# Ensure pam_pwquality module is enabled

Necessity: The 'pam_pwquality' module is essential for enforcing password complexity and construction rules on Linux systems. It prevents users from setting weak, easily guessable passwords (e.g., dictionary words, simple patterns, or passwords that are too short). Disabling this module removes a critical defense layer against brute-force and dictionary attacks, significantly increasing the risk of account compromise.

Auditing and Remediation: The audit script verifies that the 'pam_pwquality.so' library is correctly invoked within the PAM password stack configuration files. The remediation script enables this module, typically using the system's standard 'authconfig' utility, which correctly modifies the PAM stack to ensure all password changes are subject to quality checks.

Recommended State Rationale: The state for this control is binary; the module is either enabled or it is not. 
- Basic: Recommends ['enabled'] as the absolute minimum requirement for system security. 
- Moderate: Recommends ['enabled']. There is no effective intermediate state. 
- Strict: Recommends ['enabled']. Any compliant system, regardless of its hardening level, must have this module active. The degree of password strength (e.g., minimum length, character class requirements) is configured via arguments to the module in the PAM configuration files, which are handled as separate security controls.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['enabled']` |
| **Moderate** | `['enabled']` |
| **Strict** | `['enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that inspects the PAM configuration files, typically '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth'. The script must verify that a line for 'pam_pwquality.so' exists and is not commented out within the 'password' stack of both files. It should output 'enabled' if the module is active in both configurations, and 'disabled' otherwise. The output must consist solely of the value, without any additional text or formatting.

## Remediation Script Working

shell script that accepts a single positional argument: 'enabled'. The script must ensure the 'pam_pwquality.so' module is active in '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth'. This can be achieved by using the command 'authconfig --enablepwquality --updateall'. The script must return 'true' on successful execution and 'false' on failure.

