# Ensure password quality is enforced for the root user

Necessity: The 'root' user is the most privileged account on a Linux system. A weak or compromised root password provides an attacker with complete control. By default, password quality rules defined by `pam_pwquality` are often not applied to the root user, creating a significant security vulnerability. Enforcing these rules for root ensures that its password meets the same complexity, length, and history requirements as other user accounts, drastically reducing the risk of a brute-force or dictionary attack succeeding.

Auditing and Remediation: The audit script examines the central PAM configuration files (`system-auth` and `password-auth`) to verify the presence of the `enforce_for_root` directive on the `pam_pwquality.so` module line. The remediation script directly modifies these files by either adding this directive to enable enforcement or removing it to disable it, thus configuring the system's password policy for the root account.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'enforced'. There is no security justification for allowing the system's most powerful account to have a password that bypasses established quality policies. This is a foundational security control, and its enforcement is mandated by security benchmarks like the CIS controls. The distinction between levels is not applicable here, as the setting is binary and fundamental for any secure configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enforced']` |
| **Moderate** | `['enforced']` |
| **Strict** | `['enforced']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the PAM configuration in `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth`. The script must inspect the line containing `pam_pwquality.so` to determine if the `enforce_for_root` option is present. If this option is set in the relevant file(s), the script must output the string 'enforced'. Otherwise, it must output 'not enforced'. The output must contain only the resulting string value.

## Remediation Script Working

Bash script that accepts a single positional argument: 'enforced' or 'not enforced'. The script must modify the `/etc/pam.d/system-auth` and `/etc/pam.d/password-auth` files. If the argument is 'enforced', it must add the `enforce_for_root` option to the line containing `pam_pwquality.so`. If the argument is 'not enforced', it must remove the option. The script must return `true` if the configuration is successfully changed or already in the desired state, and `false` on failure.

