Use pam_options template with bash turned off

ComplianceAsCode · Jan 15, 2025 · e9211e9 · e9211e9
1 parent 4fe51f1
commit e9211e9
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 52 deletions.
diff --git a/...ocking_out_password_attempts/accounts_password_pam_pwhistory_enforce_root/oval/shared.xml b/...ocking_out_password_attempts/accounts_password_pam_pwhistory_enforce_root/oval/shared.xml
diff --git a/...s-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_root/rule.yml b/...s-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_root/rule.yml
@@ -16,3 +16,18 @@ rationale: 'Preventing re-use of previous passwords helps ensure that a compromi
 severity: medium
 
 platform: package[pam]
+
+template:
+    name: pam_options
+    vars:
+      path: /etc/pam.d/common-password
+      type: password
+      control_flag: requisite
+      module: pam_pwhistory.so
+      arguments:
+        - argument: enforce_for_root
+          new_argument: enforce_for_root
+{{% if 'ubuntu' in product %}}
+      backends:
+        - bash: "off"
+{{% endif %}}