From f15407dcb4307da63607bc952e89f1578f648435 Mon Sep 17 00:00:00 2001 From: bol7742 <102948121+bol7742@users.noreply.github.com> Date: Mon, 22 Dec 2025 11:28:49 +0100 Subject: [PATCH] fix: make 5.3.2.2 idempotent with 5.3.3.1.1 Signed-off-by: bol7742 <102948121+bol7742@users.noreply.github.com> --- tasks/section_5/cis_5.3.2.x.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tasks/section_5/cis_5.3.2.x.yml b/tasks/section_5/cis_5.3.2.x.yml index 6e1919c..5dd4352 100644 --- a/tasks/section_5/cis_5.3.2.x.yml +++ b/tasks/section_5/cis_5.3.2.x.yml @@ -93,10 +93,10 @@ loop: - regexp: "auth\\s+required\\s+pam_faillock.so\\s+preauth" after: "auth\\s+required\\s+pam_env.so" # yamllint disable-line rule:colons - line: "auth required pam_faillock.so preauth silent deny=3 unlock_timeout={{ rhel9cis_pam_faillock_unlock_time }}" # yamllint disable-line rule:colons + line: "auth required pam_faillock.so preauth silent unlock_timeout={{ rhel9cis_pam_faillock_unlock_time }}" # yamllint disable-line rule:colons - regexp: "auth\\s+required\\s+pam_faillock.so\\s+authfail" before: "auth\\s+required\\s+pam_deny.so" - line: "auth required pam_faillock.so authfail silent deny=3 unlock_timeout={{ rhel9cis_pam_faillock_unlock_time }}" # yamllint disable-line rule:colons + line: "auth required pam_faillock.so authfail silent unlock_timeout={{ rhel9cis_pam_faillock_unlock_time }}" # yamllint disable-line rule:colons - regexp: "account\\s+required\\s+pam_faillock.so" before: "account\\s+required\\s+pam_unix.so" line: "account required pam_faillock.so" # yamllint disable-line rule:colons @@ -112,10 +112,10 @@ loop: - regexp: "auth\\s+required\\s+pam_faillock.so\\s+preauth" after: "auth\\s+required\\s+pam_env.so" # yamllint disable-line rule:colons - line: "auth required pam_faillock.so preauth silent deny=3 unlock_timeout={{ rhel9cis_pam_faillock_unlock_time }}" # yamllint disable-line rule:colons + line: "auth required pam_faillock.so preauth silent unlock_timeout={{ rhel9cis_pam_faillock_unlock_time }}" # yamllint disable-line rule:colons - regexp: "auth\\s+required\\s+pam_faillock.so\\s+authfail" before: "auth\\s+required\\s+pam_deny.so" - line: "auth required pam_faillock.so authfail silent deny=3 unlock_timeout={{ rhel9cis_pam_faillock_unlock_time }}" # yamllint disable-line rule:colons + line: "auth required pam_faillock.so authfail silent unlock_timeout={{ rhel9cis_pam_faillock_unlock_time }}" # yamllint disable-line rule:colons - regexp: "account\\s+required\\s+pam_faillock.so" before: "account\\s+required\\s+pam_unix.so" line: "account required pam_faillock.so" # yamllint disable-line rule:colons