{{% if "sle12" in product or "debian" in product or "ubuntu" in product %}}
{{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/common-password' -%}}
{{% else %}}
{{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/system-auth' -%}}
{{% endif %}}

<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="2">
    {{{ oval_metadata("The passwords to remember should be set correctly.", rule_title=rule_title) }}}
    <criteria operator="OR" comment="Check if pam_pwhistory.so or pam_unix.so are configured">
      <criteria operator="AND" comment="Check if pam_pwhistory.so is properly configured">
	<!--
	    pam_pwhistory.so parameters can be defined directly in pam files or, in newer versions,
	    in /etc/security/pwhistory.conf. The last is the recommended option when available. Also,
	    is the option used by auselect tool. However, regardless the approach, a minimal
	    declaration is common in pam files. -->
	<criterion test_ref="test_accounts_password_pam_unix_remember"
		   comment="pam_pwhistory.so is properly defined in password section of PAM file"/>

	<!--
	    pam_pwhistory.so parameters should be defined in /etc/security/pwhistory.conf whenever
	    possible. But due to backwards compatibility, they are also allowed in pam files directly.
	    In case they are defined in both places, pam files have precedence and this may confuse
	    the assessment. The following tests ensure only one option is used. Note that if
	    pwhistory.conf is available, authselect tool will preserve PAM files from parameters
	    definitions in favor of /etc/security/pwhistory.conf. -->
	<criteria operator="OR"
		  comment="Check the expected value for pam_pwhistory.so remember parameter">
	  <criteria operator="AND"
		    comment="Check the pam_pwhistory.so remember parameter is only in PAM file">
	    <criterion
		test_ref="test_accounts_password_pam_unix_remember_pamd"
		comment="Check the remember parameter in password section of PAM file"/>
	    <criterion
		test_ref="test_accounts_password_pam_unix_remember_no_pwhistory_conf"
		comment="Check the pam_pwhistory.so remember parameter is absent in {{{ pwhistory_path }}}"/>
	  </criteria>
	  <criteria operator="AND"
		    comment="Check the pam_pwhistory.so remember parameter is only in {{{ pwhistory_path }}} file">
	    <criterion
		test_ref="test_accounts_password_pam_unix_remember_no_pamd"
		comment="Check the pam_pwhistory.so remember parameter is absent in PAM file"/>
	    <criterion
		test_ref="test_accounts_password_pam_unix_remember_pwhistory_conf"
		comment="Check the remember parameter in {{{ pwhistory_path }}}"/>
	  </criteria>
	</criteria>
      </criteria>
      <criterion test_ref="test_accounts_password_pam_unix_remember_legacy"
		 comment="Remember parameter of pam_unix.so is properly configured"/>
    </criteria>
  </definition>

  <external_variable comment="number of passwords that should be remembered" datatype="int" id="var_password_pam_unix_remember" version="1" />

  <!-- is pam_pwhistory.so enabled? -->
  <ind:textfilecontent54_test id="test_accounts_password_pam_unix_remember"
			      check="all" version="1" comment="Check pam_pwhistory.so presence in PAM file">
    <ind:object object_ref="object_accounts_password_pam_unix_remember"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_accounts_password_pam_unix_remember"
				version="1">
    <ind:filepath>{{{ accounts_password_pam_unix_remember_file }}}</ind:filepath>
    <ind:pattern var_ref="var_accounts_password_pam_unix_remember_module_regex"
		 var_check="at least one" operation="pattern match"/>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <!-- is the pam_pwhistory.so remember parameter correctly defined only in PAM files? -->
  <ind:textfilecontent54_test
      id="test_accounts_password_pam_unix_remember_pamd" check="all" version="1"
      comment="Check remember parameter is present and correct in PAM file">
    <ind:object object_ref="object_accounts_password_pam_unix_remember_pamd"/>
    <ind:state state_ref="state_accounts_password_pam_unix_remember"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object
      id="object_accounts_password_pam_unix_remember_pamd" version="1">
    <ind:filepath>{{{ accounts_password_pam_unix_remember_file }}}</ind:filepath>
    <ind:pattern var_check="at least one" operation="pattern match"
		 var_ref="var_accounts_password_pam_unix_remember_pam_param_regex"/>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state
      id="state_accounts_password_pam_unix_remember" version="1">
    <ind:subexpression datatype="int" operation="greater than or equal"
		       var_ref="var_password_pam_unix_remember"/>
  </ind:textfilecontent54_state>

  <external_variable id="var_password_pam_unix_remember" version="1"
		     datatype="int" comment="number of passwords that should be remembered"/>
  <external_variable comment="number of passwords that should be remembered" datatype="int" id="var_password_pam_unix_remember" version="1" />

  <ind:textfilecontent54_test check="all" check_existence="none_exist" version="1"
			      id="test_accounts_password_pam_unix_remember_no_pwhistory_conf"
			      comment="Check the absence of remember parameter in {{{ pwhistory_path }}}">
    <ind:object
	object_ref="object_accounts_password_pam_unix_remember_param_conf"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object
      id="object_accounts_password_pam_unix_remember_param_conf" version="1"
      comment="Collect the pam_pwhistory.so remember parameter from {{{ pwhistory_path }}}">
    <ind:filepath operation="pattern match">^{{{ pwhistory_path }}}$</ind:filepath>
    <ind:pattern operation="pattern match"
		 var_ref="var_accounts_password_pam_unix_remember_conf_param_regex"/>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>

  <!-- is the pam_pwhistory.so remember parameter correctly defined only in pwhistory.conf? -->
  <ind:textfilecontent54_test
      id="test_accounts_password_pam_unix_remember_no_pamd" version="1"
      check="all" check_existence="none_exist"
      comment="Check remember parameter is absent in PAM file">
    <ind:object object_ref="object_accounts_password_pam_unix_remember_pamd"/>
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_test
      id="test_accounts_password_pam_unix_remember_pwhistory_conf" version="1"
      check="all" check_existence="all_exist"
      comment="Check remember parameter is present and correct in {{{ pwhistory_path }}}">
    <ind:object object_ref="object_accounts_password_pam_unix_remember_param_conf"/>
    <ind:state state_ref="state_accounts_password_pam_unix_remember"/>
  </ind:textfilecontent54_test>

  <!-- variables used to check the module implementation -->
  <local_variable id="var_accounts_password_pam_unix_remember_module_regex"
		  datatype="string" version="1"
		  comment="The regex is to confirm the pam_pwhistory.so module is enabled">
    <literal_component>^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so.*$</literal_component>
  </local_variable>

  <!-- variables used to collect the remember parameter value -->
  <local_variable id="var_accounts_password_pam_unix_remember_pam_param_regex"
		  datatype="string" version="1"
		  comment="The regex is to collect the pam_pwhistory.so remember parameter from PAM files">
    <literal_component>^\s*password\b.*\bpam_pwhistory\.so\b.*\bremember=([0-9]*).*$</literal_component>
  </local_variable>

  <local_variable id="var_accounts_password_pam_unix_remember_conf_param_regex"
		  datatype="string" version="1"
		  comment="The regex is to collect the pam_pwhistory.so remember parameter in {{{ pwhistory_path }}}">
    <literal_component>^\s*remember\s*=\s*([0-9]+)</literal_component>
  </local_variable>

  <!-- Check the pam_unix.so remember case -->
  <ind:textfilecontent54_test id="test_accounts_password_pam_unix_remember_legacy" version="1"
			      check="all" check_existence="all_exist"
			      comment="Test if remember attribute of pam_unix.so is set correctly in {{{ accounts_password_pam_unix_remember_file }}}">
    <ind:object object_ref="object_accounts_password_pam_unix_remember_legacy" />
    <ind:state state_ref="state_accounts_password_pam_unix_remember" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_accounts_password_pam_unix_remember_legacy" version="1">
    <ind:filepath>{{{ accounts_password_pam_unix_remember_file }}}</ind:filepath>
    <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required)|(?:\[.*\]))\s+pam_unix\.so.*remember=([0-9]*).*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
