On 8/14/15 2:44 PM, Ron Colvin wrote:
The CVE
in this case was to remedy a flaw that allowed the MaxAuthTries
limit to be bypassed. The security guide has no control for
MaxAuthTries.
SSG configures authentication retries at a system level through PAM
via the accounts_password_pam_retry rule. Ref:
https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/accounts/pam.xml#L244#L270
The accounts_password_pam_retry is selected in most profiles (DoD
STIG, CS2, CCP...) and should provide a scoreable/verifiable control
that Ron referenced.
The
CIS Benchmark control for RHEL 6 is 4.
The quality of the CIS hardening guides for Red Hat technologies is
unknown; we do not formally review them.
Ideology differs between Red Hat and CIS. The purpose of SSG is to
get security configuration guidance and automation into the public,
into the technology natively (e.g. shipping in RHEL), and developed
in an open community with open (in our case, public domain)
licensing. CIS charges membership and licensing fees for their
content which doesn't mesh.