On 3/24/14, 10:07 AM, Jan Lieskovsky wrote:
Thank you for the review, Shawn.

----- Original Message -----
> From: "Shawn Wells" <shawn@redhat.com>
> To: scap-security-guide@lists.fedorahosted.org
> Sent: Friday, March 21, 2014 11:45:23 PM
> Subject: Re: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules	description
> 
> On 3/21/14, 10:31 AM, Jan Lieskovsky wrote:
> 
> 
> 
> Based on xccdf:sub elements thread:
> https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-March/005104.html
> switch on OVAL variables evaluation for Fedora content in XCCDF rules
> description.
> 
> Together with that change, indent content of <pre> elements with one heading
> tab character.
> 
> Tested on Fedora (both make & make validate seems to be working properly).
> 
> Please review.
> 
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
> 
> When we originally started authoring content, some 2 years ago, the XCCDF
> variable inclusion was not working (hence the comments scattered around).
> Applied your patch locally - everything looks great! Note a few whitespace
> errors, however this could be how I downloaded:
> 
> $ git apply /tmp/j1.patch
> /tmp/j1.patch:104: trailing whitespace.
> <tt>ClientAliveCountMax</tt> is set, edit the <tt>/etc/ssh/sshd_config</tt>
> warning: 1 line adds whitespace errors.
You are truly right, there was one whitespace noise case (didn't actually
try to apply the patch. Sorry for that -- second version shouldn't have it already).

> 
> Unclear on the purpose of the tabs though. For example:
> 
> 
> 
> -<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
> -A value of 1 day is considered to be sufficient for many environments.
> +edit the file <tt>/etc/login.defs</tt>, locate the following line:
> +<pre>	PASS_MIN_DAYS	<b>DAYS</b></pre>
> +and correct it to have the form of:
> +<pre>	PASS_MIN_DAYS	<b><sub idref="var_accounts_minimum_age_login_defs"
> /></b></pre>
> +A value greater than 1 day is considered to be sufficient for many
> environments.
> 
> In this case it gives the user the impression these values should be prefaced
> with a tab. While technically acceptable, in /etc/login.defs everything is
> defined starting as the first character. Is there a reason for the tab?
The intention was to prefix the particular row in HTML form of the guide with
a tab character to separate HTML text from command line syntax (IOW so the
command-line input would be differentiated not just by <pre> element, but also
intended from left by one tab).

But agree with you this might bring more confusion than the desired effect actually
(didn't look at this the way you did) thus removed the tabs from the attached second version.

Please review [*].

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

[*] make / make validate & basic testing passed.

Ack.



> --
> Shawn Wells
> Director, Innovation Programs shawn@redhat.com | 443.534.0130
> @shawndwells

0001-Fedora-Switch-on-OVAL-variables-evaluation-in-rules-.patch

From 2ec99f4a2840209f8a9ef834b6d67d7ccd142b07 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Mon, 24 Mar 2014 14:31:26 +0100
Subject: [PATCH] [Fedora] Switch on OVAL variables evaluation in rules
 description

Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
 Fedora/input/services/ssh.xml                      |  8 +++--
 .../accounts/restrictions/password_expiration.xml  | 42 ++++++++++++----------
 2 files changed, 29 insertions(+), 21 deletions(-)

diff --git a/Fedora/input/services/ssh.xml b/Fedora/input/services/ssh.xml
index ce289b1..0489b4b 100644
--- a/Fedora/input/services/ssh.xml
+++ b/Fedora/input/services/ssh.xml
@@ -64,11 +64,13 @@ misconfiguration elsewhere.
 <description>SSH allows administrators to set an idle timeout interval.
 After this interval has passed, the idle user will be automatically logged out.
 <br /><br />
-To set an idle timeout interval, edit the following line in
-<tt>/etc/ssh/sshd_config</tt> as follows:
+To set an idle timeout interval, edit the <tt>/etc/ssh/sshd_config</tt> file,
+locate the following line:
 <pre>ClientAliveInterval <b>INTERVAL</b></pre>
+and correct it to have the form of:
+<pre>ClientAliveInterval <b><sub idref="sshd_idle_timeout_value" /></b></pre>
 The timeout <b>INTERVAL</b> is given in seconds. To have a timeout of 15
-minutes, set <b>interval</b> to 900.
+minutes, set <b>INTERVAL</b> to 900.
 <br /><br />
 If a shorter timeout has already been set for the login shell, that value will
 preempt any SSH setting made here. Keep in mind that some processes may stop
diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml
index fd4646e..91a2fef 100644
--- a/Fedora/input/system/accounts/restrictions/password_expiration.xml
+++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml
@@ -77,10 +77,11 @@ age, and 7 day warning period with the following command:
 <Rule id="accounts_password_minlen_login_defs" severity="medium">
 <title>Password Minimum Length</title>
 <description>To specify password length requirements for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the following
-lines:
-<pre>PASS_MIN_LEN 12<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre>
-<br/><br/>
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_MIN_LEN <b>LENGTH</b></pre>
+and correct it to have the form of:
+<pre>PASS_MIN_LEN <b><sub idref="var_accounts_password_minlen_login_defs" /></b></pre>
+<br />
 Nowadays recommended values, considered as secure by various organizations
 focused on topic of computer security, range from <tt>12 (FISMA)</tt> up to
 <tt>14 (DoD)</tt> characters for password length requirements.
@@ -109,15 +110,17 @@ counterproductive behavior that may result.
 <Rule id="accounts_minimum_age_login_defs" severity="medium">
 <title>Password Minimum Age</title>
 <description>To specify password minimum age for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the
-following line, replacing the <i>DAYS</i> item as appropriate:
-<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
-A value of 1 day is considered to be sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_MIN_DAYS <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>PASS_MIN_DAYS <b><sub idref="var_accounts_minimum_age_login_defs" /></b></pre>
+<br />
+A value greater than 1 day is considered to be sufficient for many environments.
 </description>
 <ocil clause="it is not set to the required value">
 To check the minimum password age, run the command:
 <pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
-A value of 1 day is considered to be sufficient for many environments.
+A value greater than 1 day is considered to be sufficient for many environments.
 </ocil>
 <rationale>
 Setting the minimum password age protects against users cycling
@@ -131,15 +134,17 @@ requirement.
 <Rule id="accounts_maximum_age_login_defs" severity="medium">
 <title>Password Maximum Age</title>
 <description>To specify password maximum age for new accounts,
-edit the file <tt>/etc/login.defs</tt> and add or correct the
-following line, replacing the <i>DAYS</i> item appropriately:
-<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
-A value of 180 days is sufficient for many environments.
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_MAX_DAYS <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>PASS_MAX_DAYS <b><sub idref="var_accounts_maximum_age_login_defs" /></b></pre>
+<br />
+A value less than 180 days is sufficient for many environments.
 </description>
 <ocil clause="it is not set to the required value">
 To check the maximum password age, run the command:
 <pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
-A value of 180 days is sufficient for many environments.
+A value less than 180 days is sufficient for many environments.
 </ocil>
 <rationale>
 Setting the password maximum age ensures users are required to
@@ -155,11 +160,12 @@ location subject to physical compromise.</rationale>
 <title>Password Warning Age</title>
 <description>To specify how many days prior to password
 expiration that a warning will be issued to users,
-edit the file <tt>/etc/login.defs</tt> and add or correct
- the following line, replacing the <i>DAYS</i> item as appropriate:
-<pre>PASS_WARN_AGE <i>DAYS</i></pre>
+edit the file <tt>/etc/login.defs</tt>, locate the following line:
+<pre>PASS_WARN_AGE <b>DAYS</b></pre>
+and correct it to have the form of:
+<pre>PASS_WARN_AGE <b><sub idref="var_accounts_password_warn_age_login_defs" /></b></pre>
+<br />
 A value of 7 days would be nowadays considered to be a standard.
-<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> -->
 </description>
 <ocil clause="it is not set to the required value">
 To check the password warning age, run the command:
-- 1.8.3.1


-- 
Shawn Wells
Director, Innovation Programs
shawn@redhat.com | 443.534.0130
@shawndwells