add a pam_account_password_unix_remember template

and rewrite accounts_password_pam_unix_remember rule to use the
template.

linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml

@@ -101,3 +101,6 @@ warnings:
        system, an authselect custom profile must be used to avoid integrity issues in PAM files.
 
 srg_requirement: '{{{ full_name }}} must not allow passwords to be reused for a minimum of five generations.'
+
+template:
+  name: pam_account_password_unix_remember

linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/ansible/debian.yml → shared/templates/pam_account_password_unix_remember/ansible.template

@@ -1,21 +1,29 @@
-# platform = multi_platform_debian
+# platform = multi_platform_all
 # reboot = false
 # strategy = configure
 # complexity = low
 # disruption = medium
 
 {{{ ansible_instantiate_variables("var_password_pam_unix_remember") }}}
 
-# Modified version of macro ansible_ensure_pam_module_option(pam_file, group, control, module, option, value='', after_match='').
-# The original macro is designed to search/replace also the control field thus treating the field as a constant and escaping the regex.
-# Here we adapt the code to allow using regex on the control field.
-
+{{% if "ubuntu" in product or "debian" in product %}}
 {{% set pam_file='/etc/pam.d/common-password' %}}
 {{% set group='password' %}}
 {{% set control='\[success=[A-Za-z0-9].*\]' %}}
 {{% set module='pam_unix.so' %}}
 {{% set option='remember' %}}
 {{% set value='{{ var_password_pam_unix_remember }}' %}}
+{{% elif product in [ "sle12", "sle13" ] %}}
+{{% set pam_file='/etc/pam.d/common-password' %}}
+{{% else %}}
+{{% set pam_file='/etc/pam.d/system-auth' %}}
+{{% endif %}}
+
+{{% if "ubuntu" in product or "debian" in product %}}
+
+# Modified version of macro ansible_ensure_pam_module_option(pam_file, group, control, module, option, value='', after_match='').
+# The original macro is designed to search/replace also the control field thus treating the field as a constant and escaping the regex.
+# Here we adapt the code to allow using regex on the control field.
 
 - name: '{{{ rule_title }}} - Check if the required PAM module option is present in {{{ pam_file }}}'
   ansible.builtin.lineinfile:
@@ -46,3 +54,16 @@
   register: result_pam_{{{ option }}}_edit
   when:
     - result_pam_module_{{{ option }}}_option_present.found > 0
+
+
+{{% else %}}
+
+{{{ ansible_pam_pwhistory_enable(pam_file,
+                                 'requisite',
+                                 '^password.*requisite.*pam_pwquality\.so') }}}
+
+{{{ ansible_pam_pwhistory_parameter_value(pam_file,
+                                          'remember',
+                                          '{{ var_password_pam_unix_remember }}') }}}
+
+{{% endif %}}

linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh → shared/templates/pam_account_password_unix_remember/bash.template

@@ -1,12 +1,18 @@
-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle
+# platform = multi_platform_all
 
-{{% if product in [ "sle12", "sle15" ] %}}
+{{{ bash_instantiate_variables("var_password_pam_unix_remember") }}}
+
+{{% if "debian" in product or "ubuntu" in product or product in ["sle12", "sle15" ] %}}
 {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/common-password' -%}}
 {{% else %}}
 {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/system-auth' -%}}
 {{% endif %}}
 
-{{{ bash_instantiate_variables("var_password_pam_unix_remember") }}}
+{{% if "debian" in product or "ubuntu" in product %}}
+
+{{{ bash_ensure_pam_module_options(accounts_password_pam_unix_remember_file, 'password', '\[success=[[:alnum:]].*\]', 'pam_unix.so', 'remember', "$var_password_pam_unix_remember", "$var_password_pam_unix_remember") }}}
+
+{{% else %}}
 
 {{{ bash_pam_pwhistory_enable(accounts_password_pam_unix_remember_file,
                               'requisite',
@@ -15,3 +21,6 @@
 {{{ bash_pam_pwhistory_parameter_value(accounts_password_pam_unix_remember_file,
                                        'remember',
                                        "$var_password_pam_unix_remember") }}}
+
+{{% endif %}}
+