# Ensure minimum password length is configured

Necessity: Enforcing a minimum password length is a fundamental security control that defends against brute-force and dictionary attacks. Shorter passwords can be cracked in minutes or even seconds with modern hardware. A failure to enforce a strong minimum length significantly increases the risk of unauthorized access and system compromise. Auditing and Remediation: The audit script inspects the '/etc/security/pwquality.conf' file to verify the current value of the 'minlen' parameter, which is enforced by the 'pam_pwquality' module during password changes. The remediation script modifies this same file to set the 'minlen' parameter to the desired value, ensuring all future passwords meet the new minimum length requirement. Recommended State Rationale: The Basic state of [14, 14] aligns with established security benchmarks like CIS, providing a strong defense against common cracking techniques. The Moderate state of [16, 16] increases the computational difficulty of cracking passwords exponentially, suitable for systems with sensitive data. The Strict state of [24, 'upper bound'] is recommended for high-security environments, as passwords of this length are currently considered computationally infeasible to crack, offering maximum protection against brute-force attacks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[14, 'upper bound']` |
| **Moderate** | `[16, 'upper bound']` |
| **Strict** | `[18, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the '/etc/security/pwquality.conf' file for the 'minlen' setting. The script must parse the file, ignoring any commented-out lines, and return only the numerical value. If the setting is not explicitly defined, the script should return the system's default value.

## Remediation Script Working

Bash script that sets the 'minlen' value in the '/etc/security/pwquality.conf' file. The script must accept a single positional command-line argument for the desired minimum length. It should either update the existing 'minlen' setting or append it if it does not exist. The script must return 'true' on success and 'false' on failure.

