Update Linux misconfiguration templates

- Add impact and remediation sections
- Fix tag formatting (misconfiguration -> misconfig)
- Add additional reference links
- Fix matcher condition syntax for root-remote-login
- Add OS metadata for better categorization

misconfiguration/linux/password-complexity-not-enforced.yaml

@@ -0,0 +1,54 @@
+id: password-complexity-not-enforced
+
+info:
+  name: Linux Password Complexity Not Enforced
+  author: songyaeji
+  severity: high
+  description: |
+    Password complexity requirements are not enforced on this system. This allows weak passwords, making user accounts more susceptible to brute-force and dictionary attacks.
+  impact: |
+    Weak password policies enable attackers to successfully perform brute-force attacks, dictionary attacks, or password spraying against user accounts.
+  remediation: |
+    Configure password complexity requirements in /etc/security/pwquality.conf and ensure pam_pwquality.so is enabled in PAM configuration files.
+  reference:
+    - https://access.redhat.com/solutions/13090
+    - https://wiki.debian.org/PasswordStrength
+  classification:
+    cvss-metrics: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 7.8
+    cwe-id: CWE-521
+  metadata:
+    verified: true
+    max-request: 2
+    os: linux
+  tags: linux,local,configuration,auth,misconfig,compliance
+
+self-contained: true
+code:
+  - engine:
+      - bash
+    source: |
+      cat /etc/security/pwquality.conf 2>/dev/null || true
+
+    matchers:
+      - type: regex
+        part: code_1_response
+        regex:
+          - 'minlen\s*=\s*[0-7]'               # minimum length less than 8
+          - 'dcredit\s*=\s*0'                  # no digit requirement
+          - 'ucredit\s*=\s*0'                  # no uppercase requirement
+          - 'lcredit\s*=\s*0'                  # no lowercase requirement
+          - 'ocredit\s*=\s*0'                  # no special character requirement
+        condition: or
+
+  - engine:
+      - bash
+    source: |
+      grep pam_pwquality.so /etc/pam.d/system-auth /etc/pam.d/common-password 2>/dev/null || true
+
+    matchers:
+      - type: word
+        part: code_2_response
+        words:
+          - "pam_pwquality.so"
+        negative: true

misconfiguration/linux/root-remote-login.yaml

@@ -0,0 +1,46 @@
+id: root-remote-login
+
+info:
+  name: Linux Root Remote Login - Security Misconfiguration
+  author: songyaeji
+  severity: high
+  description: |
+    Root account remote login via telnet or SSH is enabled, which poses a significant security risk. This template checks the root account access settings in `/etc/securetty` and `sshd_config`.
+  impact: |
+    Allowing root login over network connections increases the attack surface and enables attackers to directly access the highest privilege account if credentials are compromised.
+  remediation: |
+    Disable root login by setting 'PermitRootLogin no' in /etc/ssh/sshd_config and removing entries from /etc/securetty. Use sudo for administrative access instead.
+  reference:
+    - https://book.hacktricks.xyz/linux-hardening/privilege-escalation
+    - https://www.tecmint.com/disable-or-enable-ssh-root-login-and-limit-ssh-access-in-linux/
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cwe-id: CWE-306
+  metadata:
+    verified: true
+    max-request: 2
+    os: linux
+  tags: linux,ssh,root,misconfig,local
+
+self-contained: true
+code:
+  - engine:
+      - bash
+    source: |
+      cat /etc/securetty 2>/dev/null | grep -E 'pts/[0-9]+' || echo "no-securetty"
+    matchers:
+      - type: word
+        part: code_1_response
+        words:
+          - "pts/"
+
+  - engine:
+      - bash
+    source: |
+      cat /etc/ssh/sshd_config 2>/dev/null | grep -E '^PermitRootLogin\s+yes' || echo "no-root-ssh"
+    matchers:
+      - type: word
+        part: code_2_response
+        words:
+          - "PermitRootLogin yes"