# Ensure pam_unix module is enabled

Necessity: The 'pam_unix' module is the cornerstone of traditional password-based authentication on Linux systems, responsible for verifying user passwords against the local '/etc/shadow' file. Disabling this module would prevent users from logging in using their local passwords, potentially locking administrators out of the system and causing a denial-of-service condition unless a different primary authentication mechanism (like SSSD or Kerberos) is correctly configured and intended to be the sole method. Ensuring it is enabled is critical for maintaining local access and operational stability.

Auditing and Remediation: The audit script inspects the configuration managed by 'pam-auth-update' to verify if the 'Unix authentication' profile is active. The remediation script directly interacts with 'pam-auth-update' using the '--enable' or '--disable' flags to toggle the state of the 'pam_unix' module within the system's PAM stack, ensuring the change is applied consistently.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'enabled'. This is not a setting that offers degrees of security hardening; it is a foundational component. For any system that relies on local password-based authentication, 'pam_unix' must be enabled. Disabling it is not a security enhancement but a severe misconfiguration that breaks a primary access vector. Therefore, the only secure and functional recommendation is to ensure it remains enabled across all security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'Unix authentication' profile is enabled in PAM. The script must use the 'pam-auth-update --display' command, parse the output to determine if the profile is active (indicated by '[*]'), and return only the string 'enabled' or 'disabled'.

## Remediation Script Working

Bash script that accepts one positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script will execute 'pam-auth-update --enable unix --force'. If 'disabled', it will execute 'pam-auth-update --disable unix --force'. The script must return 'true' upon successful execution or 'false' if it fails or receives an invalid argument.

