# Ensure minimum password length is configured

Necessity: The minimum password length is a fundamental security control that establishes the baseline complexity of user passwords. It is a primary defense against brute-force and dictionary attacks. Longer passwords exponentially increase the search space for an attacker, making it computationally infeasible to guess or crack them in a timely manner. Misconfiguration, such as allowing short passwords, significantly elevates the risk of account compromise.

Auditing and Remediation: The audit script inspects the '/etc/security/pwquality.conf' file, which governs password quality rules enforced by the PAM (Pluggable Authentication Modules) stack. It specifically retrieves the value of the 'minlen' parameter. The remediation script directly modifies this file to set 'minlen' to a desired value, thereby enforcing a new minimum password length for all users on the system during their next password change.

Recommended State Rationale:
- Basic ([14, 14]): This state aligns with modern security standards like the CIS Benchmarks. A minimum length of 14 characters provides a robust defense against common brute-force attacks, moving significantly beyond outdated recommendations of 8 characters.
- Moderate ([16, 16]): Increasing the minimum length to 16 characters offers a substantial improvement in security. Each additional character adds significant complexity, further protecting accounts against advances in password cracking technology and more determined attackers.
- Strict ([18, 'upper bound']): This state is recommended for high-security environments or systems processing sensitive data. A password of 18 characters or more is exceptionally resistant to offline cracking attempts, even with specialized hardware. Setting no upper bound allows administrators to enforce even stricter organizational policies where required.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[14, 'upper bound']` |
| **Moderate** | `[16, 'upper bound']` |
| **Strict** | `[18, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that reads the /etc/security/pwquality.conf file to find the 'minlen' setting. The script should parse the file, ignoring any commented lines, and return only the numerical value of 'minlen'. If the setting is not explicitly defined, the script should return the system's default value.

## Remediation Script Working

Bash script that accepts a single numerical value as a positional command-line argument. The script must modify the /etc/security/pwquality.conf file to set the 'minlen' parameter to the provided value. If the parameter already exists, its value should be updated; if it does not exist, the line 'minlen = <value>' should be added to the file. The script must return 'true' on success and 'false' on failure.

