{{% if 'ubuntu' in product %}}
{{% set configuration_files = ["common-password"] %}}
{{% endif %}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="2">
    {{{ oval_metadata("Check pam_pwquality module is enabled") }}}
    <criteria operator="AND" comment="Check for pam_pwquality module in PAM files">
      {{% for file in configuration_files %}}
      <criterion comment="pam_pwquality has correctly set in {{{ file }}}"
      test_ref="test_password_pam_pwquality_enabled_{{{ file | escape_id }}}" />
      {{% endfor %}}
    </criteria>
  </definition>

  {{% macro test_pwquality_enabled(path, test_ref) %}}
  <ind:textfilecontent54_test check="all" id="test_{{{ test_ref }}}" version="1"
  check_existence="at_least_one_exists"
  comment="Check for pam_pwquality.so module in PAM file of {{{ path }}}">
    <ind:object object_ref="obj_{{{ test_ref }}}" />
  </ind:textfilecontent54_test>
  {{% endmacro %}}

  {{% macro object_pwquality_enabled(path, test_ref) %}}
  <ind:textfilecontent54_object id="obj_{{{ test_ref }}}" version="1">
    <ind:filepath>{{{ path }}}</ind:filepath>
    <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  {{% endmacro %}}

  {{% for file in configuration_files %}}
  {{{ test_pwquality_enabled( path="/etc/pam.d/" ~ file ,
                             test_ref="password_pam_pwquality_enabled_" ~ (file | escape_id)) }}}
  {{{ object_pwquality_enabled( path="/etc/pam.d/" ~ file ,
                               test_ref="password_pam_pwquality_enabled_" ~ (file | escape_id)) }}}
  {{% endfor %}}
</def-group>
