---
- name: RHEL 7 Keep history of the last passwords used num {{ pam_pwd_history }}
  lineinfile:
    path: "{{ item }}"
    insertafter: '^.*pam_pwquality.so.*$'
    line: >-
      password    requisite     pam_pwhistory.so remember={{ pam_pwd_history }}
      use_authtok
    state: present
    backup: true
  with_items:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth

- name: RHEL 7 Configure pam_faillock.so
  lineinfile:
    path: "{{ item }}"
    insertbefore: '^account.*$'
    firstmatch: true
    line: account     required      pam_faillock.so
    state: present
    backup: true
  with_items:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth

- name: RHEL 7 configure pam_faillock.so for preauth
  lineinfile:
    path: "{{ item }}"
    insertafter: '^.*pam_env.so.*$'
    firstmatch: true
    line: >-
      auth        required      pam_faillock.so preauth silent audit
      deny={{ pam_pwd_deny }} unlock_time={{ pam_pwd_unlock_time }}
    state: present
    backup: true
  with_items:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth

- name: RHEL 7 configure pam_faillock.so for authfail
  lineinfile:
    path: "{{ item }}"
    insertafter: ^auth\s*sufficient\s*pam_unix\.so\s*nullok\s*try_first_pass.*$
    firstmatch: true
    line: >-
      auth        [default=die]      pam_faillock.so authfail audit
      deny={{ pam_pwd_deny }} unlock_time={{ pam_pwd_unlock_time }}
    state: present
    backup: true
  with_items:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth

- name: RHEL 7 Enforce root for password complexity
  lineinfile:
    path: "{{ item }}"
    regexp: >
      ^password\s*requisite\s*pam_pwquality\.so\s*try_first_pass\s*
      local_users_only\s*retry=3\s*authtok_type=.*$
    line: >
      password    requisite     pam_pwquality.so try_first_pass local_users_only
      retry=3 authtok_type= {{ pam_pwd_enforce_root }}
    state: present
    backup: true
  with_items:
    - /etc/pam.d/system-auth
    - /etc/pam.d/password-auth
  when:
    - pam_pwd_enforce_root is defined
    - pam_pwd_enforce_root | length > 0
