# Ensure separate partition exists for /home

Necessity: Separating the /home directory into its own partition is crucial for both system stability and security. It prevents user-created files from filling up the root filesystem, which could render the system unstable or unusable. This separation also allows for applying specific, restrictive mount options to the /home partition (such as 'nodev', 'nosuid', and 'noexec') that harden the system against certain attacks by preventing the execution of unauthorized programs or the creation of device files within user directories.

Auditing and Remediation: The audit script verifies the system's mount configuration by checking if '/home' is listed as a distinct filesystem from the root ('/') partition. Remediation is a manual, high-risk administrative task that should be performed during OS installation. Attempting to partition a live filesystem can lead to irreversible data loss.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Mounted'. This is a binary, foundational configuration with no intermediate states. The benefits of filesystem separation for stability and security are significant, making it a universal best practice recommended by security frameworks like the CIS Benchmarks. Failing to implement this exposes the system to denial-of-service risks from filesystem exhaustion and weakens its defense against malicious user-level code execution.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Mounted']` |
| **Moderate** | `['Mounted']` |
| **Strict** | `['Mounted']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if '/home' is a separate mount point. The script must output 'Mounted' if it is a separate partition, and 'Not Mounted' if it is not. The output must only be the string value, with no additional text or formatting.

## Remediation Script Working

This configuration must be implemented during the initial operating system installation. Remediation on a running system is a complex manual process involving partition resizing and data migration, which carries a high risk of data loss and cannot be safely automated. Therefore, a remediation script should simply output a message stating this and return 'false'.

