ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-27 15:33:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

add set password-auth remember settings

Browse source 
Signed-off-by: Francesco Trentini <francesco.trentini@ris.bz.it>
This commit is contained in:
Francesco Trentini 2024-03-20 17:40:46 +01:00
parent 6eeae19517
commit 8621a565f9
No known key found for this signature in database
GPG key ID: F6671CF68B529CCB
1 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
tasks/section_5/cis_5.5.x.yml
View file

@ -78,10 +78,17 @@
- rule_5.5.2
- name: "5.5.3 | PATCH | Ensure password reuse is limited | pwquality"
ansible.builtin.lineinfile:
path: /etc/pam.d/system-auth
line: "password requisite pam_pwhistory.so try_first_pass enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}"
insertafter: '^password\s*requisite\s*pam_pwquality.so'
block:
- name: "5.5.3 | PATCH | Ensure password reuse is limited | Set system-auth remember settings"
ansible.builtin.lineinfile:
path: /etc/pam.d/system-auth
line: "password requisite pam_pwhistory.so try_first_pass enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}"
insertafter: '^password\s*requisite\s*pam_pwquality.so'
- name: "5.5.3 | PATCH | Ensure password reuse is limited | Set password-auth remember settings"
ansible.builtin.lineinfile:
path: /etc/pam.d/password-auth
line: "password requisite pam_pwhistory.so try_first_pass enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}"
insertafter: '^password\s*requisite\s*pam_pwquality.so'
when:
- rhel9cis_rule_5_5_3
tags: