# Ensure password dictionary check is enabled

Necessity: Enabling the password dictionary check is crucial for enforcing strong password policies. This feature, controlled by 'pam_pwquality', prevents users from creating passwords based on common dictionary words, names, or easily guessable terms. Attackers frequently use dictionary attack methods to compromise accounts with weak passwords. Disabling this check significantly increases the risk of successful brute-force attacks and unauthorized access. Auditing and Remediation: The audit script inspects the '/etc/security/pwquality.conf' file to determine the current value of the 'dictcheck' parameter, where '1' signifies it is enabled. The remediation script directly modifies this configuration file to set 'dictcheck = 1', thereby activating the control. Recommended State Rationale: The recommended state for all levels—Basic, Moderate, and Strict—is ['1'] (Enabled). This is a binary control; it is either on or off, with no intermediate state. The Basic level requires it to be enabled as a fundamental security best practice. The Moderate and Strict levels reiterate this requirement because disabling the dictionary check creates an unacceptable security weakness, regardless of other password complexity settings. It is a foundational component of a robust authentication security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the '/etc/security/pwquality.conf' file for the 'dictcheck' setting. The script must parse the file to find the effective value, handling cases where the setting is commented out or absent (which defaults to disabled). The script should output only the resulting numeric value (e.g., '1' for enabled or '0' for disabled), with no extra text or labels.

## Remediation Script Working

Bash script that modifies the '/etc/security/pwquality.conf' file to configure the 'dictcheck' setting. The script must accept a single positional command-line argument representing the desired value (e.g., './script.sh 1'). The script should use a tool like 'sed' to find and replace an existing 'dictcheck' line (commented or uncommented) or add it if it doesn't exist. The script must output 'true' on successful modification or 'false' if an error occurs.

