Add "-Initial" replacement

ComplianceAsCode · Jan 21, 2025 · d05e01f · d05e01f
1 parent d47766a
commit d05e01f
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/...locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_root/bash/ubuntu.sh b/...locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_root/bash/ubuntu.sh
@@ -8,6 +8,12 @@ if ! grep -qE 'pam_pwhistory\.so\s+[^#\n]*\benforce_for_root\b' "$conf_file"; th
         s/$/ enforce_for_root/g
     }
     }' "$conf_file"
+
+    sed -i -E '/^Password-Initial:/,/^[^[:space:]]/ {
+    /pam_pwhistory\.so/ {
+        s/$/ enforce_for_root/g
+    }
+    }' "$conf_file"
 fi
 
 DEBIAN_FRONTEND=noninteractive pam-auth-update --enable cac_pwhistory