Example of enabling password history in PAM using Puppet/Augeas

passwd_history.pp

class pam::passwd_history(
  $num = 4
) {
  case $::osfamily {
    /(?i-mx:redhat)/: {
      # enable password history
      # if not present:
      augeas { 'passwd-hist':
        context => '/files/etc/pam.d/system-auth',
        changes => ["set *[module =~ regexp('.*pam_unix.so')][type = 'password']/argument[last()+1] remember=${num}"],
        onlyif  => "match *[module =~ regexp('.*pam_unix.so')][type = 'password'][argument = 'remember=${num}'] size == 0"
      }
    }
    default: {
    }
  }
}