>From a4f67dbf25920dba03ba8ea8d98a647a336d2016 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 24 Dec 2013 02:59:26 -0500 Subject: [PATCH 03/31] Renamed password_require_specials to accounts_password_pam_cracklib_ocredit, added to shared/ - Renamed XCCDF rule to reflect granular configuration setting, vs broader requirement - Moved OVAL to shared/ - Tested on RHEL7, updated CPE --- RHEL/6/input/auxiliary/stig_overlay.xml | 2 +- .../accounts_password_pam_cracklib_ocredit.xml | 44 +-------------------- RHEL/6/input/profiles/CS2.xml | 2 +- RHEL/6/input/profiles/common.xml | 2 +- .../6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL/6/input/profiles/rht-ccp.xml | 2 +- RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +- RHEL/6/input/system/accounts/pam.xml | 2 +- .../accounts_password_pam_cracklib_ocredit.xml | 1 + RHEL/7/input/profiles/.rht-ccp.xml.swp | Bin 20480 -> 0 bytes .../accounts_password_pam_cracklib_ocredit.xml | 44 +++++++++++++++++++++ 11 files changed, 53 insertions(+), 50 deletions(-) mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml create mode 120000 RHEL/7/input/checks/accounts_password_pam_cracklib_ocredit.xml delete mode 100644 RHEL/7/input/profiles/.rht-ccp.xml.swp create mode 100644 shared/oval/accounts_password_pam_cracklib_ocredit.xml diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml index 08a0424..b2416cc 100644 --- a/RHEL/6/input/auxiliary/stig_overlay.xml +++ b/RHEL/6/input/auxiliary/stig_overlay.xml @@ -176,7 +176,7 @@ The system must require passwords to contain at least one uppercase alphabetic character. - + The system must require passwords to contain at least one special character. diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml deleted file mode 100644 index 8a3c115..0000000 --- a/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml +++ /dev/null @@ -1,43 +0,0 @@ - - - - Set Password ocredit Requirements - - Red Hat Enterprise Linux 6 - - The password ocredit should meet minimum - requirements using pam_cracklib - - - - - - - - - - - - - - 1 - - - - - - - /etc/pam.d/system-auth - ^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]ocredit=(-?\d+)(?:[\s]|$) - 1 - - diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml new file mode 120000 index 0000000..6355aa0 --- /dev/null +++ b/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml @@ -0,0 +1 @@ +../../../../shared/oval/accounts_password_pam_cracklib_ocredit.xml \ No newline at end of file diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml index 375a4cc..b615f09 100644 --- a/RHEL/6/input/profiles/CS2.xml +++ b/RHEL/6/input/profiles/CS2.xml @@ -10,7 +10,7 @@ - - - diff --git a/RHEL/6/input/profiles/rht-ccp.xml b/RHEL/6/input/profiles/rht-ccp.xml index 48d9bb3..ef14e6d 100644 --- a/RHEL/6/input/profiles/rht-ccp.xml +++ b/RHEL/6/input/profiles/rht-ccp.xml @@ -56,7 +56,7 @@ + diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml index 8432dd0..e323b38 100644 --- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml +++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml @@ -79,7 +79,7 @@ + diff --git a/RHEL/6/input/system/accounts/pam.xml b/RHEL/6/input/system/accounts/pam.xml index f7cba14..aeecc28 100644 --- a/RHEL/6/input/system/accounts/pam.xml +++ b/RHEL/6/input/system/accounts/pam.xml @@ -317,7 +317,7 @@ more difficult by ensuring a larger search space. - + Set Password Strength Minimum Special Characters The pam_cracklib module's ocredit= parameter controls requirements for usage of special (or ``other'') characters in a password. When set to a negative number, any password will be required to diff --git a/RHEL/7/input/checks/accounts_password_pam_cracklib_ocredit.xml b/RHEL/7/input/checks/accounts_password_pam_cracklib_ocredit.xml new file mode 120000 index 0000000..6355aa0 --- /dev/null +++ b/RHEL/7/input/checks/accounts_password_pam_cracklib_ocredit.xml @@ -0,0 +1 @@ +../../../../shared/oval/accounts_password_pam_cracklib_ocredit.xml \ No newline at end of file diff --git a/RHEL/7/input/profiles/.rht-ccp.xml.swp b/RHEL/7/input/profiles/.rht-ccp.xml.swp deleted file mode 100644 index 97717044d1504ade012cc16cd29c2b0745d565a9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 20480 zcmeHOON<;x8Eyy=2sW`C#Dz;|iBRHXcl;n;C#+Yj#uIxL@54L05g>(9O?S;qXM4Ij zRn@aQ5lT2AMFcqn2`(H^0Et|3;UPdEq!0-uxdb8Q01{G;0fGpKi+zBv`Z2HVneCpn zgcQ}tpU3N&|F6Hks`~5ys%smkA6s3s7Z*Nf;dR2YZhYYvTi>_8Y5i!$vSgd?1^WLF zdHLL-ew$0R5dX{N9qQ%TRk~DE_V)HFZPoEB(xKtJWKJYJ)thfcp35p*S87))ixn>j zBUK3nZ+bqH7137njuS5Icl<*lF&`TS3io!qaQ z|1=C31`Gp+0mFb{z%XDKFbo(5-k%Jp@HXoibnSy__Z~{$KQQ+Gq4ejEr|%cXKEEyf z`BM6RdF=D_NAqSFFbo(53GHFkl!k3>XFs1BL;^!2f{(>RQ$d5dSY|0gvbZ zng0LvotEVT$AEV~VOcK&PXPAP zuK~{k*8v}R0C?xami1Gh2Yep*4-PMW0_+0!0Dnebb$`DFJO_Bd1>h!lcm?PJ_XB^y zA;=Gb9{|q*+rR}Nel1DnGe_B;D_Ha5TqK#`djS(fwx@hVUA{;3t%f-}v1jhZIVB=C zS6Q|mS-o1bH)~sKtM&To#=2d-QmZ~%x2!RLf;|~|f)VKjEuZOz35`@c&*PY-WQv4T z$~`Vz(x$Qv4}|(Hjw=}L4)MK)_U7=Qc?+EJmKV6JDUa?-_M~E+f_-#Z&>M7;Dp-c9 zNDzHuGJajJ*>u`e%w+8IJupcn%dE$Sf;tY50wo8bhBW@lQh_gah$E=8i}50nBbe){ z0wm|PIONE^RgMHxqBm1KdsGC3wixmC+#v-gPrqLsFYr21=LjD9Qvj}f7R(q&zzHrh z5w`EJP?4vQ7YeWeBfTJ*Bs@|QccG9+bh0RBs^|D%)@M^r4JVheX@&OCn(rr6H#zcF zvdYqVS)koM@qOBa&PGThoe2~2?)iCprCQzCS>LwTR@PT8*VbzIXOida`T6Aoxh}*s z*E51@M!Y~O>if*i3+{j^3uJ^W*$P`un>o8AU|nQN*ORm{!NnLw;|^LrZ=m@ep^oyp z6zt~3G3F$@;D&Xs5QijDNE9b7%nMkjAz+EOsnT89WxeS%ENPB+HZQGgudZJnVb+R2 z5*YMFyCL{4d)Ph@tM3KTK6V5ji?8cBEWUq7eA>WXm)F~P%qDmVx$ikW)eDPs6q{k( zGzNGAF}h#Vf@gsqSCTnuaISn#T_$p9PQun6>$R(^>pNc@A!@8YAr;C~9uJ6KCAh+< z(*kzfVp%uWIwz#@P5yvgX&coEb8U3Db)`}NQhmF&HrjKPGG4&uyVQ?ZR@o#OqCo>) z+$gr+-)p$gWlzg#=uAx`U+EfVDbIx_t)DI8f+gxuxtoQj9i3iWoNC_BF>OyOE_wvp z3~rf@CL8VO!D4PgI=uIJO+FIMxfz`JqZ_D>Ru{|~%~(~S-JF@BQzJEj zb~2sd{#@yg`jpZ@yPH0D`tGJz2!}iBhtr|RlC6GX)0PjNp2|xWg?B&^oqwe%oCM}qxMzNJdy$6CtlJc!8j zlKh;FTk?UtIM-Gxe7I7HYabsuQ!WJfd!faq5EF~Lf|ZL6T1I*!1KT+a1!_<^#6B&$AQlR|A7AgIq)^$8Gr-l zfdAqQ;8(!YKoz(hcn$jh8^Ahn0=N^ni8FxLf$sv31NQ*$Li_&~&}RW(0qzHGK=Z!> zd>e3pQ^3EW`+o^M4OD?UfImR{zX|*d=m9IhG2ks|{}+Kaa3An@aPcxAfB?|kGywCO ziGig`I!~7^UE+_GS8+bmvVn#n)(vxsk?j!m>?frhg-_3zshKKIdkMrJ6qWnp&pk;gg}~_Q@+_$X)jd-k8ZWP@xuxvxJLNGTxLkS*n?0 zr43QeFq?<8OWR)F=#C|b?E9*z@&!$DkebPr2XGo_dxV4w_J&Lg4bH%FANo`k z8J>*m$p$Oy+pE`hR<>)Ga15~Z*ecSXJuLuj_sF2vc8m^9@K11OEhs_1z=y=E_5YWl-CqQ> z{)aq|U#~**e;rr_P5`e$^Y?%UfPdk;?*V_x>{1)^W*9IG7zPXjh5^HXVZbn87%&VN t1`Gp7VPH(&4;1Ag%Ff&-&cEgSzPL?1?P_QLhDmmjS%%E + + + Set Password ocredit Requirements + + Red Hat Enterprise Linux 6 + Red Hat Enterprise Linux 7 + + The password ocredit should meet minimum + requirements using pam_cracklib + + + + + + + + + + + + + + 1 + + + + + + + /etc/pam.d/system-auth + ^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]ocredit=(-?\d+)(?:[\s]|$) + 1 + + -- 1.8.3.1