The checks in RHEL6/input/checks/accounts_password_pam_cracklib_[dlou]credit.xml
all permit an optional "-" in front of the value so
setting ucredit=2 in RHEL6/input/profiles/common.xml
permits ucredit=-2 in system-auth
The same is true for RHEL6/input/checks/accounts_password_pam_cracklib_difok.xml
This change avoids unintentionally matching negative values that were not
specified in a profile.
Signed-off-by: Kenneth Stailey <kstailey.lists(a)gmail.com>
---
RHEL6/input/checks/accounts_password_pam_cracklib_dcredit.xml | 2 +-
RHEL6/input/checks/accounts_password_pam_cracklib_difok.xml | 2 +-
RHEL6/input/checks/accounts_password_pam_cracklib_lcredit.xml | 2 +-
RHEL6/input/checks/accounts_password_pam_cracklib_ocredit.xml | 2 +-
RHEL6/input/checks/accounts_password_pam_cracklib_ucredit.xml | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/RHEL6/input/checks/accounts_password_pam_cracklib_dcredit.xml
b/RHEL6/input/checks/accounts_password_pam_cracklib_dcredit.xml
index 182313a..1cc6ed1 100644
--- a/RHEL6/input/checks/accounts_password_pam_cracklib_dcredit.xml
+++ b/RHEL6/input/checks/accounts_password_pam_cracklib_dcredit.xml
@@ -37,7 +37,7 @@
version="1">
<ind:path>/etc/pam.d</ind:path>
<ind:filename>system-auth</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]dcredit=(-?\d+)(?:[\s]|$)</ind:pattern>
+ <ind:pattern operation="pattern
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]dcredit=(\d+)(?:[\s]|$)</ind:pattern>
<ind:instance datatype="int" operation="less than or
equal">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
diff --git a/RHEL6/input/checks/accounts_password_pam_cracklib_difok.xml
b/RHEL6/input/checks/accounts_password_pam_cracklib_difok.xml
index 37945cd..56619a7 100644
--- a/RHEL6/input/checks/accounts_password_pam_cracklib_difok.xml
+++ b/RHEL6/input/checks/accounts_password_pam_cracklib_difok.xml
@@ -25,7 +25,7 @@
<ind:textfilecontent54_object
id="object_accounts_password_pam_cracklib_difok" version="1">
<ind:path>/etc/pam.d</ind:path>
<ind:filename>system-auth</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]difok=(-?\d+)(?:[\s]|$)</ind:pattern>
+ <ind:pattern operation="pattern
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]difok=(\d+)(?:[\s]|$)</ind:pattern>
<ind:instance datatype="int" operation="greater than or
equal">1</ind:instance>
</ind:textfilecontent54_object>
diff --git a/RHEL6/input/checks/accounts_password_pam_cracklib_lcredit.xml
b/RHEL6/input/checks/accounts_password_pam_cracklib_lcredit.xml
index f9c42f0..21bef98 100644
--- a/RHEL6/input/checks/accounts_password_pam_cracklib_lcredit.xml
+++ b/RHEL6/input/checks/accounts_password_pam_cracklib_lcredit.xml
@@ -37,7 +37,7 @@
version="1">
<ind:path>/etc/pam.d</ind:path>
<ind:filename>system-auth</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]lcredit=(-?\d+)(?:[\s]|$)</ind:pattern>
+ <ind:pattern operation="pattern
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]lcredit=(\d+)(?:[\s]|$)</ind:pattern>
<ind:instance datatype="int" operation="less than or
equal">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
diff --git a/RHEL6/input/checks/accounts_password_pam_cracklib_ocredit.xml
b/RHEL6/input/checks/accounts_password_pam_cracklib_ocredit.xml
index 8d433f4..117daaf 100644
--- a/RHEL6/input/checks/accounts_password_pam_cracklib_ocredit.xml
+++ b/RHEL6/input/checks/accounts_password_pam_cracklib_ocredit.xml
@@ -37,7 +37,7 @@
version="1">
<ind:path>/etc/pam.d</ind:path>
<ind:filename>system-auth</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]ocredit=(-?\d+)(?:[\s]|$)</ind:pattern>
+ <ind:pattern operation="pattern
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]ocredit=(\d+)(?:[\s]|$)</ind:pattern>
<ind:instance datatype="int" operation="less than or
equal">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
diff --git a/RHEL6/input/checks/accounts_password_pam_cracklib_ucredit.xml
b/RHEL6/input/checks/accounts_password_pam_cracklib_ucredit.xml
index 9227167..fe66c2b 100644
--- a/RHEL6/input/checks/accounts_password_pam_cracklib_ucredit.xml
+++ b/RHEL6/input/checks/accounts_password_pam_cracklib_ucredit.xml
@@ -37,7 +37,7 @@
version="1">
<ind:path>/etc/pam.d</ind:path>
<ind:filename>system-auth</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]ucredit=(-?\d+)(?:[\s]|$)</ind:pattern>
+ <ind:pattern operation="pattern
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]ucredit=(\d+)(?:[\s]|$)</ind:pattern>
<ind:instance datatype="int" operation="less than or
equal">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
--
1.8.1.1