-
Bug
-
Resolution: Not a Bug
-
Undefined
-
None
-
None
-
No
-
Low
-
rhel-security-compliance
-
None
-
None
-
None
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
None
During Ansible remediation using an Ansible user that requires sudo the rule as written will select a blank profile that will persist until manually fixed or rolled back.
The remediation generated is;
- name: Set number of Password Hashing Rounds - password-auth - Ensure the authselect custom profile is selected
ansible.builtin.command:
cmd: authselect select {{ authselect_custom_profile }}
register: result_pam_authselect_select_profile
when:
- result_authselect_check_cmd is success
- result_authselect_profile is not skipped
- authselect_current_profile is not match("custom/")
- authselect_custom_profile is not match(authselect_current_profile)
Without the `with-sudo` option added to the `authselect select` command a blank profile is selected, rather than the current profile in use and this needs to be manually corrected or rolled back after the run.
