# Ensure password failed attempts lockout includes root account

Necessity: The root account is the most privileged account on a Linux system. Allowing unlimited failed login attempts for this account creates a significant security risk, as it makes it vulnerable to brute-force password guessing attacks. By ensuring that the `pam_faillock` module applies its lockout policy to the root user, this setting provides a critical layer of defense against unauthorized access to the system's ultimate administrative account. Failure to enforce this can lead to a complete system compromise.

Auditing and Remediation: The audit script verifies the system's security posture by checking the PAM configuration files for the `even_deny_root` parameter within the `pam_faillock.so` module line. This confirms whether the root account is subject to the failed attempt lockout policy. The remediation script directly modifies these configuration files to either add (`Enabled`) or remove (`Disabled`) the `even_deny_root` parameter, thereby aligning the system with the desired security policy.

Recommended State Rationale: 
- Basic: `['Enabled']` - Protecting the root account from brute-force attacks is a fundamental security practice. Even a basic security posture should include this control to prevent trivial compromise of the most powerful account.
- Moderate: `['Enabled']` - A moderate security level maintains this setting as enabled, recognizing its critical importance in a defense-in-depth strategy. There is no security justification for weakening this control.
- Strict: `['Enabled']` - For a strict security environment, enforcing lockouts on the root account is non-negotiable. While there is a minor administrative risk of an accidental root lockout, this is outweighed by the severe risk of a brute-force compromise. Proper recovery procedures (e.g., using a boot disk or console access) should be in place to mitigate any lockout issues.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the PAM configuration files, specifically `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth`. The script must inspect the line containing `auth required pam_faillock.so` to determine if the `even_deny_root` option is present. The script should output 'Enabled' if the option is found and configured correctly, and 'Disabled' otherwise. The output must consist solely of the resulting value without any additional text or formatting.

## Remediation Script Working

Bash script that modifies the PAM configuration in `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth`. The script must accept a single positional command-line argument: 'Enabled' or 'Disabled'. When 'Enabled' is passed, the script must add the `even_deny_root` option to the line containing `auth required pam_faillock.so`. If 'Disabled' is passed, it must remove the `even_deny_root` option from that line. The script must return `true` upon successful completion or `false` if an error occurs.

