From 9b6f3130653af3083bd845c4d39ea1f6e5cdee9f Mon Sep 17 00:00:00 2001
From: Martin Schurz <Martin.Schurz@t-systems.com>
Date: Mon, 22 Feb 2021 15:54:03 +0100
Subject: [PATCH] move pam tests up

Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
---
 molecule/os_hardening/converge.yml   | 1 -
 molecule/os_hardening/verify.yml     | 8 ++++----
 molecule/os_hardening/verify_pam.yml | 2 +-
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/molecule/os_hardening/converge.yml b/molecule/os_hardening/converge.yml
index 0c7c00a8..8ef60885 100644
--- a/molecule/os_hardening/converge.yml
+++ b/molecule/os_hardening/converge.yml
@@ -15,7 +15,6 @@
     os_security_kernel_enable_core_dump: true
     os_security_suid_sgid_remove_from_unknown: true
     os_auth_pam_passwdqc_enable: false
-    os_auth_retries: 2
     os_auth_lockout_time: 15
     os_desktop_enable: true
     os_env_extra_user_paths: ['/home']
diff --git a/molecule/os_hardening/verify.yml b/molecule/os_hardening/verify.yml
index 45707aff..d93f0f66 100644
--- a/molecule/os_hardening/verify.yml
+++ b/molecule/os_hardening/verify.yml
@@ -33,6 +33,10 @@
         name: procps
       when: ansible_facts.os_family == 'Debian'
 
+    - name: include PAM tests
+      include: verify_pam.yml
+      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
+
     - name: download cinc-auditor
       get_url:
         url: https://omnitruck.cinc.sh/install.sh
@@ -70,7 +74,3 @@
       shell:
         cmd: "grep '027 #override' /etc/login.defs"
       changed_when: false
-
-    - name: include PAM tests
-      include: verify_pam.yml
-      when: ansible_facts.distribution in ['Debian', 'Ubuntu'] or ansible_facts.os_family == 'RedHat'
diff --git a/molecule/os_hardening/verify_pam.yml b/molecule/os_hardening/verify_pam.yml
index 86525238..6c8dafbc 100644
--- a/molecule/os_hardening/verify_pam.yml
+++ b/molecule/os_hardening/verify_pam.yml
@@ -21,7 +21,7 @@
 - name: check unsuccessfull login with incorrect password
   shell:
     cmd: "pam-tester --user testuser --password {{ test_pw }}fail --expectfail"
-  with_sequence: count=3
+  with_sequence: count=6
 
 - name: check ussuccessfull login, with orrect password (lockout)
   shell: