<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 11/12/13, 10:38 PM, Frank Caviggia
      wrote:<br>
    </div>
    <blockquote cite="mid:20131113033816.GA10244@mail.corp.redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">Shawn,

This should be a little bit better of a match to what you wanted for the password use remediation.

-Frank
</pre>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">0001-accounts_password_reuse_limit.sh-remediation.patch</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">From c6bd643edc3f9504172225d6a0fce9771a6e1a77 Mon Sep 17 00:00:00 2001
From: Frank Caviggia <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:fcaviggi@redhat.com">&lt;fcaviggi@redhat.com&gt;</a>
Date: Tue, 12 Nov 2013 22:35:19 -0500
Subject: [PATCH] accounts_password_reuse_limit.sh remediation

Signed-off-by: Frank Caviggia <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:fcaviggi@redhat.com">&lt;fcaviggi@redhat.com&gt;</a>
---
 RHEL6/input/fixes/bash/accounts_password_reuse_limit.sh | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 RHEL6/input/fixes/bash/accounts_password_reuse_limit.sh

diff --git a/RHEL6/input/fixes/bash/accounts_password_reuse_limit.sh b/RHEL6/input/fixes/bash/accounts_password_reuse_limit.sh
new file mode 100644
index 0000000..e278e54
--- /dev/null
+++ b/RHEL6/input/fixes/bash/accounts_password_reuse_limit.sh
@@ -0,0 +1,8 @@
+source ./templates/support.sh
+populate var_password_history_retain_limit
+
+if [ `grep -c 'remember=' /etc/pam.d/system-auth` -eq 0 ]; then
+        sed 's/^\s*password.*pam_unix\.so.*/&amp; remember=$var_password_history_retain_limit/' /etc/pam.d/system-auth
+else
+        sed 's/remember=[0-9]*<i class="moz-txt-slash"><span class="moz-txt-tag">/</span>remember=$var_password_history_retain_limit<span class="moz-txt-tag">/</span></i>' /etc/pam.d/system-auth
+fi
<div class="moz-txt-sig">-- 
1.8.3.1

</div></pre>
      </div>
    </blockquote>
    <br>
    I quickly tested with system-auth containing, and not, remember=.
    This is a great start!<br>
    <br>
    Three things remain:<br>
    <br>
    - sed -i ;)<br>
    <br>
    - The variable isn't being expanded when the script is ran, I get:<br>
    <blockquote type="cite"># bash accounts_password_reuse_limit.sh <br>
      .......<br>
      password    sufficient    pam_unix.so sha512 shadow try_first_pass
      use_authtok remember=$var_password_history_retain_limit<br>
      password    sufficient    pam_sss.so use_authtok</blockquote>
    <br>
    - What if "password pam_unix.so" isn't present?<br>
  </body>
</html>