sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

removed line and updated requirement #53

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2023-05-16 08:52:45 +01:00
parent 7c09b264a1
commit 195e42e3ea
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tasks/section_5/cis_5.5.x.yml
View file

@ -82,14 +82,14 @@
- name: "5.5.3 | PATCH | Ensure password reuse is limited | pwquality" - name: "5.5.3 | PATCH | Ensure password reuse is limited | pwquality"
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
path: /etc/pam.d/system-auth path: /etc/pam.d/system-auth
line: "password requisite pam_pwhistory.so try_first_pass local_users_only enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}" line: "password requisite pam_pwhistory.so try_first_pass enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}"
insertafter: '^password\s*requisite\s*pam_pwquality.so' insertafter: '^password\s*requisite\s*pam_pwquality.so'
- name: "5.5.3 | PATCH | Ensure password reuse is limited | pam_unix" - name: "5.5.3 | PATCH | Ensure password reuse is limited | pam_unix"
ansible.builtin.replace: ansible.builtin.replace:
path: /etc/pam.d/system-auth path: /etc/pam.d/system-auth
regexp: '^password\s*(sufficient|requisite|sufficient)\s*pam_unix.so.*$' regexp: '^password\s*sufficient\s*pam_unix.so.*$'
replace: 'password requisite pam_unix.so sha512 shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}' replace: 'password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}'
when: when:
- rhel9cis_rule_5_5_3 - rhel9cis_rule_5_5_3
tags: tags: