# Ensure password number of changed characters is configured

Necessity: The 'difok' parameter in PAM's pwquality module specifies the minimum number of characters in the new password that must not be present in the old password. This setting is crucial for preventing users from making trivial or incremental changes to their passwords (e.g., changing 'Password123!' to 'Password124!'). By enforcing significant changes, it mitigates password reuse attacks and makes it more difficult for an attacker who has compromised an old password to guess the new one. A weak configuration allows for predictable password cycling, undermining the security benefit of password expiration policies.

Auditing and Remediation: The audit script inspects the '/etc/security/pwquality.conf' file to retrieve the current integer value of the 'difok' setting. The remediation script modifies this same file, either updating the existing 'difok' line or adding it if it's missing, to enforce the desired password change complexity.

Recommended State Rationale:
- Basic: A value of '[5, 5]' aligns with the Center for Internet Security (CIS) Benchmark recommendation. It establishes a strong baseline by requiring at least five characters to be different, effectively blocking simple, sequential password updates.
- Moderate: A value of '[7, 7]' enhances security by demanding a more substantial change between old and new passwords. This forces users to create more unique passwords, significantly increasing the difficulty for attackers to predict new credentials based on old ones.
- Strict: A value of '[8, 8]' sets a very high standard for password changes. For a typical 16-character password, this means at least half of the characters must be new, effectively mandating a completely new and unrelated password on each cycle and providing the strongest protection against password cycling attacks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[4, 'upper bound']` |
| **Moderate** | `[7, 'upper bound']` |
| **Strict** | `[8, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

bash script that queries the `/etc/security/pwquality.conf` file for the `difok` setting. The script must parse the file to find the numerical value assigned to `difok`. If the setting is not explicitly configured, the script should return the system's default value. The script's output must be solely the numerical value, with no additional text or formatting.

## Remediation Script Working

bash script that accepts a single numerical value as a command-line argument. The script must modify the `/etc/security/pwquality.conf` file to set the `difok` parameter to the provided value. If the `difok` setting already exists, it must be updated; if it does not exist, it must be added. The script must output `true` upon successful modification and `false` if an error occurs.

