>From bf44c490e81aba7221acb2804b715a61b067b3e8 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 15 Sep 2013 21:19:04 -0400 Subject: [PATCH 22/22] Updated XCCDF/OVAL namings --- RHEL6/input/auxiliary/stig_overlay.xml | 4 ++-- RHEL6/input/auxiliary/transition_notes.xml | 6 +++--- .../checks/accounts_maximum_age_login_defs.xml | 8 ++++---- .../checks/accounts_minimum_age_login_defs.xml | 4 ++-- .../accounts_password_warn_age_login_defs.xml | 4 ++-- .../fixes/bash/accounts_maximum_age_login_defs.sh | 6 +++--- .../fixes/bash/accounts_minimum_age_login_defs.sh | 8 ++++---- .../bash/accounts_password_minlen_login_defs.sh | 6 +++--- .../bash/accounts_password_warn_age_login_defs.sh | 6 +++--- RHEL6/input/profiles/CS2.xml | 10 +++++----- RHEL6/input/profiles/common.xml | 12 ++++++------ RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 6 +++--- RHEL6/input/profiles/stig-rhel6-server.xml | 4 ++-- RHEL6/input/profiles/test.xml | 12 ++++++------ RHEL6/input/profiles/usgcb-rhel6-server.xml | 8 ++++---- .../accounts/restrictions/password_expiration.xml | 20 ++++++++++---------- 16 files changed, 62 insertions(+), 62 deletions(-) diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml index 10fd0c5..fa3ee05 100644 --- a/RHEL6/input/auxiliary/stig_overlay.xml +++ b/RHEL6/input/auxiliary/stig_overlay.xml @@ -120,10 +120,10 @@ The system must require passwords to contain a minimum of 14 characters. - + Users must not be able to change passwords more than once every 24 hours. - + User passwords must be changed at least every 60 days. diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml index f2e18dd..811d0e8 100644 --- a/RHEL6/input/auxiliary/transition_notes.xml +++ b/RHEL6/input/auxiliary/transition_notes.xml @@ -1273,13 +1273,13 @@ rule=smb_restrict_file_sharing manual=no Check exists in the RHEL6 prose, it can be automated and the OVAL for it does not appear to exist. -rule=password_min_age manual=no +rule=accounts_minimum_age_login_defs manual=no Check exists in the RHEL6 prose, it can be automated and the OVAL for it partially exists. -rule=password_min_age manual=no +rule=accounts_minimum_age_login_defs manual=no Guide and oval address changing the defaults but don't address the current values @@ -1468,7 +1468,7 @@ No automated means to determine presence in DMZ. We should not be allowing FTP. Check does exist in the RHEL6 prose, it can be automated and the OVAL for it does exist. -rule=password_max_age manual=yes +rule=accounts_maximum_age_login_defs manual=yes diff --git a/RHEL6/input/checks/accounts_maximum_age_login_defs.xml b/RHEL6/input/checks/accounts_maximum_age_login_defs.xml index 8b989c5..5360e66 100644 --- a/RHEL6/input/checks/accounts_maximum_age_login_defs.xml +++ b/RHEL6/input/checks/accounts_maximum_age_login_defs.xml @@ -16,7 +16,7 @@ - + @@ -25,10 +25,10 @@ 1 - - + + - + diff --git a/RHEL6/input/checks/accounts_minimum_age_login_defs.xml b/RHEL6/input/checks/accounts_minimum_age_login_defs.xml index 423cd60..a0cc5c3 100644 --- a/RHEL6/input/checks/accounts_minimum_age_login_defs.xml +++ b/RHEL6/input/checks/accounts_minimum_age_login_defs.xml @@ -27,9 +27,9 @@ - + - + diff --git a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml index 40a6449..9dce3e9 100644 --- a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml +++ b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml @@ -28,9 +28,9 @@ - + - + diff --git a/RHEL6/input/fixes/bash/accounts_maximum_age_login_defs.sh b/RHEL6/input/fixes/bash/accounts_maximum_age_login_defs.sh index 7daa487..0ae18b1 100644 --- a/RHEL6/input/fixes/bash/accounts_maximum_age_login_defs.sh +++ b/RHEL6/input/fixes/bash/accounts_maximum_age_login_defs.sh @@ -1,8 +1,8 @@ source ./templates/support.sh -populate var_password_max_age +populate var_accounts_maximum_age_login_defs grep -q ^PASS_MAX_DAYS /etc/login.defs && \ - sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS $var_password_max_age/g" /etc/login.defs + sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS $var_accounts_maximum_age_login_defs/g" /etc/login.defs if ! [ $? -eq 0 ]; then - echo "PASS_MAX_DAYS $var_password_max_age" >> /etc/login.defs + echo "PASS_MAX_DAYS $var_accounts_maximum_age_login_defs" >> /etc/login.defs fi diff --git a/RHEL6/input/fixes/bash/accounts_minimum_age_login_defs.sh b/RHEL6/input/fixes/bash/accounts_minimum_age_login_defs.sh index 1c4a136..e363db6 100644 --- a/RHEL6/input/fixes/bash/accounts_minimum_age_login_defs.sh +++ b/RHEL6/input/fixes/bash/accounts_minimum_age_login_defs.sh @@ -1,8 +1,8 @@ source ./templates/support.sh -populate var_password_min_age +populate var_accounts_minimum_age_login_defs -grep -q ^PASS_MIN_AGE /etc/login.defs && \ - sed -i "s/PASS_MIN_AGE.*/PASS_MIN_AGE $var_password_min_age/g" /etc/login.defs +grep -q ^PASS_MIN_DAYS /etc/login.defs && \ + sed -i "s/PASS_MIN_DAYS.*/PASS_MIN_DAYS $var_accounts_minimum_age_login_defs/g" /etc/login.defs if ! [ $? -eq 0 ]; then - echo "PASS_MIN_AGE $var_password_min_age" >> /etc/login.defs + echo "PASS_MIN_DAYS $var_accounts_minimum_age_login_defs" >> /etc/login.defs fi diff --git a/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh b/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh index 69b50e5..1d4ed31 100644 --- a/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh +++ b/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh @@ -1,8 +1,8 @@ source ./templates/support.sh -populate var_password_min_len +populate var_accounts_password_minlen_login_defs grep -q ^PASS_MIN_LEN /etc/login.defs && \ - sed -i "s/PASS_MIN_LEN.*/PASS_MIN_LEN $var_password_min_len/g" /etc/login.defs + sed -i "s/PASS_MIN_LEN.*/PASS_MIN_LEN $var_accounts_password_minlen_login_defs/g" /etc/login.defs if ! [ $? -eq 0 ]; then - echo "PASS_MIN_LEN $var_password_min_len" >> /etc/login.defs + echo "PASS_MIN_LEN $var_accounts_password_minlen_login_defs" >> /etc/login.defs fi diff --git a/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh b/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh index 6377bcc..250b141 100644 --- a/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh +++ b/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh @@ -1,8 +1,8 @@ source ./templates/support.sh -populate var_password_warn_age +populate var_accounts_password_warn_age_login_defs grep -q ^PASS_WARN_DAYS /etc/login.defs && \ - sed -i "s/PASS_WARN_DAYS.*/PASS_WARN_DAYS $var_password_warn_age/g" /etc/login.defs + sed -i "s/PASS_WARN_DAYS.*/PASS_WARN_DAYS $var_accounts_password_warn_age_login_defs/g" /etc/login.defs if ! [ $? -eq 0 ]; then - echo "PASS_WARN_DAYS $var_password_warn_age" >> /etc/login.defs + echo "PASS_WARN_DAYS $var_accounts_password_warn_age_login_defs" >> /etc/login.defs fi diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml index 01d74c1..af71984 100644 --- a/RHEL6/input/profiles/CS2.xml +++ b/RHEL6/input/profiles/CS2.xml @@ -4,10 +4,10 @@ - - + + @@ -15,7 +15,7 @@ - - + + @@ -230,11 +230,11 @@ these should likely be moved out of common. - + - + - + diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml index 1f8f664..80a69e0 100644 --- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml +++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml @@ -292,9 +292,9 @@ - - + diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml index 62aafe6..6c7783a 100644 --- a/RHEL6/input/profiles/stig-rhel6-server.xml +++ b/RHEL6/input/profiles/stig-rhel6-server.xml @@ -90,8 +90,8 @@ - - + + diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml index 36f6ed2..e44fdac 100644 --- a/RHEL6/input/profiles/test.xml +++ b/RHEL6/input/profiles/test.xml @@ -3,9 +3,9 @@ This profile is for testing. - + - + - + diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml index 322789b..88eeca3 100644 --- a/RHEL6/input/profiles/usgcb-rhel6-server.xml +++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml @@ -66,10 +66,10 @@ - - + + diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml index a09b1d2..ce8a082 100644 --- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml +++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml @@ -42,7 +42,7 @@ age, and 7 day warning period with the following command: 14 - + maximum password age Maximum age of password in days This will only apply to newly created accounts @@ -53,7 +53,7 @@ age, and 7 day warning period with the following command: 180 - + minimum password age Minimum age of password in days This will only apply to newly created accounts @@ -66,7 +66,7 @@ age, and 7 day warning period with the following command: - + warning days before password expires The number of days' warning given before a password expires. This will only apply to newly created accounts @@ -109,7 +109,7 @@ behavior that may result. - + Set Password Minimum Age To specify password minimum age for new accounts, edit the file /etc/login.defs @@ -130,13 +130,13 @@ users cycling back to a favorite password after satisfying the password reuse requirement. - + - + Set Password Maximum Age To specify password maximum age for new accounts, edit the file /etc/login.defs @@ -158,12 +158,12 @@ the utility of a stolen password. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise. - + - + Set Password Warning Age To specify how many days prior to password expiration that a warning will be issued to users, @@ -171,7 +171,7 @@ edit the file /etc/login.defs and add or correct the following line, replacing DAYS appropriately:
PASS_WARN_AGE DAYS
The DoD requirement is 7. - +
To check the password warning age, run the command: @@ -183,7 +183,7 @@ Setting the password warning age enables users to make the change at a practical time. - +
-- 1.7.1