# Ensure password number of changed characters is configured

Necessity: The 'difok' parameter in the pam_pwquality module specifies the minimum number of characters that must be different between a new password and the old one. This setting is crucial for preventing users from making trivial, predictable changes to their passwords (e.g., changing 'Password2023!' to 'Password2024!'). Such minor modifications undermine the effectiveness of password history policies, as an attacker who has compromised one password can easily guess subsequent ones. A misconfigured or unset 'difok' value significantly weakens password security and increases the risk of account compromise through credential guessing. Auditing and Remediation: The audit script inspects the /etc/security/pwquality.conf file to determine the currently configured value for 'difok'. The remediation script directly modifies this file, either updating the existing 'difok' line or adding it if it's absent, to enforce the desired password change complexity. Recommended State Rationale: Basic ([4, 4]): This state establishes a baseline that prevents the most common incremental password changes, forcing users to think of a more distinct password. Moderate ([7, 7]): This significantly strengthens the policy by requiring that approximately half of a typical secure password (e.g., 14 characters) be changed. It provides a strong defense against pattern-based password reuse without being overly burdensome. Strict ([8, 'upper bound']): This setting offers the highest level of security by mandating a substantial change, effectively forcing the creation of a completely new and unrelated password. This is recommended for high-security environments where the risk of credential compromise is severe.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[4, 'upper bound']` |
| **Moderate** | `[7, 'upper bound']` |
| **Strict** | `[8, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the /etc/security/pwquality.conf file to find the value of the 'difok' setting. The script should parse the file, extract the numerical value assigned to 'difok', and output only this value. If 'difok' is not explicitly set or is commented out, the script should return nothing.

## Remediation Script Working

Bash script that takes a single numerical value as a positional command-line argument. The script should modify the /etc/security/pwquality.conf file to set the 'difok' parameter to the provided value. If the parameter already exists (commented or not), its line should be updated; otherwise, it should be added to the file. The script must return 'true' on successful modification and 'false' on failure.

