diff --git a/benchmarks/access-and-control/1.27-ensure-password-creation-requirements-are-configured.md b/benchmarks/access-and-control/1.27-ensure-password-creation-requirements-are-configured.md
index 1a125eff70c46479e0b520d8b7a7f0dbb91c9576..51490216bf55e8d83977c05a97d2937003ce8705 100644
--- a/benchmarks/access-and-control/1.27-ensure-password-creation-requirements-are-configured.md
+++ b/benchmarks/access-and-control/1.27-ensure-password-creation-requirements-are-configured.md
@@ -52,31 +52,14 @@
 
 **以上两组参数效果一致，可根据实际情况，任选其一进行配置。**
 
-3. 执行以下命令，来更新`system-auth`和`password-auth`文件，像其中添加`enforce-for-root`及`retry=3`参数。
+3. 编辑`/etc/pam.d/system-auth`和`/etc/pam.d/password-auth`文件，向其中添加或追加`enforce-for-root`及`retry=3`参数。
 
 - `enforce-for-root` - 对`root`用户也执行策略
 - `retry=3` - 密码认证失败后可以尝试重新输入密码的次数
-- 创建自定义规则并指定和应用规则：
-
-```bash
-# currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-# authselect create-profile user-profile -b $currProfile
-# authselect select custom/user-profile
-# authselect apply-changes
-```
-
-`user-profile` 为自定义规则名称，可根据实际情况自定义修改。
-
 - 添加参数：
+
 ```bash
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
-for FN in system-auth password-auth; do
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
-    [[ -n $customProfile ]] && PTF=/etc/authselect/$customProfile/$FN || PTF=/etc/pam.d/$FN
-    [[ -z $(grep -E '^\s*password\s+requisite\s+pam_pwquality.so\s+.*enforce-for-root\s*.*$' $PTF) ]] && sed -ri 's/^\s*(password\s+requisite\s+pam_pwquality.so\s+)(.*)$/\1\2 enforce-for-root/' $PTF
-    [[ -n $(grep -E '^\s*password\s+requisite\s+pam_pwquality.so\s+.*\s+retry=\S+\s*.*$' $PTF) ]] && sed -ri '/pwquality/s/retry=\S+/retry=3/' $PTF || sed -ri 's/^\s*(password\s+requisite\s+pam_pwquality.so\s+)(.*)$/\1\2 retry=3/' $PTF
-done
-authselect apply-changes
+password    requisite    pam_pwquality.so  enforce-for-root retry=3
 ```
 
 ## 扫描检测
@@ -87,8 +70,8 @@ authselect apply-changes
 
 ```bash
 # grep pam_pwquality.so /etc/pam.d/system-auth /etc/pam.d/password-auth
-/etc/pam.d/system-auth:password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
-/etc/pam.d/password-auth:password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
+/etc/pam.d/system-auth:password    requisite    pam_pwquality.so  enforce-for-root retry=3
+/etc/pam.d/password-auth:password    requisite    pam_pwquality.so  enforce-for-root retry=3
 ```
 
 2. 执行以下命令，验证密码长度配置是否符合要求（`minlen>=14`）：
diff --git a/benchmarks/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.md b/benchmarks/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.md
index 6d8a9dd51460d0efd726e6a99dc09502fb157c7b..13e7519159ee3aeaaadb132a7852f57256f84f35 100644
--- a/benchmarks/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.md
+++ b/benchmarks/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.md
@@ -17,31 +17,13 @@
 
 ## 修复建议
 
-1. 执行以下命令，来更新`system-auth`和`password-auth`文件，像其中添加`deny`及`unlock_time`参数。
-
-- 创建自定义规则并指定和应用规则：
-
-```bash
-# currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-# authselect create-profile user-profile -b $currProfile
-# authselect select custom/user-profile
-# authselect apply-changes
-```
-
-`user-profile` 为自定义规则名称，可根据实际情况自定义修改。
+1. 编辑`/etc/pam.d/system-auth`和`/etc/pam.d/password-auth`文件，向其中添加或追加`deny`及`unlock_time`参数。
 
 - 添加参数：
+
 ```bash
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
-for FN in system-auth password-auth; do
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
-    [[ -n $customProfile ]] && PTF=/etc/authselect/$customProfile/$FN || PTF=/etc/pam.d/$FN
-    [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s+.*deny=\S+\s*.*$' $PTF) ]] && sed -ri '/pam_faillock.so/s/deny=\S+/deny=5/g' $PTF || sed -ri 's/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*[^{}])(\{.*\}|)$/\1\2 deny=5 \3/' $PTF
-    [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s+.*unlock_time=\S+\s*.*$' $PTF) ]] && sed -ri '/pam_faillock.so/s/unlock_time=\S+/unlock_time=900/g' $PTF || sed -ri 's/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*[^{}])(\{.*\}|)$/\1\2 unlock_time=900 \3/' $PTF
-done
-authselect apply-changes
-# 启用faillock模块
-authselect enable-feature with-faillock
+auth    required    pam_faillock.so preauth silent deny=5 unlock_time=900
+auth    required    pam_faillock.so authfail deny=5 unlock_time=900
 ```
 
 ## 扫描检测
diff --git a/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md b/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md
index dbe830f69d0687f8f04789e2d193e1ea50755387..c97497a60afa3e8700c7e3d794514c92069f6374 100644
--- a/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md
+++ b/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md
@@ -14,35 +14,12 @@
 
 ## 修复建议
 
-1. 执行以下命令，来更新`system-auth`文件，像其中添加`remember`参数。
-
-- 创建自定义规则并指定和应用规则：
-
-```bash
-# currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-# authselect create-profile user-profile -b $currProfile
-# authselect select custom/user-profile
-# authselect apply-changes
-```
-
-`user-profile` 为自定义规则名称，可根据实际情况自定义修改。
+1. 编辑`/etc/pam.d/system-auth`文件，向其中添加或追加`remember`参数。
 
 - 添加参数：
 ```bash
-if authselect current | awk 'NR == 1 {print $3}' | grep -q custom/; then
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/system-auth)进行修改
-    PTF=/etc/authselect/"$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)"/system-auth
-else
-    PTF=/etc/pam.d/system-auth
-fi
-
-if grep -Eq '^\s*password\s+(sufficient\s+pam_unix|requi(red|site)\s+pam_pwhistory).so\s+([^#]+\s+)*remember=\S+\s*.*$' $PTF; then
-    sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)(remember=\S+\s*)(.*)$/\1\4 remember=5 \6/' $PTF
-else
-    sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)$/\1\4 remember=5/' $PTF
-fi
-
-authselect apply-changes
+password    requisite    pam_pwhistory.so    remember=5
+password    sufficient    pam_unix.so    remember=5
 ```
 
 ## 扫描检测
diff --git a/benchmarks/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.md b/benchmarks/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.md
index ffcf9862a26ce59d3dd79a63888b3f7171b6d393..4410cd0f9f442277686ef4834236e8364282893f 100644
--- a/benchmarks/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.md
+++ b/benchmarks/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.md
@@ -12,27 +12,11 @@
 
 设置密码哈希算法为 sha512。
 
-1. 执行以下命令，修改`password-auth`和`system-auth`配置文件中`pam_unix.so`的哈希算法配置为`SHA-512`：
-
-- 创建自定义规则并指定和应用规则：
-
-```bash
-# currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-# authselect create-profile user-profile -b $currProfile
-# authselect select custom/user-profile
-# authselect apply-changes
-```
-
-`user-profile` 为自定义规则名称，可根据实际情况自定义修改。
+1. 编辑`/etc/pam.d/system-auth`和`/etc/pam.d/password-auth`文件，向其中添加或追加`pam_unix.so`的哈希算法配置为`SHA-512`：
 
 - 添加参数：
 ```bash
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
-for FN in system-auth password-auth; do
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
-    [[ -n $customProfile ]] && PTF=/etc/authselect/$customProfile/$FN || PTF=/etc/pam.d/$FN
-    [[ -z $(grep -E '^\s*password\s+sufficient\s+pam_unix.so\s+.*sha512\s*.*$' $PTF) ]] && sed -ri '/^\s*password\s+sufficient\s+pam_unix.so\s+/ { /^\s*password\s+sufficient\s+pam_unix.so(\s+\S+)*(\s+sha512)(\s+.*)?$/! s/^(\s*password\s+sufficient\s+pam_unix.so\s+)(.*)$/\1sha512 \2/ }' $PTF
-done
+password    sufficient                                   pam_unix.so  sha512
 ```
 
 ## 扫描检测
diff --git a/benchmarks/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.md b/benchmarks/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.md
index 158c3c3fbc054133859e81258ee05375c3b7fb31..16d729d785427ce71877abec72f280ba6745210e 100644
--- a/benchmarks/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.md
+++ b/benchmarks/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.md
@@ -14,35 +14,12 @@
 
 ## 修复建议
 
-1. 执行以下命令，来更新`system-auth`文件，像其中添加`remember`参数。
-
-- 创建自定义规则并指定和应用规则：
-
-```bash
-# currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-# authselect create-profile user-profile -b $currProfile
-# authselect select custom/user-profile
-# authselect apply-changes
-```
-
-`user-profile` 为自定义规则名称，可根据实际情况自定义修改。
+1. 编辑`/etc/pam.d/system-auth`文件，向其中添加或追加`remember`参数。
 
 - 添加参数：
 ```bash
-if authselect current | awk 'NR == 1 {print $3}' | grep -q custom/; then
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/system-auth)进行修改
-    PTF=/etc/authselect/"$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)"/system-auth
-else
-    PTF=/etc/pam.d/system-auth
-fi
-
-if grep -Eq '^\s*password\s+(sufficient\s+pam_unix|requi(red|site)\s+pam_pwhistory).so\s+([^#]+\s+)*remember=\S+\s*.*$' $PTF; then
-    sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)(remember=\S+\s*)(.*)$/\1\4 remember=5 \6/' $PTF
-else
-    sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)$/\1\4 remember=5/' $PTF
-fi
-
-authselect apply-changes
+password    requisite    pam_pwhistory.so    remember=5
+password    sufficient    pam_unix.so    remember=5
 ```
 
 ## 扫描检测
diff --git a/benchmarks/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.md b/benchmarks/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.md
index 6ef13d9a87325099e77fc7bb264025ca0f105587..5d2189eed4f8f889c70857b0fe764aeb2e03a93f 100644
--- a/benchmarks/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.md
+++ b/benchmarks/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.md
@@ -17,31 +17,13 @@
 
 ## 修复建议
 
-对`system-auth`及`password-auth`配置文件的参数进行配置。
-
-- 创建自定义规则并指定和应用规则：
-
-```bash
-# currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-# authselect create-profile user-profile -b $currProfile
-# authselect select custom/user-profile
-# authselect apply-changes
-```
-
-`user-profile` 为自定义规则名称，可根据实际情况自定义修改。
+1. 编辑`/etc/pam.d/system-auth`和`/etc/pam.d/password-auth`文件，向其中添加或追加`deny`及`unlock_time`参数。
 
 - 添加参数：
+
 ```bash
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
-for FN in system-auth password-auth; do
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
-    [[ -n $customProfile ]] && PTF=/etc/authselect/$customProfile/$FN || PTF=/etc/pam.d/$FN
-    [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s+.*deny=\S+\s*.*$' $PTF) ]] && sed -ri '/pam_faillock.so/s/deny=\S+/deny=5/g' $PTF || sed -ri 's/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*[^{}])(\{.*\}|)$/\1\2 deny=5 \3/' $PTF
-    [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s+.*unlock_time=\S+\s*.*$' $PTF) ]] && sed -ri '/pam_faillock.so/s/unlock_time=\S+/unlock_time=900/g' $PTF || sed -ri 's/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*[^{}])(\{.*\}|)$/\1\2 unlock_time=900 \3/' $PTF
-done
-authselect apply-changes
-# 启用faillock模块
-authselect enable-feature with-faillock
+auth    required    pam_faillock.so preauth silent deny=5 unlock_time=900
+auth    required    pam_faillock.so authfail deny=5 unlock_time=900
 ```
 
 ## 扫描检测
diff --git a/remediation-kits/access-and-control/1.27-ensure-password-creation-requirements-are-configured.sh b/remediation-kits/access-and-control/1.27-ensure-password-creation-requirements-are-configured.sh
index 787b43a624d56e2c09100efbe4b31dec55d84d70..fe2eff8aaca6a63afbaeb388f269fa626c5f3b9f 100644
--- a/remediation-kits/access-and-control/1.27-ensure-password-creation-requirements-are-configured.sh
+++ b/remediation-kits/access-and-control/1.27-ensure-password-creation-requirements-are-configured.sh
@@ -1,27 +1,38 @@
 #!/usr/bin/env bash
 
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
-currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-createP="user-profile"
+authselect check &> /dev/null && auCheck=0
 
-# 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
-if [[ -z $customProfile ]]; then
-    authselect create-profile $createP -b $currProfile
-    authselect select custom/$createP
-    authselect apply-changes
+if [[ $auCheck == "0" ]] ; then
+    customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
+    currProfile=$(authselect current | awk 'NR == 1 {print $3}')
+    createP="user-profile"
+
+    # 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
+    if [[ -z $customProfile ]]; then
+        authselect create-profile $createP -b $currProfile
+        authselect select custom/$createP
+        authselect apply-changes
+    fi
 fi
 
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
+[[ $auCheck == "0" ]] && customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/) || customProfile=""
+# 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
 for FN in system-auth password-auth; do
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
     [[ -n $customProfile ]] && PTF=/etc/authselect/$customProfile/$FN || PTF=/etc/pam.d/$FN
+    [[ -z $(grep -E '^\s*password\s+requisite\s+pam_pwquality.so.*$' $PTF) ]] && ln=$(grep -En -m1 '^\s*password\s+' $PTF | cut -d: -f1) && sed -i "${ln}i\password    requisite    pam_pwquality.so " $PTF
     [[ -z $(grep -E '^\s*password\s+requisite\s+pam_pwquality.so\s+.*enforce-for-root\s*.*$' $PTF) ]] && sed -ri 's/^\s*(password\s+requisite\s+pam_pwquality.so\s+)(.*)$/\1\2 enforce-for-root/' $PTF
     [[ -n $(grep -E '^\s*password\s+requisite\s+pam_pwquality.so\s+.*\s+retry=\S+\s*.*$' $PTF) ]] && sed -ri '/pwquality/s/retry=\S+/retry=3/' $PTF || sed -ri 's/^\s*(password\s+requisite\s+pam_pwquality.so\s+)(.*)$/\1\2 retry=3/' $PTF
 done
-authselect apply-changes
-
-grep -Eq "^(\s*)minlen\s*=\s*\S+(\s*#.*)?\s*$" /etc/security/pwquality.conf && sed -ri "s/^(\s*)minlen\s*=\s*\S+(\s*#.*)?\s*$/\minlen=14\2/" /etc/security/pwquality.conf || echo "minlen=14" >> /etc/security/pwquality.conf
+[[ $auCheck == "0" ]] && authselect apply-changes &> /dev/null
 
+minlenValue=$(grep -P "^\s*minlen\s*=.*" /etc/security/pwquality.conf | cut -d= -f2 | tr -d '[:space:]')
+if [[ -z $minlenValue ]] ; then
+    echo "minlen=14" >> /etc/security/pwquality.conf
+elif [[ $minlenValue =~ ^[0-9]+$ ]] && [[ $minlenValue -lt 14 ]] ; then
+    sed -ri "s/^(\s*)minlen\s*=\s*\S+(\s*#.*)?\s*$/\minlen=14\2/" /etc/security/pwquality.conf
+else
+    sed -ri "s/^(\s*)minlen\s*=\s*\S+(\s*#.*)?\s*$/\minlen=14\2/" /etc/security/pwquality.conf
+fi
 
 # minclass 与 credit 效果一致，任选其一即可，这里只修改minclass参数
 grep -Eq "^(\s*)minclass\s*=\s*\S+(\s*#.*)?\s*$" /etc/security/pwquality.conf && sed -ri "s/^(\s*)minclass\s*=\s*\S+(\s*#.*)?\s*$/\minclass=4\2/" /etc/security/pwquality.conf || echo "minclass=4" >> /etc/security/pwquality.conf
diff --git a/remediation-kits/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.sh b/remediation-kits/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.sh
index 3f17a858c7f1d464c35cd2bedf8ad9893e4e347d..8a76518d7eb84a4650b927370ba99b146e3848a5 100644
--- a/remediation-kits/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.sh
+++ b/remediation-kits/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.sh
@@ -1,24 +1,41 @@
 #!/usr/bin/env bash
 
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
-currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-createP="user-profile"
+authselect check &> /dev/null && auCheck=0
 
-# 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
-if [[ -z $customProfile ]]; then
-    authselect create-profile $createP -b $currProfile
-    authselect select custom/$createP
-    authselect apply-changes
+if [[ $auCheck == "0" ]] ; then
+    customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
+    currProfile=$(authselect current | awk 'NR == 1 {print $3}')
+    createP="user-profile"
+
+    # 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
+    if [[ -z $customProfile ]]; then
+        authselect create-profile $createP -b $currProfile
+        authselect select custom/$createP
+        authselect apply-changes
+    fi
 fi
 
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
+[[ $auCheck == "0" ]] && customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/) || customProfile=""
+# 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
 for FN in system-auth password-auth; do
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
     [[ -n $customProfile ]] && PTF=/etc/authselect/$customProfile/$FN || PTF=/etc/pam.d/$FN
-    [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s+.*deny=\S+\s*.*$' $PTF) ]] && sed -ri '/pam_faillock.so/s/deny=\S+/deny=5/g' $PTF || sed -ri 's/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*[^{}])(\{.*\}|)$/\1\2 deny=5 \3/' $PTF
-    [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s+.*unlock_time=\S+\s*.*$' $PTF) ]] && sed -ri '/pam_faillock.so/s/unlock_time=\S+/unlock_time=900/g' $PTF || sed -ri 's/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*[^{}])(\{.*\}|)$/\1\2 unlock_time=900 \3/' $PTF
+    [[ -z $(grep -E '^\s*auth\s+required\s+pam_faillock.so.*$' $PTF) ]] && ln=$(grep -En -m1 '^\s*auth\s+' $PTF | cut -d: -f1) && sed -i "${ln}i\auth    required    pam_faillock.so    preauth silent \nauth    required    pam_faillock.so    authfail " $PTF
+
+    denyLN=$(grep -En '^\s*auth\s+required\s+pam_faillock.so\s*.*' $PTF | grep -Pv "deny=" | cut -d: -f1)
+    if [[ -n $denyLN ]] ; then
+        for l in $denyLN; do sed -ri "${l}s/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*)$/\1\2 deny=5 /" $PTF ; done
+    elif [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s*.*deny=\S+\s*.*$' $PTF) ]] ;then
+        sed -ri "/pam_faillock.so/s/deny=\S+/deny=5/g" $PTF
+    fi
+
+    unlockLN=$(grep -En '^\s*auth\s+required\s+pam_faillock.so\s*.*' $PTF | grep -Pv "unlock_time=" | cut -d: -f1)
+    if [[ -n $unlockLN ]] ; then
+        for l in $unlockLN; do sed -ri "${l}s/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*)$/\1\2 unlock_time=900 /g" $PTF ; done
+    elif [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s*.*unlock_time=\S+\s*.*$' $PTF) ]] ;then
+        sed -ri '/pam_faillock.so/s/unlock_time=\S+/unlock_time=900/g' $PTF
+    fi
 done
 
-authselect apply-changes
+[[ $auCheck == "0" ]] && authselect apply-changes &> /dev/null
 # 启用faillock模块
-authselect enable-feature with-faillock
\ No newline at end of file
+[[ $auCheck == "0" ]] && authselect enable-feature with-faillock &> /dev/null
\ No newline at end of file
diff --git a/remediation-kits/access-and-control/1.29-ensure-password-reuse-is-limited.sh b/remediation-kits/access-and-control/1.29-ensure-password-reuse-is-limited.sh
index 774eb432935712bb377713596d03f0a54794f5da..b7a5482e1320cab7537cf6d124e28204e65c5741 100644
--- a/remediation-kits/access-and-control/1.29-ensure-password-reuse-is-limited.sh
+++ b/remediation-kits/access-and-control/1.29-ensure-password-reuse-is-limited.sh
@@ -1,27 +1,34 @@
 #!/usr/bin/env bash
 
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
-currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-createP="user-profile"
+authselect check &> /dev/null && auCheck=0
 
-# 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
-if [[ -z $customProfile ]]; then
-    authselect create-profile $createP -b $currProfile
-    authselect select custom/$createP
-    authselect apply-changes
-fi
+if [[ $auCheck == "0" ]] ; then
+    customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
+    currProfile=$(authselect current | awk 'NR == 1 {print $3}')
+    createP="user-profile"
 
-if authselect current | awk 'NR == 1 {print $3}' | grep -q custom/; then
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/system-auth)进行修改
-    PTF=/etc/authselect/"$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)"/system-auth
-else
-    PTF=/etc/pam.d/system-auth
+    # 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
+    if [[ -z $customProfile ]]; then
+        authselect create-profile $createP -b $currProfile
+        authselect select custom/$createP
+        authselect apply-changes
+    fi
 fi
 
-if grep -Eq '^\s*password\s+(sufficient\s+pam_unix|requi(red|site)\s+pam_pwhistory).so\s+([^#]+\s+)*remember=\S+\s*.*$' $PTF; then
-    sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)(remember=\S+\s*)(.*)$/\1\4 remember=5 \6/' $PTF
-else
-    sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)$/\1\4 remember=5/' $PTF
-fi
+[[ $auCheck == "0" ]] && customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/) || customProfile=""
+# 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
+for FN in system-auth; do
+    [[ -n $customProfile ]] && PTF=/etc/authselect/$customProfile/$FN || PTF=/etc/pam.d/$FN
+    [[ -z $(grep -E '^\s*password\s+requisite\s+pam_pwhistory.so.*$' $PTF) ]] && ln=$(grep -En -m1 '^\s*password\s+' $PTF | cut -d: -f1) && sed -i "${ln}i\password    requisite    pam_pwhistory.so " $PTF
+    [[ -z $(grep -E '^\s*password\s+sufficient\s+pam_unix.so.*$' $PTF) ]] && ln=$(grep -En -m1 '^\s*password\s+' $PTF | cut -d: -f1) && sed -i "${ln}i\password    sufficient    pam_unix.so " $PTF
+
+    rememberLN=$(grep -En '^\s*password\s+.*(pam_pwhistory.so|pam_unix.so)\s*.*' $PTF | grep -Pv "remember=" | cut -d: -f1)
+    if [[ -n $rememberLN ]] ; then
+        for l in $rememberLN; do sed -ri "${l}s/(^\s*password\s+)(\s+requisite\s+|\s+sufficient\s+)(\s+pam_pwhistory\.so\b\s*|\s+pam_unix\.so\b\s*)(.*)$/\1\2\3\4 remember=5 /" $PTF ; done
+    elif [[ -n $(grep -E '^\s*password\s+(requisite|sufficient)\s+(pam_pwhistory.so|pam_unix.so)\s*.*remember=\S+\s*.*$' $PTF) ]] ;then
+        sed -ri "/^\s*password\s+(requisite|sufficient)\s+(pam_pwhistory.so|pam_unix.so)/s/remember=\S+/remember=5/g" $PTF
+    fi
+
+done
 
-authselect apply-changes
+[[ $auCheck == "0" ]] && authselect apply-changes &> /dev/null
diff --git a/remediation-kits/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.sh b/remediation-kits/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.sh
index 9394c8bfe8cac91a7f668fccdf5f45fd3ebf4289..fa0e62956af13017620482a4793fdb520ee019e7 100644
--- a/remediation-kits/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.sh
+++ b/remediation-kits/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.sh
@@ -1,21 +1,34 @@
 #!/usr/bin/env bash
 
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
-currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-createP="user-profile"
-
-# 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
-if [[ -z $customProfile ]]; then
-    authselect create-profile $createP -b $currProfile
-    authselect select custom/$createP
-    authselect apply-changes
+authselect check &> /dev/null && auCheck=0
+
+if [[ $auCheck == "0" ]] ; then
+    customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
+    currProfile=$(authselect current | awk 'NR == 1 {print $3}')
+    createP="user-profile"
+
+    # 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
+    if [[ -z $customProfile ]]; then
+        authselect create-profile $createP -b $currProfile
+        authselect select custom/$createP
+        authselect apply-changes
+    fi
 fi
 
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
+
+[[ $auCheck == "0" ]] && customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/) || customProfile=""
+# 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
 for FN in system-auth password-auth; do
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
     [[ -n $customProfile ]] && PTF=/etc/authselect/$customProfile/$FN || PTF=/etc/pam.d/$FN
-    [[ -z $(grep -E '^\s*password\s+sufficient\s+pam_unix.so\s+.*sha512\s*.*$' $PTF) ]] && sed -ri '/^\s*password\s+sufficient\s+pam_unix.so\s+/ { /^\s*password\s+sufficient\s+pam_unix.so(\s+\S+)*(\s+sha512)(\s+.*)?$/! s/^(\s*password\s+sufficient\s+pam_unix.so\s+)(.*)$/\1sha512 \2/ }' $PTF
+    [[ -z $(grep -E '^\s*password\s+sufficient\s+pam_unix.so.*$' $PTF) ]] && ln=$(grep -En -m1 '^\s*password\s+' $PTF | cut -d: -f1) && sed -i "${ln}i\password    sufficient    pam_unix.so " $PTF
+
+    hashLN=$(grep -En '^\s*password\s+.*pam_unix.so\s*.*' $PTF | grep -Pv "(sha[0-9]+|md5)" | cut -d: -f1)
+    if [[ -n $hashLN ]] ; then
+        for l in $hashLN; do sed -ri "${l}s/(^\s*password\s+)(\s+sufficient\s+)(\s+pam_unix\.so\b\s*)(.*)$/\1\2\3 sha512 \4/" $PTF  ; done
+    elif [[ -n $(grep -E '^\s*password\s+sufficient\s+pam_unix.so\s*.*(sha[0-9]+|md5)\s*.*$' $PTF | grep -Pv "sha512") ]] ;then
+        sed -ri "/^\s*password\s+sufficient\s+pam_unix.so/s/(sha[0-9]+|md5)/sha512/g" $PTF
+    fi
+
 done
 
-authselect apply-changes
\ No newline at end of file
+[[ $auCheck == "0" ]] && authselect apply-changes &> /dev/null
diff --git a/remediation-kits/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh b/remediation-kits/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh
index 774eb432935712bb377713596d03f0a54794f5da..b7a5482e1320cab7537cf6d124e28204e65c5741 100644
--- a/remediation-kits/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh
+++ b/remediation-kits/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh
@@ -1,27 +1,34 @@
 #!/usr/bin/env bash
 
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
-currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-createP="user-profile"
+authselect check &> /dev/null && auCheck=0
 
-# 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
-if [[ -z $customProfile ]]; then
-    authselect create-profile $createP -b $currProfile
-    authselect select custom/$createP
-    authselect apply-changes
-fi
+if [[ $auCheck == "0" ]] ; then
+    customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
+    currProfile=$(authselect current | awk 'NR == 1 {print $3}')
+    createP="user-profile"
 
-if authselect current | awk 'NR == 1 {print $3}' | grep -q custom/; then
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/system-auth)进行修改
-    PTF=/etc/authselect/"$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)"/system-auth
-else
-    PTF=/etc/pam.d/system-auth
+    # 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
+    if [[ -z $customProfile ]]; then
+        authselect create-profile $createP -b $currProfile
+        authselect select custom/$createP
+        authselect apply-changes
+    fi
 fi
 
-if grep -Eq '^\s*password\s+(sufficient\s+pam_unix|requi(red|site)\s+pam_pwhistory).so\s+([^#]+\s+)*remember=\S+\s*.*$' $PTF; then
-    sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)(remember=\S+\s*)(.*)$/\1\4 remember=5 \6/' $PTF
-else
-    sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)$/\1\4 remember=5/' $PTF
-fi
+[[ $auCheck == "0" ]] && customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/) || customProfile=""
+# 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
+for FN in system-auth; do
+    [[ -n $customProfile ]] && PTF=/etc/authselect/$customProfile/$FN || PTF=/etc/pam.d/$FN
+    [[ -z $(grep -E '^\s*password\s+requisite\s+pam_pwhistory.so.*$' $PTF) ]] && ln=$(grep -En -m1 '^\s*password\s+' $PTF | cut -d: -f1) && sed -i "${ln}i\password    requisite    pam_pwhistory.so " $PTF
+    [[ -z $(grep -E '^\s*password\s+sufficient\s+pam_unix.so.*$' $PTF) ]] && ln=$(grep -En -m1 '^\s*password\s+' $PTF | cut -d: -f1) && sed -i "${ln}i\password    sufficient    pam_unix.so " $PTF
+
+    rememberLN=$(grep -En '^\s*password\s+.*(pam_pwhistory.so|pam_unix.so)\s*.*' $PTF | grep -Pv "remember=" | cut -d: -f1)
+    if [[ -n $rememberLN ]] ; then
+        for l in $rememberLN; do sed -ri "${l}s/(^\s*password\s+)(\s+requisite\s+|\s+sufficient\s+)(\s+pam_pwhistory\.so\b\s*|\s+pam_unix\.so\b\s*)(.*)$/\1\2\3\4 remember=5 /" $PTF ; done
+    elif [[ -n $(grep -E '^\s*password\s+(requisite|sufficient)\s+(pam_pwhistory.so|pam_unix.so)\s*.*remember=\S+\s*.*$' $PTF) ]] ;then
+        sed -ri "/^\s*password\s+(requisite|sufficient)\s+(pam_pwhistory.so|pam_unix.so)/s/remember=\S+/remember=5/g" $PTF
+    fi
+
+done
 
-authselect apply-changes
+[[ $auCheck == "0" ]] && authselect apply-changes &> /dev/null
diff --git a/remediation-kits/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.sh b/remediation-kits/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.sh
index 3f17a858c7f1d464c35cd2bedf8ad9893e4e347d..8a76518d7eb84a4650b927370ba99b146e3848a5 100644
--- a/remediation-kits/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.sh
+++ b/remediation-kits/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.sh
@@ -1,24 +1,41 @@
 #!/usr/bin/env bash
 
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
-currProfile=$(authselect current | awk 'NR == 1 {print $3}')
-createP="user-profile"
+authselect check &> /dev/null && auCheck=0
 
-# 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
-if [[ -z $customProfile ]]; then
-    authselect create-profile $createP -b $currProfile
-    authselect select custom/$createP
-    authselect apply-changes
+if [[ $auCheck == "0" ]] ; then
+    customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
+    currProfile=$(authselect current | awk 'NR == 1 {print $3}')
+    createP="user-profile"
+
+    # 判断是否已有用户自定义规则集，如有则跳过创建步骤，改为直接追加已有的规则集
+    if [[ -z $customProfile ]]; then
+        authselect create-profile $createP -b $currProfile
+        authselect select custom/$createP
+        authselect apply-changes
+    fi
 fi
 
-customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/)
+[[ $auCheck == "0" ]] && customProfile=$(authselect current | awk 'NR == 1 {print $3}' | grep custom/) || customProfile=""
+# 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
 for FN in system-auth password-auth; do
-    # 判断是否有自定义规则集，如没有或创建失败，则直接对最终文件(/etc/pam.d/password-auth,/etc/pam.d/system-auth)进行修改
     [[ -n $customProfile ]] && PTF=/etc/authselect/$customProfile/$FN || PTF=/etc/pam.d/$FN
-    [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s+.*deny=\S+\s*.*$' $PTF) ]] && sed -ri '/pam_faillock.so/s/deny=\S+/deny=5/g' $PTF || sed -ri 's/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*[^{}])(\{.*\}|)$/\1\2 deny=5 \3/' $PTF
-    [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s+.*unlock_time=\S+\s*.*$' $PTF) ]] && sed -ri '/pam_faillock.so/s/unlock_time=\S+/unlock_time=900/g' $PTF || sed -ri 's/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*[^{}])(\{.*\}|)$/\1\2 unlock_time=900 \3/' $PTF
+    [[ -z $(grep -E '^\s*auth\s+required\s+pam_faillock.so.*$' $PTF) ]] && ln=$(grep -En -m1 '^\s*auth\s+' $PTF | cut -d: -f1) && sed -i "${ln}i\auth    required    pam_faillock.so    preauth silent \nauth    required    pam_faillock.so    authfail " $PTF
+
+    denyLN=$(grep -En '^\s*auth\s+required\s+pam_faillock.so\s*.*' $PTF | grep -Pv "deny=" | cut -d: -f1)
+    if [[ -n $denyLN ]] ; then
+        for l in $denyLN; do sed -ri "${l}s/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*)$/\1\2 deny=5 /" $PTF ; done
+    elif [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s*.*deny=\S+\s*.*$' $PTF) ]] ;then
+        sed -ri "/pam_faillock.so/s/deny=\S+/deny=5/g" $PTF
+    fi
+
+    unlockLN=$(grep -En '^\s*auth\s+required\s+pam_faillock.so\s*.*' $PTF | grep -Pv "unlock_time=" | cut -d: -f1)
+    if [[ -n $unlockLN ]] ; then
+        for l in $unlockLN; do sed -ri "${l}s/^\s*(auth\s+required\s+pam_faillock\.so\s+)(.*)$/\1\2 unlock_time=900 /g" $PTF ; done
+    elif [[ -n $(grep -E '^\s*auth\s+required\s+pam_faillock.so\s*.*unlock_time=\S+\s*.*$' $PTF) ]] ;then
+        sed -ri '/pam_faillock.so/s/unlock_time=\S+/unlock_time=900/g' $PTF
+    fi
 done
 
-authselect apply-changes
+[[ $auCheck == "0" ]] && authselect apply-changes &> /dev/null
 # 启用faillock模块
-authselect enable-feature with-faillock
\ No newline at end of file
+[[ $auCheck == "0" ]] && authselect enable-feature with-faillock &> /dev/null
\ No newline at end of file
diff --git a/scanners/access-and-control/1.27-ensure-password-creation-requirements-are-configured.sh b/scanners/access-and-control/1.27-ensure-password-creation-requirements-are-configured.sh
index c14f970d1b645448871e0b61275bbb660ba6b17d..f7ad91bb127b37eb3931fd5c1f330da2bec946c1 100644
--- a/scanners/access-and-control/1.27-ensure-password-creation-requirements-are-configured.sh
+++ b/scanners/access-and-control/1.27-ensure-password-creation-requirements-are-configured.sh
@@ -15,14 +15,16 @@ PAM_SYSTEM_AUTH="/etc/pam.d/system-auth"
 # 检查/etc/security/pwquality.conf文件中的条件
 check_pwquality_conf() {
     # 检查minlen=14
-    check_file_contains "$PWQUALITY_CONF" '^minlen(?: |)=(?: |)14\b' || return 1
+    # check_file_contains "$PWQUALITY_CONF" '^minlen(?:\s*|)=(?:\s*|)14\b' || return 1
+    minlenValue=$(grep -P "^\s*minlen\s*=.*" /etc/security/pwquality.conf | cut -d= -f2 | tr -d '[:space:]')
+    [[ -n $minlenValue ]] && [[ $minlenValue =~ ^[0-9]+$ ]] && [[ $minlenValue -ge 14 ]] || return 1
 
     # 检查minclass=4 或者所有credit设置为-1
-    (check_file_contains "$PWQUALITY_CONF" '^minclass(?: |)=(?: |)4\b') || \
-    (check_file_contains "$PWQUALITY_CONF" '^dcredit(?: |)=(?: |)-1\b' && \
-     check_file_contains "$PWQUALITY_CONF" '^ucredit(?: |)=(?: |)-1\b' && \
-     check_file_contains "$PWQUALITY_CONF" '^ocredit(?: |)=(?: |)-1\b' && \
-     check_file_contains "$PWQUALITY_CONF" '^lcredit(?: |)=(?: |)-1\b') || return 1
+    (check_file_contains "$PWQUALITY_CONF" '^minclass(?:\s*|)=(?:\s*|)4\b') || \
+    (check_file_contains "$PWQUALITY_CONF" '^dcredit(?:\s*|)=(?:\s*|)-1\b' && \
+     check_file_contains "$PWQUALITY_CONF" '^ucredit(?:\s*|)=(?:\s*|)-1\b' && \
+     check_file_contains "$PWQUALITY_CONF" '^ocredit(?:\s*|)=(?:\s*|)-1\b' && \
+     check_file_contains "$PWQUALITY_CONF" '^lcredit(?:\s*|)=(?:\s*|)-1\b') || return 1
 
     return 0
 }
@@ -30,7 +32,7 @@ check_pwquality_conf() {
 # 检查/etc/pam.d/password-auth和/etc/pam.d/system-auth文件中的条件
 check_pam_files() {
     local files=("$PAM_PASSWORD_AUTH" "$PAM_SYSTEM_AUTH")
-    local patterns=("\benforce-for-root\b" "\bretry=\d+\b")
+    local patterns=("\benforce-for-root\b" "\bretry=[1-3]+\s*")
 
     for file in "${files[@]}"; do
         for pattern in "${patterns[@]}"; do
diff --git a/scanners/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.sh b/scanners/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.sh
index 8852beb93d83b3f7d33b272ea56dfcd9b96de9ac..977e56ebf96aef74bf1eda970247c236a37b5727 100644
--- a/scanners/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.sh
+++ b/scanners/access-and-control/1.28-ensure-lockout-for-failed-password-attempts-is-configured.sh
@@ -1,5 +1,5 @@
-grep -Pi "^\s*auth\s+required\s+pam_faillock.so\b\s+.*" /etc/pam.d/password-auth | grep -Pqiv ".*\bdeny=[0-9]+\b\s+.*unlock_time=[0-9]+\b.*" && echo 'fail' && exit 1
-grep -Pi "^\s*auth\s+required\s+pam_faillock.so\b\s+.*" /etc/pam.d/system-auth | grep -Pqiv ".*\bdeny=[0-9]+\b\s+.*unlock_time=[0-9]+\b.*" && echo 'fail' && exit 1
+grep -Pi "^\s*auth\s+required\s+pam_faillock.so\b\s+.*" /etc/pam.d/password-auth | grep -Pqiv "(?=.*\bdeny=[0-9]+\b)(?=.*unlock_time=[0-9]+)" && echo 'fail' && exit 1
+grep -Pi "^\s*auth\s+required\s+pam_faillock.so\b\s+.*" /etc/pam.d/system-auth | grep -Pqiv "(?=.*\bdeny=[0-9]+\b)(?=.*unlock_time=[0-9]+)" && echo 'fail' && exit 1
 
 denyValuePassword=$(grep -Poi "^\s*auth\s+required\s+pam_faillock.so\s+.*\bdeny=[0-9]+\b" /etc/pam.d/password-auth | grep -Pio "\bdeny=[0-9]+\b" | awk -F= '{print $2}')
 denyValueSystem=$(grep -Poi "^\s*auth\s+required\s+pam_faillock.so\s+.*\bdeny=[0-9]+\b" /etc/pam.d/system-auth | grep -Pio "\bdeny=[0-9]+\b" | awk -F= '{print $2}')
@@ -7,8 +7,7 @@ unlockValuePassword=$(grep -Poi "^\s*auth\s+required\s+pam_faillock.so\s+.*\bunl
 unlockValueSystem=$(grep -Poi "^\s*auth\s+required\s+pam_faillock.so\s+.*\bunlock_time=[0-9]+\b" /etc/pam.d/system-auth | grep -Pio "\bunlock_time=[0-9]+\b" | awk -F= '{print $2}')
 
 if [[ -n $denyValuePassword && -n $denyValueSystem ]] ; then
-    for i in $denyValuePassword $denyValueSystem
-    do
+    for i in $denyValuePassword $denyValueSystem; do
         if [[ $i -gt 5 ]]; then
             echo 'fail'
             exit 1
@@ -21,8 +20,7 @@ fi
 
 
 if [[ -n $unlockValuePassword && -n $unlockValueSystem ]] ; then
-    for i in $unlockValuePassword $unlockValueSystem
-    do
+    for i in $unlockValuePassword $unlockValueSystem; do
         if [[ $i -lt 900 ]]; then
             echo 'fail'
             exit 1
diff --git a/scanners/access-and-control/1.29-ensure-password-reuse-is-limited.sh b/scanners/access-and-control/1.29-ensure-password-reuse-is-limited.sh
index 3f057f4dd3276968a07834f31fd1a37a6d5d02d8..3d2e3ef4116c296e01e896f0cb7ec487af02f765 100644
--- a/scanners/access-and-control/1.29-ensure-password-reuse-is-limited.sh
+++ b/scanners/access-and-control/1.29-ensure-password-reuse-is-limited.sh
@@ -1,9 +1,18 @@
-result=false
+grep -Pi "^\h+password\h+sufficient\h+pam_unix.so\h+" /etc/pam.d/system-auth | grep -Pqv "\bremember\s*=\s*[0-9]+" && echo 'fail' && exit 1
+grep -Pi "^\h+password\h+requisite\h+pam_pwhistory.so\h+" /etc/pam.d/system-auth | grep -Pqv "\bremember\s*=\s*[0-9]+" && echo 'fail' && exit 1
 
-grep -Piq "^\h*password\h+(requisite|sufficient)\h+(pam_pwhistory\.so|pam_unix\.so)\h+([^#\n\r]+\h+)?remember=([5-9]|[1-9][0-9]+)\h*(\h+.*)?$" /etc/pam.d/system-auth && result=true
+rememberValue=$(grep -Poi "^\h*password\s+(sufficient|requisite)\s+(pam_unix.so|pam_pwhistory.so)\s+.*\bremember\s*=\s*[0-9]+" /etc/pam.d/system-auth | grep -Pio "\bremember\s*=\s*[0-9]+\b" | awk -F= '{print $2}')
 
-if [[ $result == true ]]; then
-    echo "pass"
+if [[ -n $rememberValue ]] ; then
+    for i in $rememberValue ; do
+        if [[ $i -lt 5 ]]; then
+            echo 'fail'
+            exit 1
+        fi
+    done
 else
-    echo "fail"
-fi
\ No newline at end of file
+    echo 'fail'
+    exit 1
+fi
+
+echo 'pass'
diff --git a/scanners/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.sh b/scanners/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.sh
index af6481d9c8d519a4f12d2066ab1000eb23037afb..9dc74f6a381c56b16007710cb16172f235ef8900 100644
--- a/scanners/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.sh
+++ b/scanners/access-and-control/1.30-ensure-password-hashing-algorithm-is-sha-512.sh
@@ -1,6 +1,6 @@
 result=false
 
-grep -Eiq "^\s*\bpassword\s+\bsufficient\s+\bpam_unix.so\s+.*\bsha512\s*.*$" /etc/pam.d/password-auth && grep -Eiq "^\s*\bpassword\s+\bsufficient\s+\bpam_unix.so\s+.*\bsha512\s*.*$" /etc/pam.d/system-auth && result=true
+grep -Eiq "^\s*password\s+\bsufficient\s+\bpam_unix.so\s+.*\bsha512\s*.*$" /etc/pam.d/password-auth && grep -Eiq "^\s*password\s+\bsufficient\s+\bpam_unix.so\s+.*\bsha512\s*.*$" /etc/pam.d/system-auth && result=true
 
 if [[ $result == "true" ]]; then
     echo "pass"
diff --git a/scanners/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh b/scanners/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh
index 0d3975fb565269bad69ed5944f3a41e37f680dd4..8ab4fb55e036e0f3786f108af47cf92a39280393 100644
--- a/scanners/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh
+++ b/scanners/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh
@@ -1,9 +1,18 @@
-val_remember=99999
-val_remember=`grep -Pi "^\h*password\h+(requisite|sufficient)\h+(pam_pwhistory\.so|pam_unix\.so)\h+([^#\n\r]+\h+)?remember=([5-9]|[1-9][0-9]+)\h*(\h+.*)?$" /etc/pam.d/system-auth | cut -d '=' -f2`
-[ ! -z $val_remember ] && result_remember=`echo "$val_remember >=5 && $val_remember <= 25" | bc`
+grep -Pi "^\s*password\h+sufficient\h+pam_unix.so\h+" /etc/pam.d/system-auth | grep -Pqv "\bremember\s*=\s*[0-9]+" && echo 'fail' && exit 1
+grep -Pi "^\s*password\h+requisite\h+pam_pwhistory.so\h+" /etc/pam.d/system-auth | grep -Pqv "\bremember\s*=\s*[0-9]+" && echo 'fail' && exit 1
 
-if [[ $result_remember -eq 1 ]]; then
-    echo 'pass'
+rememberValue=$(grep -Poi "^\s*password\s+(sufficient|requisite)\s+(pam_unix.so|pam_pwhistory.so)\s+.*\bremember\s*=\s*[0-9]+" /etc/pam.d/system-auth | grep -Pio "\bremember\s*=\s*[0-9]+\b" | awk -F= '{print $2}')
+
+if [[ -n $rememberValue ]] ; then
+    for i in $rememberValue; do
+        if [[ $i -lt 5 ]] || [[ $i -gt 25 ]] ; then
+            echo 'fail'
+            exit 1
+        fi
+    done
 else
     echo 'fail'
-fi
\ No newline at end of file
+    exit 1
+fi
+
+echo 'pass'
diff --git a/scanners/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.sh b/scanners/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.sh
index 2f69a055c6118a27a4b249286c8508179c50f947..6f390397da61787bdbf03b22646ff1f96d099e4f 100644
--- a/scanners/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.sh
+++ b/scanners/access-and-control/1.45-ensure-lockout-for-failed-password-attempts-is-configured.sh
@@ -1,22 +1,34 @@
-result_File_Password=`grep -E '^\s*auth\s+required\s+pam_faillock.so\s+(preauth|authfail)\s+' /etc/pam.d/password-auth | grep -Eio "deny=[0-9]+\s+unlock_time=[0-9]+"`
-result_File_System=`grep -E '^\s*auth\s+required\s+pam_faillock.so\s+(preauth|authfail)\s+' /etc/pam.d/system-auth | grep -Eio "deny=[0-9]+\s+unlock_time=[0-9]+"`
-result_Deny=true
-result_Unlock_Time=true
+grep -Pi "^\s*auth\s+required\s+pam_faillock.so\b\s+.*" /etc/pam.d/password-auth | grep -Pqiv "(?=.*\bdeny=[0-9]+\b)(?=.*unlock_time=[0-9]+)" && echo 'fail' && exit 1
+grep -Pi "^\s*auth\s+required\s+pam_faillock.so\b\s+.*" /etc/pam.d/system-auth | grep -Pqiv "(?=.*\bdeny=[0-9]+\b)(?=.*unlock_time=[0-9]+)" && echo 'fail' && exit 1
 
-for i in `grep -E '^\s*auth\s+required\s+pam_faillock.so\s+(preauth|authfail)\s+' /etc/pam.d/password-auth /etc/pam.d/system-auth | grep -Eio "deny=[0-9]+" | cut -d"=" -f 2`; do
-    if [[ $i -lt 3 ]] || [[ $i -gt 8 ]] ; then
-        result_Deny=false
-    fi
-done
+denyValuePassword=$(grep -Poi "^\s*auth\s+required\s+pam_faillock.so\s+.*\bdeny=[0-9]+\b" /etc/pam.d/password-auth | grep -Pio "\bdeny=[0-9]+\b" | awk -F= '{print $2}')
+denyValueSystem=$(grep -Poi "^\s*auth\s+required\s+pam_faillock.so\s+.*\bdeny=[0-9]+\b" /etc/pam.d/system-auth | grep -Pio "\bdeny=[0-9]+\b" | awk -F= '{print $2}')
+unlockValuePassword=$(grep -Poi "^\s*auth\s+required\s+pam_faillock.so\s+.*\bunlock_time=[0-9]+\b" /etc/pam.d/password-auth | grep -Pio "\bunlock_time=[0-9]+\b" | awk -F= '{print $2}')
+unlockValueSystem=$(grep -Poi "^\s*auth\s+required\s+pam_faillock.so\s+.*\bunlock_time=[0-9]+\b" /etc/pam.d/system-auth | grep -Pio "\bunlock_time=[0-9]+\b" | awk -F= '{print $2}')
 
-for i in `grep -E '^\s*auth\s+required\s+pam_faillock.so\s+(preauth|authfail)\s+' /etc/pam.d/password-auth /etc/pam.d/system-auth | grep -Eio "unlock_time=[0-9]+" | cut -d"=" -f 2`; do
-    if [[ $i -lt 600 ]] || [[ $i -gt 1800 ]] ; then
-        result_Unlock_Time=false
-    fi
-done
+if [[ -n $denyValuePassword && -n $denyValueSystem ]] ; then
+    for i in $denyValuePassword $denyValueSystem; do
+        if [[ $i -lt 3 ]] || [[ $i -gt 8 ]]; then
+            echo 'fail'
+            exit 1
+        fi
+    done
+else
+    echo 'fail'
+    exit 1
+fi
 
-if [[ -n $result_File_Password && -n $result_File_System && $result_Deny == "true" && $result_Unlock_Time == "true" ]]; then
-    echo 'pass'
+
+if [[ -n $unlockValuePassword && -n $unlockValueSystem ]] ; then
+    for i in $unlockValuePassword $unlockValueSystem; do
+        if [[ $i -lt 600 ]] || [[ $i -gt 1800 ]]; then
+            echo 'fail'
+            exit 1
+        fi
+    done
 else
     echo 'fail'
-fi
\ No newline at end of file
+    exit 1
+fi
+
+echo 'pass'
diff --git a/scanners/system-configurations/4.10-ensure-bootloader-password-is-set.sh b/scanners/system-configurations/4.10-ensure-bootloader-password-is-set.sh
index e46ce76dbf416dc9a9d3ff4dc39b97393edebba7..416b38700b1f2fbf7713f1e12b503bc012c718b2 100644
--- a/scanners/system-configurations/4.10-ensure-bootloader-password-is-set.sh
+++ b/scanners/system-configurations/4.10-ensure-bootloader-password-is-set.sh
@@ -1,7 +1,7 @@
 result=false
 
 if [[ -e /boot/grub2/user.cfg  ]]; then
-    grep -Pq '^\h*GRUB2_PASSWORD\h*=\h*.+$' /boot/grub2/user.cfg && result=true
+    grep -Pqs '^\h*GRUB2_PASSWORD\h*=\h*.+$' /boot/grub2/*.cfg && result=true
     if [[ "$result" == "true" ]] ; then
         echo "pass"
     else