# Ensure libpam-pwquality is installed

Necessity: The 'libpam-pwquality' package provides the Pluggable Authentication Module (PAM) responsible for enforcing password complexity requirements on the system. Without this package, there is no mechanism to check new passwords against configurable quality rules, such as minimum length, character class requirements (uppercase, lowercase, digits, special characters), and dictionary checks. This absence allows users to set weak, easily guessable passwords, significantly increasing the risk of unauthorized access through brute-force or dictionary attacks. Auditing and Remediation: The audit script verifies the installation status of the 'libpam-pwquality' package by querying the system's package database. The remediation script interacts directly with the package manager (yum/dnf) to install the package if it is missing, thereby enabling the system's password quality enforcement capabilities. Recommended State Rationale: The recommended state for all levels—Basic, Moderate, and Strict—is 'installed'. This is a foundational security control with no intermediate state; the package is either present and functional or it is not. Basic security requires password quality checks. Moderate and Strict levels build upon this by assuming the package is installed and then configuring its policies to be progressively more stringent. Therefore, the installation of 'libpam-pwquality' is a non-negotiable prerequisite for any level of system hardening concerning password policies.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['installed']` |
| **Moderate** | `['installed']` |
| **Strict** | `['installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'libpam-pwquality' package is installed using the system's package manager. The script must output only the string 'installed' if the package is present, and 'not installed' otherwise, with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument: 'installed' or 'uninstalled'. The script should use the system's package manager (yum/dnf) to install or remove the 'libpam-pwquality' package to match the desired state. The script must return 'true' on success and 'false' on failure.

