On 8/14/15 2:44 PM, Ron Colvin wrote:
The CVE in this case was to remedy a flaw that allowed the MaxAuthTries limit to be bypassed. The security guide has no control for MaxAuthTries.

SSG configures authentication retries at a system level through PAM via the accounts_password_pam_retry rule. Ref:
https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/accounts/pam.xml#L244#L270

The accounts_password_pam_retry is selected in most profiles (DoD STIG, CS2, CCP...) and should provide a scoreable/verifiable control that Ron referenced.

The CIS Benchmark control for RHEL 6 is 4.
The quality of the CIS hardening guides for Red Hat technologies is unknown; we do not formally review them.

Ideology differs between Red Hat and CIS. The purpose of SSG is to get security configuration guidance and automation into the public, into the technology natively (e.g. shipping in RHEL), and developed in an open community with open (in our case, public domain) licensing. CIS charges membership and licensing fees for their content which doesn't mesh.