# Ensure password same consecutive characters is configured

Necessity: This setting defines the maximum number of allowed consecutive identical characters in a password. Limiting consecutive characters significantly increases password complexity and resilience against brute-force or dictionary attacks. Attackers' password-cracking lists often include passwords with simple, repetitive patterns (e.g., 'passwoooord'). Enforcing this rule makes such predictable passwords invalid, thereby strengthening the system's first line of defense. Failure to configure this allows users to create weaker, more easily guessable passwords, increasing the risk of unauthorized access.

Auditing and Remediation: The audit script inspects the '/etc/security/pwquality.conf' file to retrieve the current integer value of the 'maxrepeat' parameter. The remediation script modifies this same file, setting the 'maxrepeat' parameter to a specified integer value, thus enforcing the new password complexity requirement for all future password changes.

Recommended State Rationale:
- Basic: A value of '[3, 3]' provides a fundamental safeguard by preventing overly simplistic passwords with long strings of the same character (e.g., 'aaaa'), balancing security with user convenience.
- Moderate: A value of '[2, 2]' offers a stronger security posture by disallowing more than two consecutive identical characters. This blocks a very common pattern in weak passwords (e.g., 'paassword') and encourages more complex constructions.
- Strict: A value of '[1, 1]' provides the most stringent security, as recommended by CIS Benchmarks. It disallows any consecutive identical characters (e.g., 'hello' would be invalid due to 'll'). This drastically reduces the attack surface for password guessing and enforces a high standard of password hygiene.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[3, 1]` |
| **Moderate** | `[2, 1]` |
| **Strict** | `[1, 1]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the 'maxrepeat' setting in the '/etc/security/pwquality.conf' file. The script must parse the file to find the value assigned to 'maxrepeat'. If the setting is explicitly configured, the script should output only the numerical value. If the setting is not found or is commented out, the script should return the system's default value. The output must be clean, containing only the value itself.

## Remediation Script Working

Bash script that configures the 'maxrepeat' setting in '/etc/security/pwquality.conf'. The script must accept a single, positional command-line argument representing the desired maximum number of consecutive identical characters. The script should intelligently update the configuration file: if the 'maxrepeat' setting already exists (even if commented out), it should be updated with the new value; otherwise, it should be added to the file. The script must return 'true' upon successful modification and 'false' if an error occurs.

