# Ensure pam_pwquality module is enabled

Necessity: The `pam_pwquality` module is a critical security component that enforces password complexity requirements for user accounts. Enabling it helps prevent users from choosing weak, easily guessable passwords, thereby mitigating the risk of unauthorized access through brute-force or dictionary attacks. Failure to enable this module leaves all user accounts vulnerable to being compromised by trivial passwords.

Auditing and Remediation: The audit script inspects the output of `pam-auth-update` to verify if the 'Password quality checking' profile is currently active in the system's PAM stack. The remediation script uses the same `pam-auth-update` command with the `--enable` or `--disable` flags to modify the system's PAM configuration, effectively activating or deactivating password complexity enforcement.

Recommended State Rationale: The recommendation for all hardening levels (Basic, Moderate, and Strict) is 'Enabled'. This is a foundational security setting; password quality checking should always be active. The distinction between security levels is not in whether the module is enabled, but in the specific complexity rules configured within the associated configuration file (e.g., `/etc/security/pwquality.conf`). Enabling the module is the non-negotiable first step required to apply any level of password policy.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'Password quality checking' profile is enabled in PAM. The script should use `pam-auth-update --display` and parse the output to determine the status. It must return only the string 'Enabled' if the profile is active (`[*]`) and 'Disabled' otherwise, with no extra text.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must execute `pam-auth-update --force --enable pwquality`. If 'Disabled', it must execute `pam-auth-update --force --disable pwquality`. The script must return `true` on success and `false` on failure.

