# Ensure libpam-modules is installed

Necessity: The 'libpam-modules' package contains the Pluggable Authentication Modules (PAM), which are a critical component of the Linux authentication infrastructure. PAM provides a flexible framework for applications to authenticate users, manage account policies, and handle session management. Without this package, essential services like login, sshd, and sudo would be unable to authenticate users, rendering the system insecure and potentially inaccessible. Ensuring it is installed is fundamental to system security and operational integrity.

Auditing and Remediation: The audit script verifies the installation status of the 'libpam-modules' package by querying the system's package manager (dpkg). The remediation script uses the package manager (apt-get) to install the package if it is found to be missing, thereby restoring the system's core authentication capabilities.

Recommended State Rationale: 
Basic, Moderate, and Strict: The recommended state for all hardening levels is 'Installed'. The 'libpam-modules' package is an essential system component, not an optional security feature. There is no functional or secure configuration where this package would be deliberately uninstalled on a standard Ubuntu system. Its presence is a binary requirement for security, making a tiered recommendation unnecessary. The only secure state is to have it installed.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the installation status of the 'libpam-modules' package. The script must use `dpkg-query` to determine if the package is installed. If the package is present and properly installed, the script must return only the string 'Installed'. If the package is not installed, it must return 'Not Installed'. No other text or formatting should be included in the output.

## Remediation Script Working

Bash script that ensures the 'libpam-modules' package is installed. The script must accept one positional command-line argument representing the desired state (e.g., 'Installed'). If the argument is 'Installed', the script should execute `apt-get update` followed by `apt-get install -y libpam-modules`. The script must return 'true' upon successful installation or if the package is already installed, and 'false' if the installation fails.

