# platform = multi_platform_all
# reboot = false
# strategy = enable
# complexity = low
# disruption = low
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
    File. - Force reselect authselect profile
  ansible.builtin.shell:
    cmd: authselect select "$(authselect current --raw)" --force
  when: '"linux-base" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
    File. - Check if system relies on pam-auth-update tool
  ansible.builtin.stat:
    path: /usr/sbin/pam-auth-update
  register: result_pam_auth_update_present
  when: '"linux-base" in ansible_facts.packages'
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
    File. - Remediation where pam-auth-update tool is present
  block:

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Check the presence of cac_faillock file
    ansible.builtin.stat:
      path: /usr/share/pam-configs/cac_faillock
    register: faillock_file_stat

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Check the presence of cac_faillock_notify file
    ansible.builtin.stat:
      path: /usr/share/pam-configs/cac_faillock_notify
    register: faillock_notify_file_stat

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Put the content into cac_faillock if it does not exist
    ansible.builtin.copy:
      dest: /usr/share/pam-configs/cac_faillock
      content: |
        Name: Enable pam_faillock to deny access
        Default: yes
        Priority: 0
        Conflicts: faillock
        Auth-Type: Primary
        Auth:
          [default=die]                   pam_faillock.so authfail
          sufficient                      pam_faillock.so authsucc
      force: true
    when: not faillock_file_stat.stat.exists

  - name: Configure the Use of the pam_faillock.so Module in the /etc/pam.d/password-auth
      File. - Put the content into cac_faillock_notify if it does not exist
    ansible.builtin.copy:
      dest: /usr/share/pam-configs/cac_faillock_notify
      content: |
        Name: Notify of failed login attempts and reset count upon success
        Default: yes
        Priority: 1025
        Conflicts: faillock_notify
        Auth-Type: Primary
        Auth:
          requisite                       pam_faillock.so preauth
        Account-Type: Primary
        Account:
          required                        pam_faillock.so
      force: true
    when: not faillock_notify_file_stat.stat.exists

  - name: None - Ensure pam-auth-update profile changes are applied
    ansible.builtin.command:
      cmd: pam-auth-update --enable cac_faillock

  - name: None - Ensure pam-auth-update profile changes are applied
    ansible.builtin.command:
      cmd: pam-auth-update --enable cac_faillock_notify
  when:
  - '"linux-base" in ansible_facts.packages'
  - result_pam_auth_update_present.stat.exists
  tags:
  - NIST-800-53-AC-7 (a)
  - account_password_pam_faillock_password_auth
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
