# Ensure password quality checking is enforced

Necessity: The `pam_pwquality` module is essential for enforcing password complexity rules on a Linux system. It prevents users from choosing weak, easily guessable passwords by setting requirements for length, character classes (uppercase, lowercase, digits, special characters), and other quality metrics. Without this enforcement, the system is highly vulnerable to brute-force and dictionary attacks, which could lead to unauthorized access and system compromise. Misconfiguring or disabling this module negates a fundamental layer of credential security.

Auditing and Remediation: The audit script inspects the Pluggable Authentication Modules (PAM) configuration, specifically the `/etc/pam.d/common-password` file, to determine if the `pam_pwquality.so` module is actively included in the password management stack. The remediation script directly modifies this file. When instructed to 'enable', it adds or uncomments the required line to enforce password quality checks. When instructed to 'disable', it comments out the line, effectively turning off the checks.

Recommended State Rationale: 
- Basic: `['enabled']`. Enforcing password quality is a baseline security requirement. There is no scenario in a basic security posture where this should be disabled.
- Moderate: `['enabled']`. Similar to the basic level, this is a non-negotiable setting for any moderately secure system.
- Strict: `['enabled']`. For a strict security posture, this module must be enabled. The level of strictness is then defined by the parameters configured for `pam_pwquality` in `/etc/security/pwquality.conf` (e.g., longer minimum length, more required character classes), but the enforcement module itself is a simple binary state of enabled or disabled. Therefore, enabling it is the universal recommendation across all security levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the `/etc/pam.d/common-password` file. The script should verify if the `pam_pwquality.so` module is configured and not commented out. If it is correctly configured, the script must output only the string 'enabled'. Otherwise, it must output only the string 'disabled'.

## Remediation Script Working

Bash script that accepts a single positional argument: 'enabled' or 'disabled'. If the argument is 'enabled', the script must ensure the line `password requisite pam_pwquality.so retry=3` exists and is not commented out in `/etc/pam.d/common-password`. If the argument is 'disabled', it must comment out this line. The script must return `true` upon successful modification and `false` if it fails or receives an invalid argument.

