# Ensure password maximum sequential characters is configured

Necessity: The `maxclass` setting in the `pam_pwquality` module defines the maximum number of consecutive characters of the same class (lowercase, uppercase, digits, others) allowed in a new password. Enforcing a limit on sequential characters prevents users from creating weak, easily guessable passwords that rely on simple, repetitive patterns (e.g., 'passwordAAAA' or 'admin1111'). This significantly increases password complexity and entropy, making user accounts more resilient to brute-force and dictionary-based attacks. Misconfiguration leaves the system vulnerable to credential compromise through weak password exploitation.

Auditing and Remediation: The audit script inspects the `/etc/security/pwquality.conf` file to retrieve the current configured value for `maxclass`. The remediation script directly modifies this file, either updating the existing `maxclass` entry or adding it if it is not present, to enforce the desired password construction policy.

Recommended State Rationale:
- Basic: A value of `[4, 4]` is a common baseline recommended by security frameworks like the CIS Benchmarks. It effectively prevents long, simplistic sequences (e.g., 'aaaaa' or '11111') while remaining user-friendly.
- Moderate: A value of `[3, 3]` offers a higher level of security by further tightening the restriction, disallowing shorter sequences like 'aaaa' or '1111'.
- Strict: A value of `[2, 2]` provides a very strong security posture by preventing even two consecutive characters of the same class (e.g., 'aa', 'BB', '11'). This forces users to create more complex and varied passwords, significantly increasing the difficulty for attackers to guess or crack them.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[3, 1]` |
| **Moderate** | `[2, 1]` |
| **Strict** | `[1, 1]` |
| **Type** | `RANGE` |

## Audit Script Working

bash script that queries the `/etc/security/pwquality.conf` file to find the value of the `maxclass` setting. The script should parse the file to locate the `maxclass` key, ignoring any commented-out lines, and return only the numerical value associated with it.

## Remediation Script Working

bash script that takes a single numerical value as a positional command-line argument. The script should modify the `/etc/security/pwquality.conf` file to set the `maxclass` parameter to the provided value. If the `maxclass` setting already exists (commented or not), it should be updated. If it does not exist, it should be added. The script must output `true` upon successful modification and `false` if an error occurs.

