> --
> Shawn Wells
> Director, Innovation Programs shawn@redhat.com | 443.534.0130
> @shawndwells
From 2ec99f4a2840209f8a9ef834b6d67d7ccd142b07 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Mon, 24 Mar 2014 14:31:26 +0100
Subject: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules
description
Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
Fedora/input/services/ssh.xml | 8 +++--
.../accounts/restrictions/password_expiration.xml | 42 ++++++++++++----------
2 files changed, 29 insertions(+), 21 deletions(-)
diff --git a/Fedora/input/services/ssh.xml b/Fedora/input/services/ssh.xml
index ce289b1..0489b4b 100644
--- a/Fedora/input/services/ssh.xml
+++ b/Fedora/input/services/ssh.xml
@@ -64,11 +64,13 @@ misconfiguration elsewhere.
<description>SSH allows administrators to set an idle timeout interval.
After this interval has passed, the idle user will be automatically logged out.
<br /><br />
-To set an idle timeout interval, edit the following line in
-<tt>/etc/ssh/sshd_config</tt> as follows:
+To set an idle timeout interval, edit the <tt>/etc/ssh/sshd_config</tt> file,
+locate the following line:
<pre>ClientAliveInterval <b>INTERVAL</b></pre>
+and correct it to have the form of:
+<pre>ClientAliveInterval <b><sub idref="sshd_idle_timeout_value" /></b></pre>
The timeout <b>INTERVAL</b> is given in seconds. To have a timeout of 15
-minutes, set <b>interval</b> to 900.
+minutes, set <b>INTERVAL</b> to 900.
<br /><br />
If a shorter timeout has already been set for the login shell, that value will
preempt any SSH setting made here. Keep in mind that some processes may stop
diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml
index fd4646e..91a2fef 100644
--- a/Fedora/input/system/accounts/restrictions/password_expiration.xml
+++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml
@@ -77,10 +77,11 @@ age, and 7 day warning period with the following command:
<Rule id="accounts_password_minlen_login_defs" severity="medium">
<title>Password Minimum Length</title>
<description>To specify password length requirements for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the following
-lines:
-<pre>PASS_MIN_LEN 12<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre>
-<br/><br/>
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_MIN_LEN <b>LENGTH</b></pre>
+and correct it to have the form of:
+<pre>PASS_MIN_LEN <b><sub idref="var_accounts_password_minlen_login_defs" /></b></pre>
+<br />
Nowadays recommended values, considered as secure by various organizations
focused on topic of computer security, range from <tt>12 (FISMA)</tt> up to
<tt>14 (DoD)</tt> characters for password length requirements.
@@ -109,15 +110,17 @@ counterproductive behavior that may result.
<Rule id="accounts_minimum_age_login_defs" severity="medium">
<title>Password Minimum Age</title>
<description>To specify password minimum age for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the
-following line, replacing the <i>DAYS</i> item as appropriate:
-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
-A value of 1 day is considered to be sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_MIN_DAYS <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>PASS_MIN_DAYS <b><sub idref="var_accounts_minimum_age_login_defs" /></b></pre>
+<br />
+A value greater than 1 day is considered to be sufficient for many environments.
</description>
<ocil clause="it is not set to the required value">
To check the minimum password age, run the command:
<pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
-A value of 1 day is considered to be sufficient for many environments.
+A value greater than 1 day is considered to be sufficient for many environments.
</ocil>
<rationale>
Setting the minimum password age protects against users cycling
@@ -131,15 +134,17 @@ requirement.
<Rule id="accounts_maximum_age_login_defs" severity="medium">
<title>Password Maximum Age</title>
<description>To specify password maximum age for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the
-following line, replacing the <i>DAYS</i> item appropriately:
-<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
-A value of 180 days is sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_MAX_DAYS <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>PASS_MAX_DAYS <b><sub idref="var_accounts_maximum_age_login_defs" /></b></pre>
+<br />
+A value less than 180 days is sufficient for many environments.
</description>
<ocil clause="it is not set to the required value">
To check the maximum password age, run the command:
<pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
-A value of 180 days is sufficient for many environments.
+A value less than 180 days is sufficient for many environments.
</ocil>
<rationale>
Setting the password maximum age ensures users are required to
@@ -155,11 +160,12 @@ location subject to physical compromise.</rationale>
<title>Password Warning Age</title>
<description>To specify how many days prior to password
expiration that a warning will be issued to users,
-edit the file <tt>/etc/login.defs</tt> and add or correct
- the following line, replacing the <i>DAYS</i> item as appropriate:
-<pre>PASS_WARN_AGE <i>DAYS</i></pre>
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_WARN_AGE <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>PASS_WARN_AGE <b><sub idref="var_accounts_password_warn_age_login_defs" /></b></pre>
+<br />
A value of 7 days would be nowadays considered to be a standard.
-<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> -->
</description>
<ocil clause="it is not set to the required value">
To check the password warning age, run the command:
--
1.8.3.1