# Ensure password maximum sequential characters is configured

The 'maxsequence' parameter within the pam_pwquality module defines the maximum number of allowed consecutive characters of the same class (e.g., 'abc' or '123') in a new password. Setting a low value for this parameter is crucial for enforcing password complexity and mitigating security risks. Weak passwords that follow predictable patterns are highly susceptible to dictionary and brute-force attacks. By limiting sequential characters, the system forces users to create more random and less predictable passwords, significantly strengthening the first line of defense against unauthorized access. The audit script verifies the current 'maxsequence' value in '/etc/security/pwquality.conf', while the remediation script modifies this file to enforce the desired setting. The Basic state of [3, 3] prevents obvious sequences like 'abcd'. The Moderate state of [2, 2] offers stronger protection by disallowing even two sequential characters. The Strict state of [1, 1] provides the highest security by completely banning any sequential characters, which is ideal for high-risk environments but may impact user convenience.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[3, 1]` |
| **Moderate** | `[2, 1]` |
| **Strict** | `[1, 1]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script to query the 'maxsequence' setting from '/etc/security/pwquality.conf'. The script should parse the file to find the value assigned to 'maxsequence'. If the setting is commented out or not explicitly present, it should report the system's default value, which is 0. The script must return only the numeric value.

## Remediation Script Working

Bash script that takes a single integer command-line argument to set the 'maxsequence' value in '/etc/security/pwquality.conf'. The script must find and update an existing 'maxsequence' entry, uncomment and update a commented entry, or add a new entry if one does not exist. The script must return 'true' on successful configuration and 'false' on failure.

