# Ensure password same consecutive characters is configured

Necessity: This setting controls the maximum number of allowed consecutive identical characters in a password. Enforcing a limit is crucial for strengthening password policy, as it prevents users from creating easily guessable passwords that rely on simple repetition (e.g., 'Pa$$w0rd1111'). Such patterns are trivial to break with dictionary and brute-force attacks. Leaving this unconfigured significantly weakens password complexity and increases the risk of unauthorized access.

Auditing and Remediation: The audit script inspects the `/etc/security/pwquality.conf` file to determine the currently configured value for `maxrepeat`. The remediation script modifies this same file, setting the `maxrepeat` parameter to the desired value. This change is enforced by the `pam_pwquality` module whenever a user attempts to change their password.

Recommended State Rationale:
- Basic `[3, 3]`: Establishes a fundamental security baseline by preventing passwords with four or more identical consecutive characters (e.g., 'aaaa'). This effectively blocks the most obvious and low-effort repetitive patterns.
- Moderate `[2, 2]`: Enhances security by limiting consecutive characters to a maximum of two (e.g., disallowing 'aaa'). This forces users to introduce more variety into their passwords, making them more resistant to guessing.
- Strict `[1, 1]`: Implements the most secure configuration by disallowing any identical consecutive characters (e.g., 'aa'). This aligns with high-security standards like CIS Benchmarks, compelling the creation of complex passwords that are significantly harder to compromise.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[3, 1]` |
| **Moderate** | `[2, 1]` |
| **Strict** | `[1, 1]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the `maxrepeat` setting from `/etc/security/pwquality.conf`. The script should parse the file to find the uncommented `maxrepeat` value. If the setting is not explicitly defined, the script should return the system default of '0', which indicates the check is disabled. The script must output only the numerical value.

## Remediation Script Working

Bash script that accepts a single numerical value as a command-line argument to configure the `maxrepeat` setting in `/etc/security/pwquality.conf`. The script should either modify the existing `maxrepeat` entry or add it if it does not exist. The script must return `true` if the configuration is successfully applied, and `false` otherwise.

