policy_pam/tasks/main.yml

@@ -1,8 +1,13 @@
 ---
-#
+
-# -password       [success=1 default=ignore]      pam_unix.so obscure yescrypt
+# System compatibility check. yescrypt only works on Debian 11+
-# +password       requisite                       pam_pwquality.so retry=3
+# So we ensure that this role isn't executed on older systems
-# +password       [success=1 default=ignore]      pam_unix.so obscure use_authtok try_first_pass yescrypt
+- name: "System compatibility check"
+  assert:
+    that:
+      - ansible_distribution == "Debian"
+      - ansible_distribution_major_version is version_compare('11', '>=')
+    msg: pam_policy is only compatible with Debian >= 11