# Ensure sshd PermitRootLogin is disabled

Necessity: Allowing remote login directly to the root account via SSH is a significant security risk. The root account is a well-known, high-value target for attackers. Exposing it to remote access invites automated brute-force password attacks. If an attacker successfully compromises the root password, they gain complete and unrestricted control over the entire system. Disabling root login mitigates this threat by forcing all administrative access through non-privileged user accounts, which must then use privilege escalation tools like 'sudo'. This practice adds a layer of security and ensures that all administrative actions are auditable and tied to a specific user account. 

Auditing and Remediation: The audit script examines the active SSH server configuration file ('/etc/ssh/sshd_config') to determine the current state of the 'PermitRootLogin' directive. The remediation script modifies this file to set 'PermitRootLogin' to the specified value (typically 'no'), creating the line if it doesn't exist or changing it if it does. It then restarts the SSH service to apply the configuration change. 

Recommended State Rationale: 
- Basic: Recommends ['no']. Disabling direct root login is a fundamental first step in securing any server and is mandated by security benchmarks like CIS. 
- Moderate: Recommends ['no']. There is no middle ground for this setting. The security principle is clear: do not allow direct root login. 
- Strict: Recommends ['no']. The strictest and most secure configuration is to completely disable root login, enforcing the best practice of privilege escalation through 'sudo'. Other options like 'prohibit-password' still allow key-based root login, which is less secure than disabling it entirely.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['no']` |
| **Moderate** | `['no']` |
| **Strict** | `['no']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that inspects the '/etc/ssh/sshd_config' file to find the effective value of the 'PermitRootLogin' setting. The script should output only the value (e.g., 'no', 'yes', 'prohibit-password'), with no additional text or labels. If the setting is not explicitly defined, it should return the system's default value.

## Remediation Script Working

bash script that takes a single positional argument (e.g., 'no') to set the 'PermitRootLogin' value in the '/etc/ssh/sshd_config' file. The script must correctly uncomment, modify, or add the setting as needed. After applying the change, the script must restart the sshd service. It must return 'true' on successful application of the setting and 'false' on failure.

