# Ensure libpam-pwquality is installed

Necessity: The 'libpam-pwquality' package provides the PAM module 'pam_pwquality.so', which is essential for enforcing password complexity and strength policies on a Linux system. Without this package, the system cannot check new passwords against configurable criteria such as length, character classes (uppercase, lowercase, digits, special characters), and dictionary words. This significantly increases the risk of users choosing weak, easily guessable passwords, making user accounts vulnerable to brute-force attacks and unauthorized access. Auditing and Remediation: The audit script verifies whether the 'libpam-pwquality' package is installed by querying the system's package manager (dpkg). The remediation script uses the package manager (apt-get) to install the package, making the password quality checking module available for integration into the PAM stack. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Installed'. This is a foundational security control with no viable alternative for enforcing password quality through PAM. The presence of this package is a binary requirement; it is either installed and available for configuration, or it is not. Therefore, any security posture, from basic to strict, mandates its installation as a prerequisite for implementing effective password policies.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Installed']` |
| **Moderate** | `['Installed']` |
| **Strict** | `['Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks the installation status of the 'libpam-pwquality' package. The script must output only 'Installed' if the package is present and 'Not Installed' otherwise, with no extra text or formatting.

## Remediation Script Working

bash script that accepts a single positional argument representing the desired state ('Installed'). The script must use 'apt-get install -y libpam-pwquality' to install the package if the argument is 'Installed' and the package is not already present. The script must return 'true' upon successful completion or if the system is already in the desired state, and 'false' on failure.

