Nice catch, thanks.
ACK. Please push.
On 06/06/2012 01:04 AM, Joe Nall wrote:
Sorry about the lack of context. There is no "=" in
login.defs statements. The check is already correct.
joe
On Jun 6, 2012, at 12:03 AM, Joe Nall wrote:
> ---
> .../accounts/restrictions/password_expiration.xml | 6 +++---
> 1 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/rhel6/src/input/system/accounts/restrictions/password_expiration.xml
b/rhel6/src/input/system/accounts/restrictions/password_expiration.xml
> index 43179a4..9349fec 100644
> --- a/rhel6/src/input/system/accounts/restrictions/password_expiration.xml
> +++ b/rhel6/src/input/system/accounts/restrictions/password_expiration.xml
> @@ -80,7 +80,7 @@ age, and 7 day warning period with the following command:
> <description>To specify password length requirements for new accounts,
> edit the file <tt>/etc/login.defs</tt> and add or correct the following
> lines:
> -<pre>PASS_MIN_LEN=12<!-- <sub idref="var_password_min_len">
--></pre>
> +<pre>PASS_MIN_LEN 12<!-- <sub idref="var_password_min_len">
--></pre>
> TODO: More research needed to understand exact interaction: when precisely is this
file consulted?
> <br/><br/>
> If a program consults <tt>/etc/login.defs</tt> and also another PAM
module
> @@ -107,7 +107,7 @@ behavior that may result.
> <description>To specify password minimum age for new accounts,
> edit the file <tt>/etc/login.defs</tt>
> and add or correct the following line, replacing <i>DAYS</i>
appropriately:
> -<pre>PASS_MIN_DAYS=<i>DAYS</i></pre>
> +<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
> A value of 7 days is considered for sufficient for many
> environments.
> </description>
> @@ -147,7 +147,7 @@ the utility of a stolen password.</rationale>
> expiration that a warning will be issued to users,
> edit the file <tt>/etc/login.defs</tt> and add or correct
> the following line:
> -<pre>PASS_WARN_AGE=<i>DAYS</i></pre>
> +<pre>PASS_WARN_AGE <i>DAYS</i></pre>
> A value of 7 days is considered for appropriate for many
> environments.
> <!-- <sub idref="password_warn_age_login_defs_value" /> -->
> --
> 1.7.1
>
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/scap-security-guide