# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low
- (xccdf-var var_password_pam_minclass)






- name: 'Ensure PAM Enforces Password Requirements - Minimum Different Categories - Check if system relies on pam-auth-update tool'
  ansible.builtin.stat:
    path: /usr/sbin/pam-auth-update
  register: result_pam_auth_update_present

- name: Ensure PAM Enforces Password Requirements - Minimum Different Categories - Remediation where pam-auth-update tool is present
  block:
    - name: Check if /usr/share/pam-configs/cac_pwquality exists
      ansible.builtin.stat:
        path: /usr/share/pam-configs/cac_pwquality
      register: pwquality_file_stat

    - name: Put the content into /usr/share/pam-configs/cac_pwquality if it does not exist
      ansible.builtin.copy:
        dest: /usr/share/pam-configs/cac_pwquality
        content: |+
          Name: Pwquality password strength checking
          Default: yes
          Priority: 1024
          Conflicts: cracklib
          Password-Type: Primary
          Password:
            requisite           pam_pwquality.so retry=3
        force: yes
      when: not pwquality_file_stat.stat.exists

    - name: 'Ensure PAM Enforces Password Requirements - Minimum Different Categories - Ensure pam-auth-update profile changes are applied'
      ansible.builtin.command:
        cmd: pam-auth-update --enable cac_pwquality

  when:
    - result_pam_auth_update_present.stat.exists


- name: Ensure PAM Enforces Password Requirements - Minimum Different Categories - Ensure PAM variable minclass is set accordingly
  ansible.builtin.lineinfile:
    create: yes
    dest: "/etc/security/pwquality.conf"
    regexp: '^#?\s*minclass'
    line: "minclass = {{ var_password_pam_minclass }}"