use var values for pam_faillock

Signed-off-by: Jay Olinares <[email protected]>
ansible-lockdown · Apr 15, 2023 · fb4216b · fb4216b
1 parent 1ef886c
commit fb4216b
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/tasks/section_5/cis_5.5.x.yml b/tasks/section_5/cis_5.5.x.yml
@@ -38,8 +38,8 @@
       regexp: "{{ item.regexp }}"
       line: "{{ item.line }}"
   loop:
-      - { regexp: '^\s*deny\s*=\s*[1-5]\b', line: 'deny = 5' }
-      - { regexp: '^\s*unlock_time\s*=\s*(0|9[0-9][0-9]|[1-9][0-9][0-9][0-9]+)\b', line: 'unlock_time = 900' }
+      - { regexp: '^\s*deny\s*=\s*[1-5]\b', line: 'deny = {{ rhel9cis_pam_faillock.deny }}' }
+      - { regexp: '^\s*unlock_time\s*=\s*(0|9[0-9][0-9]|[1-9][0-9][0-9][0-9]+)\b', line: 'unlock_time = {{ rhel9cis_pam_faillock.unlock_time }}' }
   when:
       - rhel9cis_rule_5_5_2