CIS 4.5.1.6 difok regex incorrectly matches any line

[kdebisschop]

Overall Review of Changes:
Fixes typo in regex for difok so it no longer matches every line in the file.

As currently written, the regex is '^(#\s+|)difok|' which matches every line. Therefore, if the last line in /etc/security/pwquality.conf is not 'difok = n', a new copy of the difok setting will be inserted.

Issue Fixes:
Please list (using linking) any open issues this PR addresses

Enhancements:
Please list any enhancements/features that are not open issue tickets

How has this been tested?:
Please give an overview of how these changes were tested. If they were not please use N/A

Test file:

$ sudo grep difok /etc/security/pwquality.conf
difok = 5
$ sudo tail -n 5 /etc/security/pwquality.conf
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1

Before fix:

$ ansible-playbook -i inventory.yml -l 'server.example.com' cis-fixes.yml -CD

PLAY [all] *******************************************************************************************************

PLAY [ubuntu] *****************************************************************************************************************

TASK [UBUNTU20-CIS : PRELIM | Run apt update] *****************************************************************************************************************
changed: [server.example.com]

TASK [UBUNTU20-CIS : 4.5.1.6 | PATCH | Ensure the number of changed characters in a new password is configured] *****************************************************************************************************************
--- before: /etc/security/pwquality.conf (content)
+++ after: /etc/security/pwquality.conf (content)
@@ -77,4 +77,4 @@
dcredit = -1
ucredit = -1
ocredit = -1
-lcredit = -1
+difok = 5

changed: [server.example.com]

PLAY RECAP *****************************************************************************************************************
server.example.com : ok=289 changed=2 unreachable=0 failed=0 skipped=315 rescued=0 ignored=0

After fix:

$ ansible-playbook -i inventory.yml -l 'server.example.com' cis-fixes.yml -CD

PLAY [all] *******************************************************************************************************

PLAY [ubuntu] *****************************************************************************************************************

TASK [UBUNTU20-CIS : PRELIM | Run apt update] *****************************************************************************************************************
changed: [server.example.com]

PLAY RECAP *****************************************************************************************************************
server.example.com : ok=289 changed=1 unreachable=0 failed=0 skipped=315 rescued=0 ignored=0