# Ensure password dictionary check is enabled

Necessity: Enabling the password dictionary check is a critical security measure that prevents users from creating passwords based on common words found in a dictionary. Attackers often use dictionary attack methods, which cycle through lists of common words, to crack passwords. By enforcing this check, the system significantly reduces the risk of accounts being compromised through simple password guessing or brute-force attacks. Disabling this feature makes user accounts highly vulnerable.

Auditing and Remediation: The audit script verifies the configuration by reading the `dictcheck` value from the `/etc/security/pwquality.conf` file. A value of '1' indicates the check is enabled. The remediation script directly modifies this file, ensuring the `dictcheck` parameter is set to '1', thereby activating the control system-wide for all future password changes.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is '1' (enabled). This is a foundational binary control; it is either on or off. There is no intermediate state. A secure system must prevent the use of easily guessable, dictionary-based passwords. Therefore, this setting should be enabled in any environment, making '1' the only acceptable value for all security hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['1']` |
| **Strict** | `['1']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the `/etc/security/pwquality.conf` file to determine the current state of the password dictionary check. The script should parse the file for the `dictcheck` setting, ignoring any commented lines. It must output only the numerical value of the setting (e.g., '1'). If the setting is not explicitly defined, the script should return the system's default value, which is '1'.

## Remediation Script Working

Bash script that accepts a single positional command-line argument to configure the `dictcheck` setting in `/etc/security/pwquality.conf`. The script must either update the existing uncommented `dictcheck` entry or add it if it does not exist. The script must return `true` upon successful configuration and `false` if an error occurs.

