{{% if 'ubuntu' in product %}} {{% set configuration_files = ["common-password"] %}} {{% elif product in ['ol8','ol9','rhel8', 'rhel9'] %}} {{% set configuration_files = ["password-auth","system-auth"] %}} {{% else %}} {{% set configuration_files = ["system-auth"] %}} {{% endif %}} {{{ oval_metadata("The password retry should meet minimum requirements") }}} {{% for file in configuration_files %}} {{% endfor %}} {{% for file in configuration_files %}} {{% endfor %}} {{% macro test_pwquality_retry(path, test_ref) %}} {{% endmacro %}} {{% macro test_pwquality_notset(file, test_ref, pam_retry_test_ref) %}} {{% endmacro %}} {{% macro object_pwquality_retry(path, test_ref) %}} {{{ path }}} ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$ 1 {{% endmacro %}} {{% for file in configuration_files %}} {{{ test_pwquality_retry( path="/etc/pam.d/" ~ file , test_ref="password_pam_pwquality_retry_" ~ (file | escape_id)) }}} {{{ object_pwquality_retry( path="/etc/pam.d/" ~ file , test_ref="password_pam_pwquality_retry_" ~ (file | escape_id)) }}} {{{ test_pwquality_notset(file, "password_pam_pwquality_retry_" ~ (file | escape_id) ~"_not_set", "password_pam_pwquality_retry_" ~ (file | escape_id)) }}} {{% endfor %}} 0 /etc/security/pwquality.conf ^[\s]*retry[\s]*=[\s]*(\d+)(?:[\s]|$) 1