On 8/14/15 2:44 PM, Ron Colvin wrote:
The CVE in this case was to remedy a flaw that allowed the
MaxAuthTries limit to be bypassed. The security guide has no control
for MaxAuthTries.
SSG configures authentication retries at a system level through PAM via
the accounts_password_pam_retry rule. Ref:
https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/...
The accounts_password_pam_retry is selected in most profiles (DoD STIG,
CS2, CCP...) and should provide a scoreable/verifiable control that Ron
referenced.
The CIS Benchmark control for RHEL 6 is 4.
The quality of the
CIS hardening guides for Red Hat technologies is
unknown; we do not formally review them.
Ideology differs between Red Hat and CIS. The purpose of SSG is to get
security configuration guidance and automation into the public, into the
technology natively (e.g. shipping in RHEL), and developed in an open
community with open (in our case, public domain) licensing. CIS charges
membership and licensing fees for their content which doesn't mesh.