# Ensure sshd UsePAM is enabled

Necessity: The 'UsePAM' directive in the SSH server configuration enables the use of Pluggable Authentication Modules (PAM). PAM provides a flexible and centralized framework for handling authentication, authorization, and session management. Enabling it allows SSH to integrate with system-wide authentication policies, including multi-factor authentication (MFA), centralized user directories (LDAP, Kerberos), password complexity rules, and account lockout policies. Disabling 'UsePAM' forces SSH to rely solely on its own basic authentication mechanisms (e.g., /etc/passwd, /etc/shadow), bypassing critical security controls and increasing the risk of unauthorized access.

Auditing and Remediation: The audit script directly queries the running SSH daemon's effective configuration to determine if PAM is enabled. The remediation script modifies the '/etc/ssh/sshd_config' file to explicitly set 'UsePAM yes' and reloads the SSH service, ensuring that all subsequent SSH connections are subject to the system's PAM policies.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'yes'. This is a foundational security setting, not a granular control. 
- Basic: ['yes'] is the minimum requirement for any securely managed system, ensuring SSH adheres to central authentication rules.
- Moderate: ['yes'] maintains this state, as disabling PAM introduces an unacceptable security gap.
- Strict: ['yes'] is required because there is no more secure alternative. Any system requiring high security must leverage advanced authentication mechanisms, which are exclusively available through PAM.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['yes']` |
| **Moderate** | `['yes']` |
| **Strict** | `['yes']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that queries the effective SSH server configuration for the 'UsePAM' setting and prints only its current value (e.g., 'yes' or 'no') to standard output. The script should execute a command like `sshd -T | grep -i '^usepam' | awk '{print $2}'` to ensure only the value is returned.

## Remediation Script Working

shell script that accepts a single positional command-line argument ('yes' or 'no'). The script must update the '/etc/ssh/sshd_config' file to set the 'UsePAM' directive to the provided value. If the directive exists (commented or not), it should be updated; if not, it should be appended. The script must then restart the SSH service to apply the change. It must return 'true' on success and 'false' on failure.

