Description of problem: OpenSCAP uses a separate file under /etc/ssh/sshd_config.d to configure sshd and this makes sense as it's then easy to see what are the changes and the reverting (if needed for some reason) to OS defaults is trivial. Starting with RHEL 8 there is /etc/security/pwquality.conf.d that could/should be used to create system-local password quality policy configurations. This would be consistent with sshd configuration and would avoid editing system-provided default files. However, it should be noted that at least currently the priorities for configuration files are inconsistent between sshd and pwpolicy, see https://bugzilla.redhat.com/show_bug.cgi?id=2055604. It would be helpful if OpenSCAP would use files under /etc/security/pwquality.conf.d to configure libpwquality. Thanks. (If deemed too late for RHEL 8 then doing this for RHEL 9 would be great.) Version-Release number of selected component (if applicable): RHEL 8.5
Moving ITR to 8.8, because we won't manage to deliver fix in 8.7
Given that with RHEL 8.8 / RHEL 9.2 we will have /etc/security/pwhistory.conf but not /etc/security/pwhistory.conf.d and that https://bugzilla.redhat.com/show_bug.cgi?id=2055604 remains unfixes perhaps it could be considered leaving this as-is, at least as long as the other areas are inconsistent. Thanks.