On 6/28/13 9:15 AM, Brian Millett wrote:

+++ b/RHEL6/input/fixes/bash/password_require_minimun_class.sh
@@ -0,0 +1,6 @@
+grep -q minclass /etc/pam.d/system-auth
+if [ $? = "0" ]; then
+    sed --follow-symlinks -i "/pam_cracklib.so/s/minclass=[0-4]/minclass=3/" /etc/pam.d/system-auth
+else
+    sed --follow-symlinks -i "/pam_cracklib.so/s/pam_cracklib.so /pam_cracklib.so minclass=3 /" /etc/pam.d/system-auth
+fi

Per Jeff's note, the pseudo code for remediation parameters should be something like:

source ./templates/support.sh
populate var_password_pam_cracklib_minclass
grep -q minclass /etc/pam.d/system-auth
if [ $? = "0" ]; then
    sed --follow-symlinks -i "/pam_cracklib.so/s/minclass=[0-4]/minclass=$var_password_pam_cracklib_minclass
/" /etc/pam.d/system-auth
else
    sed --follow-symlinks -i "/pam_cracklib.so/s/pam_cracklib.so /pam_cracklib.so minclass=$var_password_pam_cracklib_minclass
 /" /etc/pam.d/system-auth
fi