# Ensure sshd UsePAM is enabled

Necessity: The 'UsePAM' setting is critical because it integrates the SSH daemon with the Pluggable Authentication Modules (PAM) framework. This enables SSH to leverage the host's centralized authentication policies, such as multi-factor authentication (MFA), password complexity rules, account lockout policies, and session logging. Disabling this setting forces SSH to use its own, more limited authentication mechanisms, bypassing system-wide security controls and significantly weakening the server's security posture against unauthorized access.

Auditing and Remediation: The audit script inspects the live SSH server configuration to determine the current value of the 'UsePAM' directive. The remediation script modifies the '/etc/ssh/sshd_config' file to set 'UsePAM' to the desired state and then reloads the SSH service to enforce the change.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'yes'. This is a binary security control with no intermediate value. Basic security requires PAM integration to enforce standard system access policies. For Moderate and Strict levels, maintaining this setting as 'yes' is non-negotiable, as it is a foundational component for implementing advanced authentication controls like MFA and centralized access logging, which are essential in more secure environments. Disabling it would violate the principle of centralized security management.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['yes']` |
| **Moderate** | `['yes']` |
| **Strict** | `['yes']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that queries the active SSH server configuration for the 'UsePAM' setting. The script must parse the output and return only the value (e.g., 'yes' or 'no'), without any additional text or labels.

## Remediation Script Working

shell script that accepts one positional argument ('yes' or 'no') to configure the 'UsePAM' setting in '/etc/ssh/sshd_config'. The script must find and update the existing 'UsePAM' line, or add it if it does not exist, ensuring any previously commented lines are handled correctly. After modifying the configuration, the script must restart the SSH service to apply the changes. It should return 'true' upon successful completion and 'false' if any step fails.

