# Ensure libpam-modules is installed

Necessity: Pluggable Authentication Modules (PAM) form a critical, generalized API for authentication-related services on Linux systems. The 'pam' package provides the core libraries and modules necessary for managing user authentication, password policies, session management, and access control. Without this fundamental package, the system cannot properly authenticate users for login, sudo, SSH, or other services, leading to a complete failure of access control and rendering the system insecure and potentially unusable. Ensuring it is installed is a foundational requirement for any secure system.

Auditing and Remediation: The audit script verifies the presence of the 'pam' RPM package, which is the correct package for CentOS systems (as opposed to 'libpam-modules' which is for Debian-based systems). The remediation script uses the system's native package manager ('yum' or 'dnf') to install the 'pam' package if it is determined to be missing.

Recommended State Rationale: 
Basic, Moderate, and Strict: The recommended state for all hardening levels is 'Installed'. The 'pam' package is not an optional security feature but an essential component of the operating system's security framework. There is no less-secure-but-functional alternative; its absence constitutes a critical system misconfiguration. Therefore, the only acceptable state for any operational and secure system is to have the package installed.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the installation status of the 'pam' package using the 'rpm' command. The script must output only 'Installed' if the package is present, or 'Not Installed' if it is not.

## Remediation Script Working

Bash script that accepts a single command-line argument representing the desired state ('Installed'). If the argument is 'Installed', the script must use 'yum' or 'dnf' to install the 'pam' package. The script must output 'true' upon successful installation or if the package is already present, and 'false' if the installation fails or the input argument is not 'Installed'.

