# Ensure separate partition exists for /var

Necessity: The '/var' directory is the designated location for variable data, including system logs, mail and print spools, and transient files. Isolating '/var' on its own partition is a critical security and stability measure. It prevents a runaway process or log flood from filling up the root filesystem, which could lead to system instability or a complete crash. This separation also allows for mounting the partition with specific security options (e.g., nodev) and facilitates easier system recovery and backups.

Auditing and Remediation: The audit script verifies if '/var' is a distinct mount point by querying the system's mount table. Remediation is a complex, manual process that should ideally be performed during initial system installation. It involves creating a new partition, moving the contents of the existing '/var' directory to it, and updating the '/etc/fstab' file to mount the new partition automatically at boot. This action cannot be safely automated post-installation without significant risk.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Mounted'. This configuration is binary; either '/var' is on a separate partition, or it is not. There is no middle ground or incremental hardening level. Adhering to this recommendation is a foundational step in hardening a Linux system, aligning with best practices and benchmarks like CIS, to ensure system resilience and availability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Mounted']` |
| **Moderate** | `['Mounted']` |
| **Strict** | `['Mounted']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if '/var' is mounted on a separate partition. The script must output 'true' if it is a separate partition and 'false' if it is not. The output should not contain any other text or formatting.

## Remediation Script Working

This setting requires manual intervention and cannot be remediated automatically. Write a Bash script that accepts a single placeholder argument, prints a message to standard error explaining that creating a separate partition for /var is a manual process, and returns 'false' to indicate that no changes were made.

