Use pam_options template with bash turned off

ComplianceAsCode · Jan 15, 2025 · 56f5eb4 · 56f5eb4
1 parent 845f5c3
commit 56f5eb4
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 59 deletions.
diff --git a/...am/locking_out_password_attempts/accounts_password_pam_pwhistory_remember/oval/shared.xml b/...am/locking_out_password_attempts/accounts_password_pam_pwhistory_remember/oval/shared.xml
diff --git a/...ounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember/rule.yml b/...ounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember/rule.yml
@@ -49,14 +49,20 @@ ocil: |-
 
 platform: package[pam]
 
-{{% if 'ubuntu' not in product or product == 'ubuntu2004' %}}
 template:
     name: pam_options
     vars:
       path: /etc/pam.d/common-password
       type: password
       control_flag: requisite
       module: pam_pwhistory.so
+{{% if 'ubuntu' in product and product != 'ubuntu2004' %}}
+      arguments:
+        - variable: remember
+          operation: greater than or equal
+      backends:
+        - bash: "off"
+{{% else %}}
       arguments:
         - variable: remember
           operation: greater than or equal