# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_almalinux,multi_platform_ubuntu
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - accounts_password_pam_unix_no_remember
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Avoid using remember in pam_unix module - Remove remember option from pam_unix.so
  ansible.builtin.replace:
    dest: '{{ item }}'
    regexp: (\s+pam_unix\.so.*)\s+remember=\d+\b(.*)
    replace: \1\2
  loop:
  - /etc/pam.d/common-password
  - /etc/pam.d/common-auth
  - /etc/pam.d/common-account
  - /etc/pam.d/common-session
  - /etc/pam.d/common-session-noninteractive
  when: '"libpam-runtime" in ansible_facts.packages'
  tags:
  - accounts_password_pam_unix_no_remember
  - configure_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed
