add a pam_accounts_password_unix_remember template

and rewrite accounts_password_pam_unix_remember rule to use the
template.

linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml

@@ -101,3 +101,6 @@ warnings:
        system, an authselect custom profile must be used to avoid integrity issues in PAM files.
 
 srg_requirement: '{{{ full_name }}} must not allow passwords to be reused for a minimum of five generations.'
+
+template:
+  name: pam_account_password_unix_remember

linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/ansible/debian.yml → shared/templates/pam_account_password_unix_remember/ansible.template

@@ -1,21 +1,29 @@
-# platform = multi_platform_debian
+# platform = multi_platform_all
 # reboot = false
 # strategy = configure
 # complexity = low
 # disruption = medium
 
 {{{ ansible_instantiate_variables("var_password_pam_unix_remember") }}}
 
-# Modified version of macro ansible_ensure_pam_module_option(pam_file, group, control, module, option, value='', after_match='').
-# The original macro is designed to search/replace also the control field thus treating the field as a constant and escaping the regex.
-# Here we adapt the code to allow using regex on the control field.
-
+{{% if "ubuntu" in product or "debian" in product %}}
 {{% set pam_file='/etc/pam.d/common-password' %}}
 {{% set group='password' %}}
 {{% set control='\[success=[A-Za-z0-9].*\]' %}}
 {{% set module='pam_unix.so' %}}
 {{% set option='remember' %}}
 {{% set value='{{ var_password_pam_unix_remember }}' %}}
+{{% elif product in [ "sle12", "sle13" ] %}}
+{{% set pam_file='/etc/pam.d/common-password' %}}
+{{% else %}}
+{{% set pam_file='/etc/pam.d/system-auth' %}}
+{{% endif %}}
+
+{{% if "ubuntu" in product or "debian" in product %}}
+
+# Modified version of macro ansible_ensure_pam_module_option(pam_file, group, control, module, option, value='', after_match='').
+# The original macro is designed to search/replace also the control field thus treating the field as a constant and escaping the regex.
+# Here we adapt the code to allow using regex on the control field.
 
 - name: '{{{ rule_title }}} - Check if the required PAM module option is present in {{{ pam_file }}}'
   ansible.builtin.lineinfile:
@@ -46,3 +54,16 @@
   register: result_pam_{{{ option }}}_edit
   when:
     - result_pam_module_{{{ option }}}_option_present.found > 0
+
+
+{{% else %}}
+
+{{{ ansible_pam_pwhistory_enable(pam_file,
+                                 'requisite',
+                                 '^password.*requisite.*pam_pwquality\.so') }}}
+
+{{{ ansible_pam_pwhistory_parameter_value(pam_file,
+                                          'remember',
+                                          '{{ var_password_pam_unix_remember }}') }}}
+
+{{% endif %}}

linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh → shared/templates/pam_account_password_unix_remember/bash.template

@@ -1,12 +1,18 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
+# platform = multi_platform_all
 
-{{% if product in [ "sle12", "sle15" ] %}}
+{{{ bash_instantiate_variables("var_password_pam_unix_remember") }}}
+
+{{% if "debian" in product or "ubuntu" in product or product in ["sle12", "sle15" ] %}}
 {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/common-password' -%}}
 {{% else %}}
 {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/system-auth' -%}}
 {{% endif %}}
 
-{{{ bash_instantiate_variables("var_password_pam_unix_remember") }}}
+{{% if "debian" in product or "ubuntu" in product %}}
+
+{{{ bash_ensure_pam_module_options(accounts_password_pam_unix_remember_file, 'password', '\[success=[[:alnum:]].*\]', 'pam_unix.so', 'remember', "$var_password_pam_unix_remember", "$var_password_pam_unix_remember") }}}
+
+{{% else %}}
 
 {{{ bash_pam_pwhistory_enable(accounts_password_pam_unix_remember_file,
                               'requisite',
@@ -15,3 +21,5 @@
 {{{ bash_pam_pwhistory_parameter_value(accounts_password_pam_unix_remember_file,
                                        'remember',
                                        "$var_password_pam_unix_remember") }}}
+
+{{% endif %}}

linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/oval/shared.xml → shared/templates/pam_account_password_unix_remember/oval.template

@@ -1,57 +1,59 @@
-{{% if product in [ "sle12", "sle15" ] %}}
+{{% if product in [ "sle12", "sle15" ] or "debian" in product or "ubuntu" in product %}}
 {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/common-password' -%}}
 {{% else %}}
 {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/system-auth' -%}}
 {{% endif %}}
 
 <def-group>
-  <definition class="compliance" id="{{{ rule_id }}}" version="2">
+  <definition class="compliance" id="accounts_password_pam_unix_remember" version="2">
     {{{ oval_metadata("The passwords to remember should be set correctly.") }}}
     <criteria operator="OR" comment="Check if pam_pwhistory.so or pam_unix.so are configured">
       <criteria operator="AND" comment="Check if pam_pwhistory.so is properly configured">
         <!--
-          pam_pwhistory.so parameters can be defined directly in pam files or, in newer versions,
-          in /etc/security/pwhistory.conf. The last is the recommended option when available. Also,
-          is the option used by auselect tool. However, regardless the approach, a minimal
-          declaration is common in pam files. -->
+            pam_pwhistory.so parameters can be defined directly in pam files or, in newer versions,
+            in /etc/security/pwhistory.conf. The last is the recommended option when available. Also,
+            is the option used by auselect tool. However, regardless the approach, a minimal
+            declaration is common in pam files. -->
         <criterion test_ref="test_accounts_password_pam_unix_remember"
-          comment="pam_pwhistory.so is properly defined in password section of PAM file"/>
+		   comment="pam_pwhistory.so is properly defined in password section of PAM file"/>
 
         <!--
-          pam_pwhistory.so parameters should be defined in /etc/security/pwhistory.conf whenever
-          possible. But due to backwards compatibility, they are also allowed in pam files directly.
-          In case they are defined in both places, pam files have precedence and this may confuse
-          the assessment. The following tests ensure only one option is used. Note that if
-          pwhistory.conf is available, authselect tool will preserve PAM files from parameters
-          definitions in favor of /etc/security/pwhistory.conf. -->
+            pam_pwhistory.so parameters should be defined in /etc/security/pwhistory.conf whenever
+            possible. But due to backwards compatibility, they are also allowed in pam files directly.
+            In case they are defined in both places, pam files have precedence and this may confuse
+            the assessment. The following tests ensure only one option is used. Note that if
+            pwhistory.conf is available, authselect tool will preserve PAM files from parameters
+            definitions in favor of /etc/security/pwhistory.conf. -->
         <criteria operator="OR"
-          comment="Check the expected value for pam_pwhistory.so remember parameter">
+		  comment="Check the expected value for pam_pwhistory.so remember parameter">
           <criteria operator="AND"
-            comment="Check the pam_pwhistory.so remember parameter is only in PAM file">
+		    comment="Check the pam_pwhistory.so remember parameter is only in PAM file">
             <criterion
-              test_ref="test_accounts_password_pam_unix_remember_pamd"
-              comment="Check the remember parameter in password section of PAM file"/>
+		test_ref="test_accounts_password_pam_unix_remember_pamd"
+		comment="Check the remember parameter in password section of PAM file"/>
             <criterion
-              test_ref="test_accounts_password_pam_unix_remember_no_pwhistory_conf"
-              comment="Check the pam_pwhistory.so remember parameter is absent in pwhistory.conf"/>
+		test_ref="test_accounts_password_pam_unix_remember_no_pwhistory_conf"
+		comment="Check the pam_pwhistory.so remember parameter is absent in pwhistory.conf"/>
           </criteria>
           <criteria operator="AND"
-            comment="Check the pam_pwhistory.so remember parameter is only in pwhistory.conf file">
+		    comment="Check the pam_pwhistory.so remember parameter is only in pwhistory.conf file">
             <criterion
-              test_ref="test_accounts_password_pam_unix_remember_no_pamd"
-              comment="Check the pam_pwhistory.so remember parameter is absent in PAM file"/>
+		test_ref="test_accounts_password_pam_unix_remember_no_pamd"
+		comment="Check the pam_pwhistory.so remember parameter is absent in PAM file"/>
             <criterion
-              test_ref="test_accounts_password_pam_unix_remember_pwhistory_conf"
-              comment="Check the remember parameter in /etc/security/pwhistory.conf"/>
+		test_ref="test_accounts_password_pam_unix_remember_pwhistory_conf"
+		comment="Check the remember parameter in /etc/security/pwhistory.conf"/>
           </criteria>
         </criteria>
       </criteria>
       <criterion test_ref="test_accounts_password_pam_unix_remember_legacy"
-        comment="Remember parameter of pam_unix.so is properly configured"/>
+		 comment="Remember parameter of pam_unix.so is properly configured"/>
     </criteria>
   </definition>
 
-  <!-- is pam_pwhistory.so enabled? -->
+  <external_variable comment="number of passwords that should be remembered" datatype="int" id="var_password_pam_unix_remember" version="1" />
+
+    <!-- is pam_pwhistory.so enabled? -->
   <ind:textfilecontent54_test id="test_accounts_password_pam_unix_remember"
     check="all" version="1" comment="Check pam_pwhistory.so presence in PAM file">
     <ind:object object_ref="object_accounts_password_pam_unix_remember"/>
@@ -89,6 +91,7 @@
 
   <external_variable id="var_password_pam_unix_remember" version="1"
     datatype="int" comment="number of passwords that should be remembered"/>
+  <external_variable comment="number of passwords that should be remembered" datatype="int" id="var_password_pam_unix_remember" version="1" />
 
   <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1"
     id="test_accounts_password_pam_unix_remember_no_pwhistory_conf"
@@ -145,14 +148,15 @@
   <!-- Check the pam_unix.so remember case -->
   <ind:textfilecontent54_test id="test_accounts_password_pam_unix_remember_legacy" version="1"
     check="all" check_existence="all_exist"
-    comment="Test if remember attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth">
+    comment="Test if remember attribute of pam_unix.so is set correctly in {{{ accounts_password_pam_unix_remember_file }}}">
     <ind:object object_ref="object_accounts_password_pam_unix_remember_legacy" />
     <ind:state state_ref="state_accounts_password_pam_unix_remember" />
   </ind:textfilecontent54_test>
 
   <ind:textfilecontent54_object id="object_accounts_password_pam_unix_remember_legacy" version="1">
-    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
-    <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*remember=([0-9]*).*$</ind:pattern>
+    <ind:filepath>{{{ accounts_password_pam_unix_remember_file }}}</ind:filepath>
+    <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required)|(?:\[.*\]))\s+pam_unix\.so.*remember=([0-9]*).*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+
 </def-group>

shared/templates/pam_account_password_unix_remember/template.yml

@@ -0,0 +1,4 @@
+supported_languages:
+  - ansible
+  - bash
+  - oval