# Ensure password quality is enforced for the root user

Necessity: The 'pam_pwquality' module enforces password complexity requirements for users, including the root user. This is a critical defense against brute-force and dictionary attacks. By requiring passwords to meet certain criteria (e.g., length, character classes), it significantly increases the difficulty for an attacker to guess or crack credentials. Failing to enforce password quality for the root user creates a severe vulnerability, as a compromised root account provides an attacker with complete control over the system.

Auditing and Remediation: The audit script verifies that the 'pam_pwquality.so' module is actively configured within the system's PAM stack, specifically in the 'common-password' file which applies to user password changes. The remediation script directly manipulates this configuration file to either enable or disable the module, thereby controlling whether password quality rules are enforced.

Recommended State Rationale: The recommended state is uniformly 'enforced' across all security levels (Basic, Moderate, and Strict). There is no secure scenario where password quality checks should be disabled, particularly for the root account. Basic security requires this module to be active. Moderate and Strict levels maintain this requirement as it is a foundational security control. While further hardening would involve tuning the specific parameters within 'pam_pwquality' (e.g., minlen, dcredit), the initial step of ensuring the module itself is active is non-negotiable.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enforced']` |
| **Moderate** | `['enforced']` |
| **Strict** | `['enforced']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that inspects the PAM configuration in '/etc/pam.d/common-password'. The script must check if a line containing 'pam_pwquality.so' is present and not commented out. If it is active, the script must return the string 'enforced'. Otherwise, it must return 'not enforced'. The output should be exclusively the returned string.

## Remediation Script Working

shell script that accepts a single positional argument: 'enforced' or 'not enforced'. The script must modify the '/etc/pam.d/common-password' file. If the argument is 'enforced', it must add or uncomment the line 'password requisite pam_pwquality.so retry=3'. If the argument is 'not enforced', it must comment out this line. The script must return 'true' on success and 'false' on failure.

