5.5.3 fix and update

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

Changelog.md

@@ -4,6 +4,7 @@
 
 - [#72](https://github.com/ansible-lockdown/RHEL9-CIS/issues/72)
   - Only run check when paybook user not a superuser
+- fix for 5.5.3 thanks to @nrg-fv
 
 ## 1.0.9
 

tasks/section_5/cis_5.5.x.yml

@@ -77,19 +77,11 @@
       - patch
       - rule_5.5.2
 
-- name: "5.5.3 | PATCH | Ensure password reuse is limited"
+- name: "5.5.3 | PATCH | Ensure password reuse is limited | pwquality"
-  block:
+  ansible.builtin.lineinfile:
-      - name: "5.5.3 | PATCH | Ensure password reuse is limited | pwquality"
+      path: /etc/pam.d/system-auth
-        ansible.builtin.lineinfile:
+      line: "password    requisite     pam_pwhistory.so try_first_pass enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}"
-            path: /etc/pam.d/system-auth
+      insertafter: '^password\s*requisite\s*pam_pwquality.so'
-            line: "password    requisite     pam_pwhistory.so try_first_pass enforce_for_root retry=3 remember={{ rhel9cis_pam_faillock.remember }}"
-            insertafter: '^password\s*requisite\s*pam_pwquality.so'
-
-      - name: "5.5.3 | PATCH | Ensure password reuse is limited | pam_unix"
-        ansible.builtin.replace:
-            path: /etc/pam.d/system-auth
-            regexp: '^password\s*sufficient\s*pam_unix.so.*$'
-            replace: 'password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok remember={{ rhel9cis_pam_faillock.remember }}'
   when:
       - rhel9cis_rule_5_5_3
   tags: