It's my understanding that the setting in login.defs is for local system
accounts. The advantage of a separate setting for pam_cracklib is that
it will apply to remote accounts stored in LDAP, for example.
On 06/24/2013 01:26 PM, Jeffrey Blank wrote:
Yes -- please push these corrections. It should eventually get
picked
up in a STIG update, too.
Is the minlen needed here at all, or is the setting in login.defs
(discussed elsewhere in the guide) adequate?
On 06/18/2013 04:31 PM, Maura Dailey wrote:
> In addition to the changes I made (outlined just below), I noticed that there is no
rule for the minlen
> parameter for cracklib. Should I add a new rule, modeled on its neighbors?
>
> I'm open to wording corrections. I noticed that the latest draft STIG is also
incorrect with regards
> to maxrepeat (it shares identical wording).
>
> - Maura Dailey
>
> Maura Dailey (1):
> Some corrections to the PAM cracklib guidance as follows: corrected
> pam_cracklib.so line to include all discussed parameters and edited
> them to contain plausible values (ucredit was set to 0 for some reason),
> corrected maxrepeat description to match other rules (it
> incorrectly suggested that a brand new line be inserted, and
> also gave an incorrect line insertion location as it referred to
> lines that do not exist by default), and I added a suggestion to
> add cracklib line if one does not exist
>
> RHEL6/input/system/accounts/pam.xml | 11 ++++++-----
> 1 files changed, 6 insertions(+), 5 deletions(-)
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide