# Ensure password quality checking is enforced

Necessity: Enforcing password quality checking via the `pam_pwquality` module is a fundamental security control. It prevents users from setting weak, easily guessable passwords (e.g., 'password123', 'admin', dictionary words). Without this enforcement, systems are highly susceptible to brute-force and dictionary attacks, which can lead to unauthorized access and system compromise. Misconfiguration effectively disables password complexity rules, creating a significant security vulnerability.

Auditing and Remediation: The audit script inspects the core PAM configuration files to confirm that the `pam_pwquality.so` module is loaded as part of the password management stack. The remediation script modifies these files to add or enable the module, thereby activating system-wide password strength and complexity requirements for all local users.

Recommended State Rationale: A state of 'Enforced' is recommended for all security levels (Basic, Moderate, and Strict). There is no secure alternative to enforcing password quality; it is a foundational requirement. The differentiation between security levels is not in whether this module is enabled, but in the specific arguments passed to it (e.g., minimum length, credit requirements for different character classes), which are defined in separate security settings. Therefore, the 'Enforced' state is the universal baseline for any secure system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enforced']` |
| **Moderate** | `['Enforced']` |
| **Strict** | `['Enforced']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the PAM configuration files, specifically `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth`, to verify if the `pam_pwquality.so` module is present and active (not commented out) in the `password` stack. The script must output 'Enforced' if the module is correctly configured in both files, and 'Not Enforced' otherwise. The output must consist solely of the resulting string value.

## Remediation Script Working

Bash script that accepts a single positional argument, which should be 'Enforced'. The script must ensure that the line `password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=` is present and active in both `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth`. On systems using `authselect`, it should enable the `with-pwquality` feature. The script must return `true` on successful configuration or if the system is already compliant, and `false` on failure.

