{{% set audisp_config_file_path = audisp_conf_path + "/audisp-remote.conf" %}}

<def-group>
  <definition class="compliance" id="auditd_audispd_encrypt_sent_records" version="1">
    {{% if product in ["rhel8", "fedora", "ol8", "rhv4", "sle15"] %}}
    {{{ oval_metadata("transport setting in " + audisp_config_file_path + " is set to 'KRB5'") }}}
    {{% else %}}
    {{{ oval_metadata("enable_krb5 setting in " + audisp_config_file_path + " is set to 'yes'") }}}
    {{% endif %}}

    <criteria>
      <criterion comment="setting in audisp-remote.conf" test_ref="test_auditd_audispd_encrypt_sent_records" />
    </criteria>

  </definition>

  <ind:textfilecontent54_test check="all" comment="setting in audisp-remote.conf" id="test_auditd_audispd_encrypt_sent_records" version="1">
    <ind:object object_ref="object_auditd_audispd_encrypt_sent_records" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_auditd_audispd_encrypt_sent_records" version="1">
    <ind:filepath>{{{ audisp_config_file_path }}}</ind:filepath>
    <!-- Allow only space (exactly) as delimiter -->
    <!-- Require at least one space before and after the equal sign -->
{{% if product in ["rhel8", "fedora", "ol8", "rhv4", "sle15"] %}}
    <ind:pattern operation="pattern match">^[ ]*transport[ ]+=[ ]+KRB5[ ]*$</ind:pattern>
{{% else %}}
    <ind:pattern operation="pattern match">^[ ]*enable_krb5[ ]+=[ ]+yes[ ]*$</ind:pattern>
{{% endif %}}
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
