# Help with pamd module

**URL:** <https://forum.ansible.com/t/help-with-pamd-module/28698>\
**Category:** Ansible Project\
**Tags:** rhel\
**Created:** [October 1, 2018, 5:26pm UTC](https://forum.ansible.com/t/help-with-pamd-module/28698 "2018-10-01T17:26:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robert2](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@Robert2](https://forum.ansible.com/u/Robert2)\
**Post date:** [October 1, 2018, 5:26pm UTC](https://forum.ansible.com/t/help-with-pamd-module/28698/1 "2018-10-01T17:26:03Z")

</div>

All,

I’m fairly new to ansible and have been following the ansible documentation but am having trouble with the pamd module and hope someone can help shed some light.

Here is my current task in my playbook:

- name: “[RHEL-06-000060] - Update difok number in /etc/pam.d/system-auth”  
pamd:  
name: system-auth  
type: password  
control: required  
module\_path: pam\_cracklib.so  
module\_arguments: ‘retry=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=8 maxrepeat=3’  
state: updated

What I am trying to do is just update the difok argument as the original setting in the file is difok=3. If I just change the module\_arguments part to just say ‘difok=8’ and change the state to args\_present, then it just appends to the end of the line and I have both a difok=3 and a difok=8. Is there a way to just use the module\_argument section for only the one I want to change without having to list all of the arguments? I’m trying to avoid my playbook showing changed every time I run it.

Any help is appreciated.

Thanks  
Robert

---

<div class="post-metadata">

**Author:** ![Brad2](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Brad2](https://forum.ansible.com/u/Brad2)\
**Post date:** [October 2, 2018, 2:55pm UTC](https://forum.ansible.com/t/help-with-pamd-module/28698/2 "2018-10-02T14:55:45Z")

</div>

Simplify your task. Just create a well know template with your correct settings for the system-auth-ac file and then just copy it down. You don’t really care what is currently in it if you just copy a good known copy down. Or, you could run an command grep for difok on system-auth-ac and only copy if the value is different than 8.