>From 5a97389c5c8ca1b3869b02677d6c352feef93738 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 27 Dec 2013 00:28:43 -0500 Subject: [PATCH 08/31] Renamed deny_password_attempts to accounts_passwords_pam_faillock_deny, moved to shared/ - Renamed XCCDF to match granular configuration setting - Moved OVAL to shared/, updated CPE info, ln -s to RHEL directories after testing --- RHEL/6/input/auxiliary/stig_overlay.xml | 2 +- RHEL/6/input/auxiliary/transition_notes.xml | 2 +- .../accounts_passwords_pam_faillock_deny.xml | 49 +--------------------- RHEL/6/input/profiles/CS2.xml | 2 +- RHEL/6/input/profiles/common.xml | 2 +- .../6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL/6/input/profiles/nist-CL-IL-AL.xml | 2 +- RHEL/6/input/profiles/rht-ccp.xml | 3 +- RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +- RHEL/6/input/system/accounts/pam.xml | 2 +- RHEL/7/input/auxiliary/transition_notes.xml | 2 +- .../accounts_passwords_pam_faillock_deny.xml | 1 + RHEL/7/input/profiles/rht-ccp.xml | 3 +- RHEL/7/input/system/accounts/pam.xml | 2 +- .../oval/accounts_passwords_pam_faillock_deny.xml | 49 ++++++++++++++++++++++ 15 files changed, 65 insertions(+), 60 deletions(-) mode change 100644 => 120000 RHEL/6/input/checks/accounts_passwords_pam_faillock_deny.xml create mode 120000 RHEL/7/input/checks/accounts_passwords_pam_faillock_deny.xml create mode 100644 shared/oval/accounts_passwords_pam_faillock_deny.xml diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml index 0e77ee6..652ce49 100644 --- a/RHEL/6/input/auxiliary/stig_overlay.xml +++ b/RHEL/6/input/auxiliary/stig_overlay.xml @@ -188,7 +188,7 @@ The system must require at least four characters be changed between the old and new passwords during a password change. - + The system must disable accounts after three consecutive unsuccessful login attempts. diff --git a/RHEL/6/input/auxiliary/transition_notes.xml b/RHEL/6/input/auxiliary/transition_notes.xml index d190b2c..e2f7db6 100644 --- a/RHEL/6/input/auxiliary/transition_notes.xml +++ b/RHEL/6/input/auxiliary/transition_notes.xml @@ -9,7 +9,7 @@ This is not covered in RHEL 6 content -This is covered in RHEL 6 content +This is covered in RHEL 6 content This is not covered in RHEL 6 content diff --git a/RHEL/6/input/checks/accounts_passwords_pam_faillock_deny.xml b/RHEL/6/input/checks/accounts_passwords_pam_faillock_deny.xml deleted file mode 100644 index c682c33..0000000 --- a/RHEL/6/input/checks/accounts_passwords_pam_faillock_deny.xml +++ /dev/null @@ -1,48 +0,0 @@ - - - - Lock out account after failed login attempts - - Red Hat Enterprise Linux 6 - - The number of allowed failed logins should be set correctly. - - - - - - - - - - - - - - - - - - - - /etc/pam.d/system-auth - ^\s*auth\s+(?:(?:required))\s+pam_faillock\.so.*deny=([0-9]*).*$ - 1 - - - - /etc/pam.d/password-auth - ^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so.*deny=([0-9]*).*$ - 1 - - - - - - - - - - - - diff --git a/RHEL/6/input/checks/accounts_passwords_pam_faillock_deny.xml b/RHEL/6/input/checks/accounts_passwords_pam_faillock_deny.xml new file mode 120000 index 0000000..7555d49 --- /dev/null +++ b/RHEL/6/input/checks/accounts_passwords_pam_faillock_deny.xml @@ -0,0 +1 @@ +../../../../shared/oval/accounts_passwords_pam_faillock_deny.xml \ No newline at end of file diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml index 8bb284c..9d33f72 100644 --- a/RHEL/6/input/profiles/CS2.xml +++ b/RHEL/6/input/profiles/CS2.xml @@ -17,7 +17,7 @@ - diff --git a/RHEL/6/input/profiles/common.xml b/RHEL/6/input/profiles/common.xml index 3944bd4..01cb978 100644 --- a/RHEL/6/input/profiles/common.xml +++ b/RHEL/6/input/profiles/common.xml @@ -57,7 +57,7 @@ + diff --git a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml index 16d7d29..55254b0 100644 --- a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml +++ b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml @@ -78,7 +78,7 @@ FISMA Refine: 3 attempts in 15 min --> - + diff --git a/RHEL/6/input/profiles/rht-ccp.xml b/RHEL/6/input/profiles/rht-ccp.xml index 9040055..b6df557 100644 --- a/RHEL/6/input/profiles/rht-ccp.xml +++ b/RHEL/6/input/profiles/rht-ccp.xml @@ -10,6 +10,7 @@ + @@ -59,7 +60,7 @@ + diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml index 4693fae..c8a7bfb 100644 --- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml +++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml @@ -83,7 +83,7 @@ + -