On 10/10/13 12:45 PM, Jan Lieskovsky wrote:
This patch converts (and includes) four existing rules from RHEL6
'Set Password Expiration Parameters' section to (into) Fedora.

Testing:
* all tests of make fedora-tarball, fedora-srpm, fedora-rpm have passed,
* all tests within Fedora of 'make / make validate / make validate-xml /
  make checks / make guide / make content / make eval-common' have passed
  with the proposal.

Please review.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

0001-Fedora-Convert-four-RHEL6-rules-from-Set-Password-Ex.patch

From 5e5dbb929fe8376f72d71f526f5e02e4ed4a841d Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Thu, 10 Oct 2013 18:39:11 +0200
Subject: [PATCH] [Fedora] Convert four RHEL6 rules from 'Set Password
 Expiration Parameters' section to Fedora


Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
 .../checks/accounts_maximum_age_login_defs.xml     |  32 ++++
 .../checks/accounts_minimum_age_login_defs.xml     |  34 ++++
 .../checks/accounts_password_minlen_login_defs.xml |  33 ++++
 .../accounts_password_warn_age_login_defs.xml      |  35 ++++
 Fedora/input/guide.xml                             |   2 +-
 Fedora/input/guide.xslt                            |   1 +
 Fedora/input/profiles/common.xml                   |   4 +
 .../accounts/restrictions/password_expiration.xml  | 177 +++++++++++++++++++++
 Fedora/scap-security-guide.spec                    |   5 +-
 9 files changed, 321 insertions(+), 2 deletions(-)
 create mode 100644 Fedora/input/checks/accounts_maximum_age_login_defs.xml
 create mode 100644 Fedora/input/checks/accounts_minimum_age_login_defs.xml
 create mode 100644 Fedora/input/checks/accounts_password_minlen_login_defs.xml
 create mode 100644 Fedora/input/checks/accounts_password_warn_age_login_defs.xml
 create mode 100644 Fedora/input/system/accounts/restrictions/password_expiration.xml

diff --git a/Fedora/input/checks/accounts_maximum_age_login_defs.xml b/Fedora/input/checks/accounts_maximum_age_login_defs.xml
new file mode 100644
index 0000000..5e96118
--- /dev/null
+++ b/Fedora/input/checks/accounts_maximum_age_login_defs.xml
@@ -0,0 +1,32 @@
+<def-group>
+  <definition class="compliance" id="accounts_maximum_age_login_defs" version="1">
+    <metadata>
+      <title>Set Password Expiration Parameters</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The maximum password age policy should meet minimum requirements.</description>
+    </metadata>
+    <criteria comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
+      <criterion test_ref="test_pass_max_days" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs" id="test_pass_max_days" version="1">
+    <ind:object object_ref="object_etc_login_defs_pass_max" />
+    <ind:state state_ref="state_accounts_maximum_age_login_defs" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_etc_login_defs_pass_max" version="1">
+    <ind:filepath>/etc/login.defs</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*PASS_MAX_DAYS[\s]+(\d+)\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_accounts_maximum_age_login_defs" version="1">
+    <ind:subexpression operation="less than or equal" var_ref="var_accounts_maximum_age_login_defs" datatype="int" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="maximum password age" datatype="int" id="var_accounts_maximum_age_login_defs" version="1" />
+
+</def-group>
diff --git a/Fedora/input/checks/accounts_minimum_age_login_defs.xml b/Fedora/input/checks/accounts_minimum_age_login_defs.xml
new file mode 100644
index 0000000..87917e0
--- /dev/null
+++ b/Fedora/input/checks/accounts_minimum_age_login_defs.xml
@@ -0,0 +1,34 @@
+<def-group>
+  <definition class="compliance" id="accounts_minimum_age_login_defs" version="1">
+    <metadata>
+      <title>Set Password Expiration Parameters</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The minimum password age policy should be set appropriately.</description>
+    </metadata>
+    <criteria comment="the value PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
+      <criterion test_ref="test_pass_min_days" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all"
+  comment="Tests the value of PASS_MIN_DAYS in /etc/login.defs"
+  id="test_pass_min_days" version="1">
+    <ind:object object_ref="object_etc_login_defs_pass_min_age" />
+    <ind:state state_ref="state_etc_login_defs_pass_min_age" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_etc_login_defs_pass_min_age" version="1">
+    <ind:filepath>/etc/login.defs</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*PASS_MIN_DAYS[\s]+(\d+)\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_etc_login_defs_pass_min_age" version="1">
+    <ind:subexpression operation="greater than or equal" var_ref="var_accounts_minimum_age_login_defs" datatype="int" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="minimum password age in days" datatype="int" id="var_accounts_minimum_age_login_defs" version="1" />
+
+</def-group>
diff --git a/Fedora/input/checks/accounts_password_minlen_login_defs.xml b/Fedora/input/checks/accounts_password_minlen_login_defs.xml
new file mode 100644
index 0000000..e3ce130
--- /dev/null
+++ b/Fedora/input/checks/accounts_password_minlen_login_defs.xml
@@ -0,0 +1,33 @@
+<def-group>
+
+  <definition class="compliance" id="accounts_password_minlen_login_defs" version="1">
+    <metadata>
+      <title>Set Password Expiration Parameters</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The password minimum length should be set appropriately.</description>
+    </metadata>
+    <criteria operator="AND">
+      <criterion test_ref="test_etc_login_defs" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" comment="check PASS_MIN_LEN in /etc/login.defs" id="test_etc_login_defs" version="1">
+    <ind:object object_ref="object_etc_login_defs" />
+    <ind:state state_ref="state_accounts_password_minlen_login_defs" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_etc_login_defs" version="1">
+    <ind:filepath>/etc/login.defs</ind:filepath>
+    <ind:pattern operation="pattern match">^PASS_MIN_LEN\s+(\d+)\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_accounts_password_minlen_login_defs" version="1">
+    <ind:subexpression operation="greater than or equal" var_ref="var_accounts_password_minlen_login_defs" datatype="int" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="password minimum length" datatype="int" id="var_accounts_password_minlen_login_defs" version="1" />
+
+</def-group>
diff --git a/Fedora/input/checks/accounts_password_warn_age_login_defs.xml b/Fedora/input/checks/accounts_password_warn_age_login_defs.xml
new file mode 100644
index 0000000..5230af1
--- /dev/null
+++ b/Fedora/input/checks/accounts_password_warn_age_login_defs.xml
@@ -0,0 +1,35 @@
+<def-group>
+  <definition class="compliance" id="accounts_password_warn_age_login_defs" version="1">
+    <metadata>
+      <title>Set Password Expiration Parameters</title>
+      <affected family="unix">
+        <platform>Fedora 19</platform>
+      </affected>
+      <description>The password expiration warning age should be set appropriately.</description>
+    </metadata>
+    <criteria>
+      <criterion test_ref="test_pass_warn_age" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all"
+  comment="Tests the value of PASS_WARN_AGE in /etc/login.defs"
+  id="test_pass_warn_age" version="1">
+    <ind:object object_ref="object_etc_login_defs_pass_warn_age" />
+    <ind:state state_ref="state_etc_login_defs_pass_warn_age" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="object_etc_login_defs_pass_warn_age"
+  version="1">
+    <ind:filepath>/etc/login.defs</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*PASS_WARN_AGE[\s]*(\d+)\s*$</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_etc_login_defs_pass_warn_age" version="1">
+    <ind:subexpression operation="greater than or equal" var_ref="var_accounts_password_warn_age_login_defs" datatype="int" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="password expiration warning age in days" datatype="int" id="var_accounts_password_warn_age_login_defs" version="1" />
+
+</def-group>
diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml
index c76b795..6e276b1 100644
--- a/Fedora/input/guide.xml
+++ b/Fedora/input/guide.xml
@@ -36,5 +36,5 @@ trademarks or trademarks of Red Hat, Inc. in the United States and other
 countries. All other names are registered trademarks or trademarks of their
 respective companies.</rear-matter>
 <platform idref="cpe:/o:fedoraproject:fedora:19" />
-<version>0.0.1</version>
+<version>0.0.2</version>
 </Benchmark>
diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt
index 8bdf86e..559042e 100644
--- a/Fedora/input/guide.xslt
+++ b/Fedora/input/guide.xslt
@@ -46,6 +46,7 @@
     <xsl:copy>
       <xsl:copy-of select="@*|node()" />
       <xsl:apply-templates select="document('system/accounts/restrictions/password_storage.xml')" />
+      <xsl:apply-templates select="document('system/accounts/restrictions/password_expiration.xml')" />
     </xsl:copy>
   </xsl:template>
 
diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/common.xml
index 2739a33..83e3478 100644
--- a/Fedora/input/profiles/common.xml
+++ b/Fedora/input/profiles/common.xml
@@ -8,5 +8,9 @@
 <select idref="no_hashes_outside_shadow" selected="true"/>
 <select idref="gid_passwd_group_same" selected="true"/>
 <select idref="no_netrc_files" selected="true"/>
+<select idref="accounts_password_minlen_login_defs" selected="true"/>
+<select idref="accounts_minimum_age_login_defs" selected="true"/>
+<select idref="accounts_maximum_age_login_defs" selected="true"/>
+<select idref="accounts_password_warn_age_login_defs" selected="true"/>
 
 </Profile>
diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml
new file mode 100644
index 0000000..73d48c6
--- /dev/null
+++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml
@@ -0,0 +1,177 @@
+<Group id="password_expiration">
+<title>Set Password Expiration Parameters</title>
+<description>The file <tt>/etc/login.defs</tt> controls several
+password-related settings. Programs such as <tt>passwd</tt>,
+<tt>su</tt>, and <tt>login</tt> consult <tt>/etc/login.defs</tt> to determine
+behavior with regard to password aging, expiration warnings,
+and length. See the man page <tt>login.defs(5)</tt> for more information.
+<br/><br/>
+Users should be forced to change their passwords, in order to
+decrease the utility of compromised passwords. However, the need to
+change passwords often should be balanced against the risk that
+users will reuse or write down passwords if forced to change them
+too often. Forcing password changes every 90-360 days, depending on
+the environment, is recommended. Set the appropriate value as
+<tt>PASS_MAX_DAYS</tt> and apply it to existing accounts with the
+<tt>-M</tt> flag.
+<br /><br />
+The <tt>PASS_MIN_DAYS</tt> (<tt>-m</tt>) setting prevents password
+changes for 7 days after the first change, to discourage password
+cycling. If you use this setting, train users to contact an administrator
+for an emergency password change in case a new password becomes
+compromised. The <tt>PASS_WARN_AGE</tt> (<tt>-W</tt>) setting gives
+users 7 days of warnings at login time that their passwords are about to expire.
+<br /><br />
+For example, for each existing human user <i>USER</i>, expiration parameters
+could be adjusted to a 180 day maximum password age, 7 day minimum password
+age, and 7 day warning period with the following command:
+<pre># chage -M 180 -m 7 -W 7 USER</pre>
+</description>
+
+<Value id="var_accounts_password_minlen_login_defs" type="number" >
+<title>minimum password length</title>
+<description>Minimum number of characters in password</description>
+<warning category="general">This will only check new passwords</warning>
+<value selector="">12</value>
+<value selector="6">6</value>
+<!-- NIST 800-53 requires 1 in a million using brute force which translates to six numbers -->
+<value selector="8">8</value>
+<value selector="10">10</value>
+<value selector="12">12</value>
+<value selector="14">14</value>
+</Value>
+
+<Value id="var_accounts_maximum_age_login_defs" type="number" >
+<title>maximum password age</title>
+<description>Maximum age of password in days</description>
+<warning category="general">This will only apply to newly created accounts</warning>
+<value selector="">60</value>
+<value selector="60">60</value>
+<value selector="90">90</value>
+<value selector="120">120</value>
+<value selector="180">180</value>
+</Value>
+
+<Value id="var_accounts_minimum_age_login_defs" type="number" >
+<title>minimum password age</title>
+<description>Minimum age of password in days</description>
+<warning category="general">This will only apply to newly created accounts</warning>
+<value selector="">7</value>
+<value selector="7">7</value>
+<value selector="5">5</value>
+<value selector="1">1</value>
+<value selector="2">2</value>
+<value selector="0">0</value>
+</Value>
+
+<Value id="var_accounts_password_warn_age_login_defs" type="number" >
+<title>warning days before password expires</title>
+<description>The number of days' warning given before a password expires.</description>
+<warning category="general">This will only apply to newly created accounts</warning>
+<value selector="">7</value>
+<value selector="0">0</value>
+<value selector="7">7</value>
+<value selector="14">14</value>
+</Value>
+
+<Rule id="accounts_password_minlen_login_defs" severity="medium">
+<title>Set Password Minimum Length in login.defs</title>
+<description>To specify password length requirements for new accounts,
+edit the file <tt>/etc/login.defs</tt> and add or correct the following
+lines:
+<pre>PASS_MIN_LEN 12<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre>
+<br/><br/>
+Nowadays recommended values, considered as secure by various organizations
+focused on topic of computer security, range from <tt>12 (FISMA)</tt> up to
+<tt>14 (DoD)</tt> characters for password length requirements.
+If a program consults <tt>/etc/login.defs</tt> and also another PAM module
+(such as <tt>pam_cracklib</tt>) during a password change operation,
+then the most restrictive must be satisfied. See PAM section
+for more information about enforcing password quality requirements.
+</description>
+<ocil clause="it is not set to the required value">
+To check the minimum password length, run the command:
+<pre>$ grep PASS_MIN_LEN /etc/login.defs</pre>
+Passwords of length <tt>12</tt> characters and more are nowadays
+considered to be a standard requirement.
+</ocil>
+<rationale>
+Requiring a minimum password length makes password
+cracking attacks more difficult by ensuring a larger
+search space. However, any security benefit from an onerous requirement
+must be carefully weighed against usability problems, support costs, or
+counterproductive behavior that may result.
+</rationale>
+<oval id="accounts_password_minlen_login_defs" value="var_accounts_password_minlen_login_defs"/>
+<ref nist="IA-5(f),IA-5(1)(a)" disa="205"/>
+</Rule>
+
+<Rule id="accounts_minimum_age_login_defs" severity="medium">
+<title>Set Password Minimum Age</title>
+<description>To specify password minimum age for new accounts,
+edit the file <tt>/etc/login.defs</tt> and add or correct the
+following line, replacing the <i>DAYS</i> item as appropriate: 
+<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
+A value of 1 day is considered to be sufficient for many environments.
+</description>
+<ocil clause="it is not set to the required value">
+To check the minimum password age, run the command:
+<pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
+A value of 1 day is considered to be sufficient for many environments.
+</ocil>
+<rationale>
+Setting the minimum password age protects against users cycling
+back to a favorite password after satisfying the password reuse
+requirement.
+</rationale>
+<oval id="accounts_minimum_age_login_defs" value="var_accounts_minimum_age_login_defs"/>
+<ref nist="IA-5(f),IA-5(1)(d)" disa="198"/>
+</Rule>
+
+<Rule id="accounts_maximum_age_login_defs" severity="medium">
+<title>Set Password Maximum Age</title>
+<description>To specify password maximum age for new accounts,
+edit the file <tt>/etc/login.defs</tt> and add or correct the
+following line, replacing the <i>DAYS</i> item appropriately:
+<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
+A value of 180 days is sufficient for many environments. 
+</description>
+<ocil clause="it is not set to the required value">
+To check the maximum password age, run the command:
+<pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
+A value of 180 days is sufficient for many environments. 
+</ocil>
+<rationale>
+Setting the password maximum age ensures users are required to
+periodically change their passwords. This could possibly decrease
+the utility of a stolen password. Requiring shorter password lifetimes
+increases the risk of users writing down the password in a convenient
+location subject to physical compromise.</rationale>
+<oval id="accounts_maximum_age_login_defs" value="var_accounts_maximum_age_login_defs"/>
+<ref nist="IA-5(f),IA-5(g),IA-5(1)(d)" disa="180,199" />
+</Rule>
+
+<Rule id="accounts_password_warn_age_login_defs">
+<title>Set Password Warning Age</title>
+<description>To specify how many days prior to password
+expiration that a warning will be issued to users,
+edit the file <tt>/etc/login.defs</tt> and add or correct
+ the following line, replacing the <i>DAYS</i> item as appropriate:
+<pre>PASS_WARN_AGE <i>DAYS</i></pre>
+A value of 7 days would be nowadays considered to be a standard.
+<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> -->
+</description>
+<ocil clause="it is not set to the required value">
+To check the password warning age, run the command:
+<pre>$ grep PASS_WARN_AGE /etc/login.defs</pre>
+A value of 7 days would be nowadays considered to be a standard.
+</ocil>
+<rationale>
+Setting the password warning age enables users to make the change
+at a practical time.
+</rationale>
+<oval id="accounts_password_warn_age_login_defs" value="var_accounts_password_warn_age_login_defs" />
+<ref nist="IA-5(f)" />
+</Rule>
+
+</Group>
diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
index 73eab57..1abe666 100644
--- a/Fedora/scap-security-guide.spec
+++ b/Fedora/scap-security-guide.spec
@@ -5,7 +5,7 @@
 # file one level up - in the main scap-security-guide directory (instead of
 # this one).
 
-%global	fedorassgrelease	2.rc2
+%global	fedorassgrelease	2.rc3
 
 Name:		scap-security-guide
 Version:	0.1
@@ -50,6 +50,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/xml/scap/ssg/fedora/19/*
 
 %changelog
+* Thu Oct 10 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-2.rc3
+- Convert four RHEL6 'Set Password Expiration Parameter' rules to Fedora
+
 * Thu Oct 10 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1-2.rc2
 - Introduce 'Account and Access Control' section
 - Convert following "Verify Proper Storage and Existence of Password Hashes" section
-- 1.7.11.7

ack