# Ensure pam_unix module is enabled

The pam_unix module is a fundamental component of the Pluggable Authentication Modules (PAM) stack on Linux systems. It is responsible for handling traditional Unix-style authentication, verifying user passwords against the /etc/shadow file, and managing account policies like expiration and locking. Disabling this module will prevent local users from logging into the system, effectively locking them out. The primary risk of misconfiguration is a denial-of-service condition for all local user accounts. The audit script verifies that the pam_unix.so library is correctly configured in the primary PAM authentication files. The remediation script uses standard system utilities to rebuild the PAM stack correctly, ensuring the pam_unix module is enabled. For all security levels (Basic, Moderate, and Strict), the recommended state is 'Enabled'. This is not a tunable security setting but a core operational requirement for any system that needs to support local user authentication. There is no scenario in a standard configuration where disabling this module is recommended or secure; its absence is a critical system failure.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the active PAM configuration files (e.g., /etc/pam.d/system-auth, /etc/pam.d/password-auth) to determine if the 'pam_unix.so' module is included and not commented out. The script must output only the string 'Enabled' if it is present and active in the authentication stack, or 'Disabled' otherwise, with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which must be the string 'Enabled'. The script should use the system's standard PAM configuration tool (e.g., 'authconfig --enableunix --update' or an equivalent 'authselect' command) to ensure the pam_unix module is activated. The script must return the boolean value 'true' on success and 'false' on failure or if the input argument is not 'Enabled'.

