Enabled'. The distinction for a moderate configuration would typically involve adjusting the module's parameters (e.g., decreasing the number of allowed failed attempts), but the module itself must be active.
- Strict: For the highest level of security, the module must be enabled. A strict policy would enforce this and complement it with very aggressive lockout parameters, such as a low failure threshold and a long lockout duration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the pam_faillock module is enabled using the 'authconfig --test' command. The script should parse the output to determine if 'pam_faillock' is enabled. The script must output only the string 'Enabled' or 'Disabled' and nothing else.

## Remediation Script Working

Bash script that accepts a single positional command-line argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must execute 'authconfig --enablefaillock --update'. If the argument is 'Disabled', it must execute 'authconfig --disablefaillock --update'. The script must return the boolean 'true' on success or 'false' on failure.

