>From 122b80eb706eab502c80b2d675618c845d4e2348 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 28 Sep 2013 16:41:37 -0400 Subject: [PATCH 6/8] OVAL signoff: accounts_password_pam_cracklib_retry - filepath update - XCCDF naming update - Fixed variable name in USGCB profile Testing: [shawn@SSG-RHEL6 checks]$ grep retry /etc/pam.d/system-auth password requisite pam_cracklib.so try_first_pass retry=2 type= [shawn@SSG-RHEL6 checks]$ ./testcheck.py accounts_password_pam_cracklib_retry.xml external_variable with id : var_password_pam_cracklib_retry Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_retrycWn8LP.xml Writing results to : /tmp/accounts_password_pam_cracklib_retrycWn8LP.xml-results Definition oval:scap-security-guide.testing:def:275: true Evaluation done. [shawn@SSG-RHEL6 checks]$ sudo sed -i 's/retry=2/retry=3/g' /etc/pam.d/system-auth ; \ > ./testcheck.py accounts_password_pam_cracklib_retry.xml external_variable with id : var_password_pam_cracklib_retry Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_retry27xCkF.xml Writing results to : /tmp/accounts_password_pam_cracklib_retry27xCkF.xml-results Definition oval:scap-security-guide.testing:def:275: true Evaluation done. [shawn@SSG-RHEL6 checks]$ sudo sed -i 's/retry=3/retry=5/g' /etc/pam.d/system-auth ; ./testcheck.py accounts_password_pam_cracklib_retry.xml external_variable with id : var_password_pam_cracklib_retry Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_retryq5rSPT.xml Writing results to : /tmp/accounts_password_pam_cracklib_retryq5rSPT.xml-results Definition oval:scap-security-guide.testing:def:275: false Evaluation done. --- .../accounts_password_pam_cracklib_retry.xml | 4 ++-- RHEL6/input/profiles/CS2.xml | 2 +- RHEL6/input/profiles/common.xml | 2 +- RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL6/input/profiles/usgcb-rhel6-server.xml | 4 ++-- RHEL6/input/system/accounts/pam.xml | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml b/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml index 5f51a27..175b55c 100644 --- a/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml +++ b/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml @@ -7,6 +7,7 @@ The password retry should meet minimum requirements using pam_cracklib + - /etc/pam.d - system-auth + /etc/pam.d/system-auth ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*retry=([0-9]*).*$ 1 diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml index dfcdf53..0099b0a 100644 --- a/RHEL6/input/profiles/CS2.xml +++ b/RHEL6/input/profiles/CS2.xml @@ -18,7 +18,7 @@ + diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml index e6e345f..19cd181 100644 --- a/RHEL6/input/profiles/common.xml +++ b/RHEL6/input/profiles/common.xml @@ -51,7 +51,7 @@ + diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml index 80a69e0..6e6d7bd 100644 --- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml +++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml @@ -276,7 +276,7 @@ + diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml index 88eeca3..d96e4f2 100644 --- a/RHEL6/input/profiles/usgcb-rhel6-server.xml +++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml @@ -72,8 +72,8 @@ - -