From jlieskov at redhat.com Thu Aug 20 11:37:17 2015 Content-Type: multipart/mixed; boundary="===============0636750718379595873==" MIME-Version: 1.0 From: Jan Lieskovsky To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [RHEL/6] Fix implementation of accounts_password_pam_cracklib_minclass OVAL check. Provide corresponding XCCDF definition & start using the rule. Date: Fri, 27 Jun 2014 11:40:28 -0400 Message-ID: <767549518.46450595.1403883628105.JavaMail.zimbra@redhat.com> In-Reply-To: 53AC656D.7070105@redhat.com --===============0636750718379595873== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- > From: "Shawn Wells" > To: scap-security-guide(a)lists.fedorahosted.org > Sent: Thursday, June 26, 2014 8:24:45 PM > Subject: Re: [PATCH] [RHEL/6] Fix implementation of accounts_password_pam= _cracklib_minclass OVAL check. Provide > corresponding XCCDF definition & start using the rule. > = > = > On 6/26/14, 12:14 PM, Jan Lieskovsky wrote: > = > = > = > The following patch: > [1] > https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=3D= a38ece26a85f210b7edc6db2d91c438ef78f5add > added support for accounts_password_pam_cracklib_minclass OVAL check & > corresponding remediation script. > = > But it got never used due to missing XCCDF definition. Therefore: > 1) fix the accounts_password_pam_cracklib_minclass actual OVAL check > implementation so it > would be more aligned with existing accounts_password_* OVAL checks, > 2) provide corresponding XCCDF definition for it & start using it. > = > Testing status: > --------------- > The change has been tested on RHEL-6 & works as expected (=3D> added the > test_attestation timestamp into > OVAL definition). > = > Please review. > = > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > = > P.S.: Will have a look at the corresponding remediation script yet to see= if > any updates are needed. > = > Thanks for doing this! The STIG profile explicitly calls out character > classes so this rule has been neglected for some time. Very small changes > outlined below: > = > = > = > = > = > 0001-RHEL-6-Fix-implementation-of-accounts_password_pam_c.patch > From 06d6c866797d9021c375e56ad83ea8cbb0db0956 Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky Date: Thu, 26 Jun 2014 18:03= :55 > +0200 > Subject: [PATCH] [RHEL/6] Fix implementation of > accounts_password_pam_cracklib_minclass OVAL check. Provide corresponding > XCCDF definition & start using the rule. > = > Signed-off-by: Jan Lieskovsky --- > .../accounts_password_pam_cracklib_minclass.xml | 45 > ++++++++++----------- > RHEL/6/input/system/accounts/pam.xml | 46 > ++++++++++++++++++++++ > 2 files changed, 69 insertions(+), 22 deletions(-) > = > diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_minclass.= xml > b/RHEL/6/input/checks/accounts_password_pam_cracklib_minclass.xml > index 539164b..100a2ae 100644 > --- a/RHEL/6/input/checks/accounts_password_pam_cracklib_minclass.xml > +++ b/RHEL/6/input/checks/accounts_password_pam_cracklib_minclass.xml > @@ -1,43 +1,44 @@ > > - id=3D"accounts_password_pam_cracklib_minclass" version=3D"1"> > + id=3D"accounts_password_pam_cracklib_minclass" > + version=3D"2"> > > Set Password minclass Requirements > > Red Hat Enterprise Linux 6 > > - The password minclass should meet minimum > - requirements using pam_cracklib > + The password minclass should meet the minimum > requirements > + using pam_cracklib > + > > > - test_ref=3D"test_password_pam_cracklib_minclass" /> > + test_ref=3D"test_password_pam_cracklib_minclass" /> > > > = > - comment=3D"check the configuration of > /etc/pam.d/system-auth" > - id=3D"test_password_pam_cracklib_minclass" > version=3D"1"> > - > + comment=3D"check the configuration of /etc/pam.d/system-auth" > + id=3D"test_password_pam_cracklib_minclass" version=3D"1"> > + > > > = > + + datatype=3D"int" id=3D"var_password_pam_cracklib_minclass" version=3D"= 1" /> > + > + + version=3D"1"> > + /etc/pam.d/system-auth > + match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=3D\= s]+[\s]minclass=3D(\d+)(?:[\s]|$) > + + operation=3D"greater than or equal">1 > + > + > - version=3D"1"> > + version=3D"1"> > 1 > - - operation=3D"less than or equal" > - var_ref=3D"var_password_pam_cracklib_minclass" /> > + + var_ref=3D"var_password_pam_cracklib_minclass" /> > > = > - - datatype=3D"int" id=3D"var_password_pam_cracklib_mi= nclass" > - version=3D"1" /> > - > - - version=3D"1"> > - /etc/pam.d > - system-auth > - match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=3D\= s]+[\s]minclass=3D(-?\d+)(?:[\s]|$) > - equal">1 > - > > diff --git a/RHEL/6/input/system/accounts/pam.xml > b/RHEL/6/input/system/accounts/pam.xml > index feddbb6..e13a19c 100644 > --- a/RHEL/6/input/system/accounts/pam.xml > +++ b/RHEL/6/input/system/accounts/pam.xml > @@ -188,6 +188,17 @@ passwords > 4 > 5 > > + > + operator=3D"equals" interactive=3D"0"> > +minclass > +Minimum number of categories of characters that must exist = in a > password > +3 > +1 > +2 > +3 > +4 > + > + > operator=3D"equals" interactive=3D"0"> > fail_deny > @@ -392,6 +403,41 @@ Note that passwords which are changed on compromised > systems will still be compr > > > > + > + > +Set Password Strength Minimum Different Categories > +The pam_cracklib module's minclass parameter contr= ols > requirements for > +usage of different character classes, or types, of character that must e= xist > in a password > +before it is considered valid. For example, setting this value to three = (3) > requires that > +any password must have characters from at least three different categori= es > in order to be > +approved. The default value is zero (0), meaning there are no required > classes. There are > +four categories available: > +
> +* Upper-case characters
> +* Lower-case characters
> +* Digits
> +* Special characters (for example, punctuation)
> +
> +Add minclass=3DNUM after pam_cracklib.so to require diff= ering > categories of > +characters when changing passwords, substituting NUM appropriately > (for example to > +require at least three character classes to be used in password, use > minclass=3D3). > +
> = > The description should be updated to reflect the value should be placed in > /etc/pam.d/system-auth Thank you. Updated & pushed via: https://git.fedorahosted.org/cgit/scap-se= curity-guide.git/commit/?id=3D929cbf31f6f82f27a66d1a2d26c306f3c99475dc > = > = > = > = > + > +To check how many categories of characters must be used in password duri= ng a > password change, > +run the following command: > +
$ grep pam_cracklib /etc/pam.d/system-auth
> +The minclass parameter will indicate how many character classes > must be used. If > +the requirement was password to contain characters from three different > categories, then this > +would appear as minclass=3D3. > = > Nitpick: > "requirement was password to..." --> "requirement was for the password to= ..." Fixed via: https://git.fedorahosted.org/cgit/scap-security-guide.git/commit= /?id=3D929cbf31f6f82f27a66d1a2d26c306f3c99475dc > = > = > = > = > +
> + > +Requiring a minimum number of character categories makes password guessi= ng > attacks > +more difficult by ensuring a larger search space. > + > + > = > It makes sense to assign a CCE for this (take one out of > shared/references/cce-rhel6-avail.txt and place here). Took CCE-27115-5 via: https://git.fedorahosted.org/cgit/scap-security-guide= .git/commit/?id=3D731d99b3f19d435193100846078633d51ad6ba76 and updated particular entry via: https://git.fedorahosted.org/cgit/scap-se= curity-guide.git/commit/?id=3D929cbf31f6f82f27a66d1a2d26c306f3c99475dc > = > = > = > = > = > + value=3D"var_password_pam_cracklib_minclass"/> > + > +
> > > = Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team --===============0636750718379595873==--