# Ensure root account access is controlled

Necessity: The root account is the most privileged account on a Linux system, making it a primary target for attackers. If an attacker gains access to the root account, they have complete control over the system. Disabling direct login for the root account by locking its password mitigates the risk of brute-force attacks targeting this well-known username. It forces all administrative actions to be performed through `sudo` by authorized, non-root users, which provides a clear audit trail and enforces the principle of least privilege.

Auditing and Remediation: The audit script checks the status of the root account's password by parsing the output of the `passwd -S root` command, which explicitly states whether the account is locked, has a password, or has no password. The remediation script uses the `passwd` utility with the `-l` (lock) or `-u` (unlock) flags to directly modify the account's login state as required.

Recommended State Rationale: Basic, Moderate, and Strict levels all recommend the state 'Locked'. This is a foundational security control with no room for leniency. Permitting direct root login is a significant security risk in any production environment. The universal best practice, endorsed by security frameworks like the CIS Benchmarks, is to always keep the root account locked and delegate administrative privileges via `sudo`. Therefore, 'Locked' is the only acceptable secure configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Locked']` |
| **Moderate** | `['Locked']` |
| **Strict** | `['Locked']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks the status of the root account's password. The script should execute `passwd -S root` and parse the output. If the second field of the output is 'L', the script must return the string 'Locked'. Otherwise, it must return 'Unlocked'. The output should contain only the status string.

## Remediation Script Working

bash script that accepts a single positional argument: 'Locked' or 'Unlocked'. If the argument is 'Locked', the script should execute `passwd -l root`. If the argument is 'Unlocked', it should execute `passwd -u root`. The script must return `true` if the command executes successfully and `false` otherwise.

