---
- name: Gather package facts
  ansible.builtin.package_facts:
    manager: auto
  when:
    - ansible_facts.os_family != 'Suse'
    - ansible_facts.os_family != 'Archlinux'

# the reason for this is so a user cannot connect to a server,
# that isn't connected to an LDAP server anymore.
# normally caching credentials shouldn't be necessary for most machines.
# removing it provides some more security while not removing usability.
- name: Remove pam ccreds to disable password caching
  ansible.builtin.package:
    name: "{{ os_packages_pam_ccreds }}"
    state: absent
  when:
    - ansible_facts.os_family != 'Archlinux'

- name: Import tasks for Debian PAM
  ansible.builtin.import_tasks: pam_debian.yml
  when:
    - ansible_facts.os_family == 'Debian'

- name: Import tasks for RedHat PAM
  ansible.builtin.import_tasks: pam_rhel.yml
  when:
    - ansible_facts.os_family == 'RedHat'

- name: Allow Login with SSH Keys, when user password is expired
  ansible.builtin.lineinfile:
    path: /etc/pam.d/system-auth
    backrefs: true
    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
    line: '\1 no_pass_expiry'
  when:
    - ansible_facts.os_family == 'Archlinux'

- name: Allow Login with SSH Keys, when user password is expired
  ansible.builtin.lineinfile:
    path: /etc/pam.d/common-account
    backrefs: true
    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
    line: '\1 no_pass_expiry'
  when:
    - ansible_facts.os_family == 'Suse'

- name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
  ansible.builtin.template:
    src: etc/libuser.conf.j2
    dest: /etc/libuser.conf
    mode: "0640"
    owner: root
    group: root
  when:
    - ansible_facts.os_family != 'Suse'
    - ansible_facts.os_family != 'Archlinux'
    - "'libuser' in ansible_facts.packages"