On 12/24/13, 11:40 AM, Shawn Wells wrote:

0001-bugfix-no_empty_passwords-missing-follow-symlinks.patch

From 8a4cc92099cf53b3f22e45c7d9287b7ba162244c Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn@redhat.com>
Date: Mon, 23 Dec 2013 08:48:05 -0500
Subject: [PATCH] [bugfix] no_empty_passwords missing --follow-symlinks

As reported by Jeb Trayer, no_empty_passwords remediation scripts was missing the
--follow-symlinks flag, breaking the symlink between system-auth and system-auth-ac.

Updating remediation script to use --follow-symlinks
---
 RHEL/6/input/fixes/bash/no_empty_passwords.sh |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/RHEL/6/input/fixes/bash/no_empty_passwords.sh b/RHEL/6/input/fixes/bash/no_empty_passwords.sh
index fca40af..6b8c187 100644
--- a/RHEL/6/input/fixes/bash/no_empty_passwords.sh
+++ b/RHEL/6/input/fixes/bash/no_empty_passwords.sh
@@ -1 +1 @@
-sed -i 's/\<nullok\>//g' /etc/pam.d/system-auth
+sed --follow-symlinks -i 's/\<nullok\>//g' /etc/pam.d/system-auth
-- 1.7.1

Pushed as bugfix:

https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=8a4cc92099cf53b3f22e45c7d9287b7ba162244c