Improve regex in Bash and Ansible remediation

The former regex were not matching all possible cases. Signed-off-by: Marcus Burghardt <[email protected]>
ComplianceAsCode · Jul 17, 2024 · c9225b5 · c9225b5
1 parent 4c304c0
commit c9225b5
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 5 deletions.
diff --git a/...password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/ansible/shared.yml b/...password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/ansible/shared.yml
@@ -21,7 +21,7 @@
     - name: '{{{ rule_title }}} - Ensure That Only the Correct Hashing Algorithm Option For pam_unix.so Is Used in {{{ pam_file }}}'
       ansible.builtin.replace:
         dest: "{{ pam_file_path }}"
-        regexp: (.*password.*pam_unix\.so.*)\b{{ item }}\b=?[0-9a-zA-Z]*(.*)
+        regexp: (^\s*password.*pam_unix\.so.*)\b{{ item }}\b\s*(.*)
         replace: '\1\2'
       when:
         item != var_password_hashing_algorithm_pam

diff --git a/...set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh b/...set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/bash/shared.sh
@@ -10,7 +10,7 @@ declare -a HASHING_ALGORITHMS_OPTIONS=("sha512" "yescrypt" "gost_yescrypt" "blow
 
 for hash_option in "${HASHING_ALGORITHMS_OPTIONS[@]}"; do
   if [ "$hash_option" != "$var_password_hashing_algorithm_pam" ]; then
-    if grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\s+$hash_option\b" "$PAM_FILE_PATH"; then
+    if grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\b$hash_option\b" "$PAM_FILE_PATH"; then
       {{{ bash_remove_pam_module_option_configuration("$PAM_FILE_PATH", 'password', ".*", 'pam_unix.so', "$hash_option") }}}
     fi
   fi

diff --git a/...t_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/ansible/shared.yml b/...t_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/ansible/shared.yml
@@ -27,7 +27,7 @@
     - name: '{{{ rule_title }}} - Ensure That Only the Correct Hashing Algorithm Option For pam_unix.so Is Used in {{{ pam_file }}}'
       ansible.builtin.replace:
         dest: "{{ pam_file_path }}"
-        regexp: (.*password.*pam_unix\.so.*)\b{{ item }}\b=?[0-9a-zA-Z]*(.*)
+        regexp: (^\s*password.*pam_unix\.so.*)\b{{ item }}\b\s*(.*)
         replace: '\1\2'
       when:
         item != var_password_hashing_algorithm_pam

diff --git a/...m/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh b/...m/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
@@ -15,7 +15,7 @@ CONTROL="sufficient"
 {{% if 'ubuntu' in product -%}}
 # Can't use macro bash_ensure_pam_module_configuration because the control
 # contains special characters and is not static ([success=N default=ignore)
-if ! grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\s+$var_password_hashing_algorithm_pam\b" "$PAM_FILE_PATH"; then
+if ! grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\b$var_password_hashing_algorithm_pam\b" "$PAM_FILE_PATH"; then
   sed -i -E --follow-symlinks "/\s*password\s+.*\s+pam_unix.so.*/ s/$/ $var_password_hashing_algorithm_pam/" "$PAM_FILE_PATH"
 fi
 {{%- else -%}}
@@ -27,7 +27,7 @@ declare -a HASHING_ALGORITHMS_OPTIONS=("sha512" "yescrypt" "gost_yescrypt" "blow
 
 for hash_option in "${HASHING_ALGORITHMS_OPTIONS[@]}"; do
   if [ "$hash_option" != "$var_password_hashing_algorithm_pam" ]; then
-    if grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\s+$hash_option\b" "$PAM_FILE_PATH"; then
+    if grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\b$hash_option\b" "$PAM_FILE_PATH"; then
       {{{ bash_remove_pam_module_option_configuration("$PAM_FILE_PATH", 'password', ".*", 'pam_unix.so', "$hash_option") }}}
     fi
   fi