---

- name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured"
  when: ubtu24cis_rule_5_3_3_2_1
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_5.3.3.2.1
    - NIST800-53R5_IA-5
    - pam
  block:
    - name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured | Remove difok from conf files except expected file"
      when: "ubtu24cis_passwd_difok_file not in item.path"
      ansible.builtin.replace:
        path: "{{ item.path }}"
        regexp: 'difok\s*=\s*\d+\b'
        replace: ''
      with_items:
        - "{{ prelim_pam_pwquality_confs.files }}"
        - { path: '/etc/security/pwquality.conf'}
        - { path: '/etc/pam.d/common-password' }

    - name: "5.3.3.2.1 | PATCH | Ensure password number of changed characters is configured | Ensure difok file exists"
      ansible.builtin.template:
        src: "{{ ubtu24cis_passwd_difok_file }}.j2"
        dest: "/{{ ubtu24cis_passwd_difok_file }}"
        owner: root
        group: root
        mode: 'go-rwx'

- name: "5.3.3.2.2 | PATCH | Ensure minimum password length is configured"
  when: ubtu24cis_rule_5_3_3_2_2
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_5.3.3.2.2
    - NIST800-53R5_IA-5
    - pam
  block:
    - name: "5.3.3.2.2 | PATCH | Ensure minimum password length is configured | Remove minlen from conf files except expected file"
      when: "ubtu24cis_passwd_minlen_file not in item.path"
      ansible.builtin.replace:
        path: "{{ item.path }}"
        regexp: 'minlen\s*=\s*\d+\b'
        replace: ''
      with_items:
        - "{{ prelim_pam_pwquality_confs.files }}"
        - { path: '/etc/security/pwquality.conf'}
        - { path: '/etc/pam.d/common-password' }

    - name: "5.3.3.2.2 | PATCH | Ensure minimum password length is configured | Ensure minlen file exists"
      ansible.builtin.template:
        src: "{{ ubtu24cis_passwd_minlen_file }}.j2"
        dest: "/{{ ubtu24cis_passwd_minlen_file }}"
        owner: root
        group: root
        mode: 'go-rwx'

- name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured"
  when: ubtu24cis_rule_5_3_3_2_3
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_5.3.3.2.3
    - NIST800-53R5_IA-5
    - pam
  block:
    - name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured | Remove pwd complex settings from conf files except expected file"
      when: "ubtu24cis_passwd_complex_file not in item.path"
      ansible.builtin.replace:
        path: "{{ item.path }}"
        regexp: '(minclass|[dulo]credit)\s*=\s*(-\d|\d+)\b'
        replace: ''
      with_items:
        - "{{ prelim_pam_pwquality_confs.files }}"
        - { path: '/etc/security/pwquality.conf'}
        - { path: '/etc/pam.d/common-password' }

    - name: "5.3.3.2.3 | PATCH | Ensure password complexity is configured | Ensure complexity file exists"
      ansible.builtin.template:
        src: "{{ ubtu24cis_passwd_complex_file }}.j2"
        dest: "/{{ ubtu24cis_passwd_complex_file }}"
        owner: root
        group: root
        mode: 'go-rwx'

- name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured"
  when: ubtu24cis_rule_5_3_3_2_4
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_5.3.3.2.4
    - NIST800-53R5_IA-5
    - pam
  block:
    - name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured | Remove maxrepeat settings from conf files except expected file"
      when: "ubtu24cis_passwd_maxrepeat_file not in item.path"
      ansible.builtin.replace:
        path: "{{ item.path }}"
        regexp: 'maxrepeat\s*=\s*\d+\b'
        replace: ''
      with_items:
        - "{{ prelim_pam_pwquality_confs.files }}"
        - { path: '/etc/security/pwquality.conf'}
        - { path: '/etc/pam.d/common-password' }

    - name: "5.3.3.2.4 | PATCH | Ensure password same consecutive characters is configured | Ensure maxrepeat file exists"
      ansible.builtin.template:
        src: "{{ ubtu24cis_passwd_maxrepeat_file }}.j2"
        dest: "/{{ ubtu24cis_passwd_maxrepeat_file }}"
        owner: root
        group: root
        mode: 'go-rwx'

- name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is is configured"
  when: ubtu24cis_rule_5_3_3_2_5
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_5.3.3.2.5
    - NIST800-53R5_IA-5
    - pam
  block:
    - name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is configured | Remove maxsequence settings from conf files except expected file"
      when: "ubtu24cis_passwd_maxsequence_file not in item.path"
      ansible.builtin.replace:
        path: "{{ item.path }}"
        regexp: 'maxsequence\s*=\s*\d+\b'
        replace: ''
      with_items:
        - "{{ prelim_pam_pwquality_confs.files }}"
        - { path: '/etc/security/pwquality.conf'}
        - { path: '/etc/pam.d/common-password' }

    - name: "5.3.3.2.5 | PATCH | Ensure password maximum sequential characters is configured | Ensure maxsequence file exists"
      ansible.builtin.template:
        src: "{{ ubtu24cis_passwd_maxsequence_file }}.j2"
        dest: "/{{ ubtu24cis_passwd_maxsequence_file }}"
        owner: root
        group: root
        mode: 'go-rwx'

- name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled"
  when: ubtu24cis_rule_5_3_3_2_6
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_5.3.3.2.6
    - NIST800-53R5_IA-5
    - pam
  block:
    - name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled | Remove dictcheck settings from conf files except expected file"
      when: "ubtu24cis_passwd_dictcheck_file not in item.path"
      ansible.builtin.replace:
        path: "{{ item.path }}"
        regexp: 'dictcheck\s*=\s*\d+\b'
        replace: ''
      with_items:
        - "{{ prelim_pam_pwquality_confs.files }}"
        - { path: '/etc/security/pwquality.conf'}
        - { path: '/etc/pam.d/common-password' }

    - name: "5.3.3.2.6 | PATCH | Ensure password dictionary check is enabled | Ensure dictcheck file exists"
      ansible.builtin.template:
        src: "{{ ubtu24cis_passwd_dictcheck_file }}.j2"
        dest: "/{{ ubtu24cis_passwd_dictcheck_file }}"
        owner: root
        group: root
        mode: 'go-rwx'

- name: "5.3.3.2.7 | PATCH | Ensure password quality checking is enforced"
  when: ubtu24cis_rule_5_3_3_2_7
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_5.3.3.2.7
    - NIST800-53R5_IA-5
    - pam
  block:
    - name: "5.3.3.2.7 | PATCH | Ensure password quality checking is enforced | Remove quality enforcement settings from conf files except expected file"
      when: "ubtu24cis_passwd_quality_enforce_file not in item.path"
      ansible.builtin.replace:
        path: "{{ item.path }}"
        regexp: 'enforcing\s*=\s*\d+\b'
        replace: ''
      with_items:
        - "{{ prelim_pam_pwquality_confs.files }}"
        - { path: '/etc/security/pwquality.conf'}
        - { path: '/etc/pam.d/common-password' }

    - name: "5.3.3.2.7 | PATCH | Ensure password quality checking is enforced | Ensure quality enforcement file exists"
      ansible.builtin.template:
        src: "{{ ubtu24cis_passwd_quality_enforce_file }}.j2"
        dest: "/{{ ubtu24cis_passwd_quality_enforce_file }}"
        owner: root
        group: root
        mode: 'go-rwx'

- name: "5.3.3.2.8 | PATCH | Ensure password quality is enforced for the root user"
  when: ubtu24cis_rule_5_3_3_2_8
  tags:
    - level1-server
    - level1-workstation
    - patch
    - rule_5.3.3.2.8
    - NIST800-53R5_IA-5
    - pam
  ansible.builtin.template:
    src: "{{ ubtu24cis_passwd_quality_enforce_root_file }}.j2"
    dest: "/{{ ubtu24cis_passwd_quality_enforce_root_file }}"
    owner: root
    group: root
    mode: 'go-rwx'