From 60def65686a7663806c3940f60c65cf32448a868 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Wed, 26 Mar 2014 17:07:40 +0100
Subject: [PATCH] [RHEL/6] Introduce accounts_password_pam_cracklib_minlen OVAL
 check (enforcing user's password minimum length requirements for existing
 user accounts according to CC). Also make a note in the
 accounts_password_minlen_login_defs description to make it clear the
 /etc/login.defs setting is honoured only for newly added user accounts (but
 still used by tools like useradd or system-config-users).

Also fix couple of typos (undefined selectors warning message) in
OpenStack's / RHEVM3's stig-rhevm3 profile that arose during patch testing.

Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
 OpenStack/input/profiles/stig-rhevm3.xml           |  6 +--
 .../accounts_password_pam_cracklib_minlen.xml      | 35 ++++++++++++++++
 RHEL/6/input/profiles/common.xml                   |  7 ++--
 .../6/input/profiles/fisma-medium-rhel6-server.xml |  4 +-
 RHEL/6/input/profiles/rht-ccp.xml                  |  2 +
 RHEL/6/input/profiles/usgcb-rhel6-server.xml       |  2 +
 RHEL/6/input/system/accounts/pam.xml               | 48 ++++++++++++++++++----
 .../accounts/restrictions/password_expiration.xml  | 27 ++++++------
 RHEVM3/input/profiles/stig-rhevm3.xml              |  6 +--
 9 files changed, 105 insertions(+), 32 deletions(-)
 create mode 100644 RHEL/6/input/checks/accounts_password_pam_cracklib_minlen.xml

diff --git a/OpenStack/input/profiles/stig-rhevm3.xml b/OpenStack/input/profiles/stig-rhevm3.xml
index d80e69a..3e0aa53 100644
--- a/OpenStack/input/profiles/stig-rhevm3.xml
+++ b/OpenStack/input/profiles/stig-rhevm3.xml
@@ -74,9 +74,9 @@
 <select idref="enable_randomize_va_space" selected="true"/>
 <select idref="enable_execshield" selected="true"/>
 
-<select idref="disable_sysctl_ipv4_default_send_redirects" selected="true"/>
-<select idref="disable_sysctl_ipv4_all_send_redirects" selected="true"/>
-<select idref="disable_sysctl_ipv4_ip_forward" selected="true"/>
+<select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
+<select idref="sysctl_ipv4_all_send_redirects" selected="true"/>
+<select idref="sysctl_ipv4_ip_forward" selected="true"/>
 <select idref="set_sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
 <select idref="set_sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/>
 <select idref="set_sysctl_net_ipv4_conf_all_secure_redirects" selected="true"/>
diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_minlen.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_minlen.xml
new file mode 100644
index 0000000..a27df4a
--- /dev/null
+++ b/RHEL/6/input/checks/accounts_password_pam_cracklib_minlen.xml
@@ -0,0 +1,35 @@
+<def-group>
+
+  <definition class="compliance" id="accounts_password_pam_cracklib_minlen" version="1">
+    <metadata>
+      <title>Set Password minlen Requirements</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The password minlen should meet minimum requirements using pam_cracklib</description>
+      <reference source="JL" ref_id="20140326" ref_url="test_attestation" />
+    </metadata>
+    <criteria>
+      <criterion comment="Conditions for pam_cracklib's minlen are satisfied" test_ref="test_password_pam_cracklib_minlen" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="test_password_pam_cracklib_minlen" version="1">
+    <ind:object object_ref="obj_password_pam_cracklib_minlen" />
+    <ind:state state_ref="state_password_pam_cracklib_minlen" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_password_pam_cracklib_minlen" version="1">
+    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minlen=(\d+)(?:[\s]|$)</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_password_pam_cracklib_minlen" version="1">
+    <ind:instance datatype="int">1</ind:instance>
+    <ind:subexpression datatype="int" operation="greater than or equal" var_ref="var_password_pam_cracklib_minlen" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="External variable for pam_cracklib minlen" datatype="int" id="var_password_pam_cracklib_minlen" version="1" />
+
+</def-group>
diff --git a/RHEL/6/input/profiles/common.xml b/RHEL/6/input/profiles/common.xml
index e96823f..c023308 100644
--- a/RHEL/6/input/profiles/common.xml
+++ b/RHEL/6/input/profiles/common.xml
@@ -51,6 +51,7 @@
 <select idref="accounts_minimum_age_login_defs" selected="true"/>
 <select idref="accounts_maximum_age_login_defs" selected="true"/>
 <select idref="accounts_password_warn_age_login_defs" selected="true"/>
+<select idref="accounts_password_pam_cracklib_minlen" selected="true"/>
 <select idref="accounts_password_pam_cracklib_retry" selected="true"/>
 <select idref="accounts_password_pam_cracklib_dcredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
@@ -229,17 +230,17 @@ these should likely be moved out of common.
 <refine-value idref="var_umask_for_daemons" selector="027"/>
 <!-- daemon umask -->
 <refine-value idref="var_accounts_password_minlen_login_defs" selector="14"/>
-<!-- password minimum length -->
+<!-- Future passwords minimum length -->
 <refine-value idref="var_accounts_maximum_age_login_defs" selector="90"/>
 <!-- maximum password age -->
 <refine-value idref="var_accounts_minimum_age_login_defs" selector="7"/>
 <!-- minimum password age -->
 <refine-value idref="var_accounts_password_warn_age_login_defs" selector="7"/>
 <!-- password warn age -->
-<refine-value idref="var_password_pam_cracklib_retry" selector="3"/>
-<!-- Number of retry attempts before erroring out -->
 <refine-value idref="var_password_pam_cracklib_minlen" selector="14"/>
 <!-- Minimum number of characters in password -->
+<refine-value idref="var_password_pam_cracklib_retry" selector="3"/>
+<!-- Number of retry attempts before erroring out -->
 <refine-value idref="var_password_pam_cracklib_dcredit" selector="1"/>
 <!-- Minimum number of digits in password -->
 <refine-value idref="var_password_pam_cracklib_ucredit" selector="2"/>
diff --git a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
index 07e9ba9..502e497 100644
--- a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
@@ -1,5 +1,5 @@
 <Profile id="fisma-medium-rhel6-server">
-<title>FISAMA Medium for Red Hat Enterprise Linux 6</title>
+<title>FISMA Medium for Red Hat Enterprise Linux 6</title>
 <description>FISMA Medium for Red Hat Enterprise Linux 6</description>
 
 <!-- ACCESS CONTROL (AC) -->
@@ -276,6 +276,8 @@
 <select idref="bootloader_password" selected="true" />
 
 <!--	IA-5 -->
+<refine-value idref="var_password_pam_cracklib_minlen" selector="12" />
+<select idref="accounts_password_pam_cracklib_minlen" selected="true" />
 <select idref="accounts_password_pam_cracklib_retry" selected="true" />
 <select idref="password_require_consecrepeat" selected="true" />
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true" />
diff --git a/RHEL/6/input/profiles/rht-ccp.xml b/RHEL/6/input/profiles/rht-ccp.xml
index 505965a..5e84193 100644
--- a/RHEL/6/input/profiles/rht-ccp.xml
+++ b/RHEL/6/input/profiles/rht-ccp.xml
@@ -12,6 +12,7 @@
 <refine-value idref="var_accounts_minimum_age_login_defs" selector="7"/>
 <refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="5" />
 <refine-value idref="var_accounts_password_warn_age_login_defs" selector="7"/>
+<refine-value idref="var_password_pam_cracklib_minlen" selector="6"/>
 <refine-value idref="var_password_pam_cracklib_retry" selector="3"/>
 <refine-value idref="var_password_pam_cracklib_dcredit" selector="1"/>
 <refine-value idref="var_password_pam_cracklib_ucredit" selector="2"/>
@@ -54,6 +55,7 @@
 <select idref="accounts_minimum_age_login_defs" selected="true"/>
 <select idref="accounts_maximum_age_login_defs" selected="true"/>
 <select idref="accounts_password_warn_age_login_defs" selected="true"/>
+<select idref="accounts_password_pam_cracklib_minlen" selected="true"/>
 <select idref="accounts_password_pam_cracklib_retry" selected="true"/>
 <select idref="accounts_password_pam_cracklib_dcredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
index 1716e73..96aea42 100644
--- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
@@ -70,6 +70,8 @@
 <select idref="accounts_maximum_age_login_defs" selected="true" />
 <refine-value idref="var_accounts_password_minlen_login_defs" selector="12" />
 <select idref="accounts_password_minlen_login_defs" selected="true" />
+<refine-value idref="var_password_pam_cracklib_minlen" selector="12" />
+<select idref="accounts_password_pam_cracklib_minlen" selected="true" />
 <refine-value idref="var_password_pam_cracklib_retry" selector="3" />
 <select idref="accounts_password_pam_cracklib_retry" selected="true" />
 <refine-value idref="var_password_pam_cracklib_dcredit" selector="1" />
diff --git a/RHEL/6/input/system/accounts/pam.xml b/RHEL/6/input/system/accounts/pam.xml
index aacab89..a61b578 100644
--- a/RHEL/6/input/system/accounts/pam.xml
+++ b/RHEL/6/input/system/accounts/pam.xml
@@ -116,15 +116,6 @@ your organization's security policy. Discussion of each parameter follows.
 requirements are not enforced for the root account for some
 reason.</warning>
 
-<Value id="var_password_pam_cracklib_retry" type="number" operator="equals" interactive="0">
-<title>retry</title>
-<description>Number of retry attempts before erroring out</description>
-<value selector="">3</value>
-<value selector="1">1</value>
-<value selector="2">2</value>
-<value selector="3">3</value>
-</Value>
-
 <Value id="var_password_pam_cracklib_minlen" type="number"
 operator="equals" interactive="0">
 <title>minlen</title>
@@ -138,6 +129,16 @@ operator="equals" interactive="0">
 <value selector="14">14</value>
 <value selector="15">15</value>
 </Value>
+
+<Value id="var_password_pam_cracklib_retry" type="number" operator="equals" interactive="0">
+<title>retry</title>
+<description>Number of retry attempts before erroring out</description>
+<value selector="">3</value>
+<value selector="1">1</value>
+<value selector="2">2</value>
+<value selector="3">3</value>
+</Value>
+
 <Value id="var_password_pam_cracklib_dcredit" type="number"
 operator="equals" interactive="0">
 <title>dcredit</title>
@@ -220,6 +221,35 @@ operator="equals" interactive="0">
 <value selector="100000000">100000000</value> <!-- 3.16 years -->
 </Value>
 
+<Rule id="accounts_password_pam_cracklib_minlen">
+<title>Set Password Minimum Length For Existing User Accounts</title>
+<description>To specify password length requirements for existing user accounts:
+<br /><br />
+Edit the <tt>pam_cracklib.so</tt> statement in <tt>/etc/pam.d/system-auth</tt> file
+to show <tt>minlen=14</tt>, or a greater value if site policy is more restrictive.
+<br /><br />
+The DoD requirement is the password needs to be at least <tt>14</tt> characters long.
+The FISMA requirement is the password needs to be at least <tt>12</tt> characters long.
+</description>
+<ocil clause="it is not the required value">
+To check the minimum password length requirement for existing user accounts, run
+the following command:
+<pre>$ grep pam_cracklib /etc/pam.d/system-auth</pre>
+The <tt>minlen</tt> parameter will indicate the required minimum password length
+(in characters). The DoD requirement is the passwords needs to be at least <tt>14</tt>
+characters long. The FISMA requirement is the password needs to be at least <tt>12</tt>
+characters long. This would appear as <tt>minlen=14</tt> (DoD), <tt>minlen=12</tt>
+(FISMA), or a greater value.
+</ocil>
+<rationale>
+Requiring a minimum password length makes password cracking attacks more
+difficult by ensuring a larger search space. However, any security benefit
+from an onerous requirement must be carefully weighed against usability
+problems, support costs, or counterproductive behavior that may result.
+</rationale>
+<oval id="accounts_password_pam_cracklib_minlen" value="var_password_pam_cracklib_minlen"/>
+</Rule>
+
 <Rule id="accounts_password_pam_cracklib_retry">
 <title>Set Password Retry Prompts Permitted Per-Session</title>
 <description>To configure the number of retry prompts that are permitted per-session:
diff --git a/RHEL/6/input/system/accounts/restrictions/password_expiration.xml b/RHEL/6/input/system/accounts/restrictions/password_expiration.xml
index ce8a082..5dda88e 100644
--- a/RHEL/6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL/6/input/system/accounts/restrictions/password_expiration.xml
@@ -77,30 +77,31 @@ age, and 7 day warning period with the following command:
 </Value>
 
 <Rule id="accounts_password_minlen_login_defs" severity="medium">
-<title>Set Password Minimum Length in login.defs</title>
+<title>Set Password Minimum Length For User Accounts Created in the Future</title>
 <description>To specify password length requirements for new accounts,
 edit the file <tt>/etc/login.defs</tt> and add or correct the following
 lines:
 <pre>PASS_MIN_LEN 14<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre>
 <br/><br/>
-The DoD requirement is <tt>14</tt>. 
+The DoD requirement is <tt>14</tt>.
 The FISMA requirement is <tt>12</tt>.
-If a program consults <tt>/etc/login.defs</tt> and also another PAM module
-(such as <tt>pam_cracklib</tt>) during a password change operation,
-then the most restrictive must be satisfied. See PAM section
-for more information about enforcing password quality requirements.
+<br/><br/>
+<b>Please note this setting will check minimum password length requirements
+for newly created user accounts only. To enforce minimum password length
+policy requirements also for already existing user accounts, refer to the
+<tt>Set Password Minimum Length For Existing User Accounts</tt> section
+of this guide.</b>
 </description>
 <ocil clause="it is not set to the required value">
-To check the minimum password length, run the command:
+To check the minimum password length for user accounts created in the future, run the command:
 <pre>$ grep PASS_MIN_LEN /etc/login.defs</pre>
-The DoD requirement is <tt>14</tt>. 
+The DoD requirement is <tt>14</tt>.
 </ocil>
 <rationale>
-Requiring a minimum password length makes password
-cracking attacks more difficult by ensuring a larger
-search space. However, any security benefit from an onerous requirement
-must be carefully weighed against usability problems, support costs, or counterproductive
-behavior that may result.
+Requiring a minimum password length makes password cracking attacks more
+difficult by ensuring a larger search space. However, any security benefit
+from an onerous requirement must be carefully weighed against usability
+problems, support costs, or counterproductive behavior that may result.
 </rationale>
 <ident cce="27002-5" />
 <oval id="accounts_password_minlen_login_defs" value="var_accounts_password_minlen_login_defs"/>
diff --git a/RHEVM3/input/profiles/stig-rhevm3.xml b/RHEVM3/input/profiles/stig-rhevm3.xml
index d80e69a..3e0aa53 100644
--- a/RHEVM3/input/profiles/stig-rhevm3.xml
+++ b/RHEVM3/input/profiles/stig-rhevm3.xml
@@ -74,9 +74,9 @@
 <select idref="enable_randomize_va_space" selected="true"/>
 <select idref="enable_execshield" selected="true"/>
 
-<select idref="disable_sysctl_ipv4_default_send_redirects" selected="true"/>
-<select idref="disable_sysctl_ipv4_all_send_redirects" selected="true"/>
-<select idref="disable_sysctl_ipv4_ip_forward" selected="true"/>
+<select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
+<select idref="sysctl_ipv4_all_send_redirects" selected="true"/>
+<select idref="sysctl_ipv4_ip_forward" selected="true"/>
 <select idref="set_sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
 <select idref="set_sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/>
 <select idref="set_sysctl_net_ipv4_conf_all_secure_redirects" selected="true"/>
-- 
1.8.3.1

