# platform = multi_platform_sle,multi_platform_slmicro
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low

# NOTE(gyee): Ansible's pamd module is very rigid, it doesn't do
# what we wanted, which is to conditionally replace an existing value
# if it doesn't match what we wanted. Till someday some good samaritan
# updated the Ansible pamd module to do that, we will need to use regexp
# for now.


# declare the XCCDF vars if any




- name: Set control_flag fact
  ansible.builtin.set_fact:
    control_flag: 'required'

- name: Check to see if 'pam_tally2.so' module is configured in '/etc/pam.d/login'
  ansible.builtin.shell: |
    set -o pipefail
    grep -E '^\s*auth\s+\S+\s+pam_tally2.so' /etc/pam.d/login || true
  register: check_pam_module_result

- name: Configure 'pam_tally2.so' module in '/etc/pam.d/login'
  ansible.builtin.lineinfile:
    path: /etc/pam.d/login
    line: 'auth required pam_tally2.so'
    state: present
  when: check_pam_module_result.stdout is defined and '"pam_tally2.so" not in check_pam_module_result.stdout'

- name: Ensure 'pam_tally2.so' module has conforming control flag
  ansible.builtin.lineinfile:
    path: /etc/pam.d/login
    regexp: '^(\s*auth\s+)\S+(\s+pam_tally2.so\s+.*)'
    line: '\g<1>required\g<2>'
    backrefs: yes
  when: control_flag|length


# NOTE: if 'remove_argument' is present and set to some value, we assume
# user's intention is to remove the argument. Therefore, no need to check what
# it is set to.

- name: Remove argument 'file' from 'pam_tally2.so' module
  ansible.builtin.replace:
    path: /etc/pam.d/login
    regexp: '^(\s*auth\s+\S+\s+pam_tally2.so(?:\s+\S+)*)\s+file(?:=\S+)?((\s+\S+)*\s*\\*\s*)$'
    replace: '\1\2'

