On 10/15/2013 08:01 PM, Shawn Wells wrote:
On 10/15/13 4:28 PM, Maura Dailey wrote:
> The alternative, by the way, is to delete the check entirely, if no
> profiles reference it.
>
> On 10/15/2013 04:05 PM, Maura Dailey wrote:
>> Somewhat confusingly, the name of the check for pam_cracklib's
>> minclass option was accounts_password_minclass_login_defs.xml. I
>> corrected it and the id of the check inside the file.
>>
>> - Maura Dailey
>>
>> Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
>> ---
>> .../accounts_password_pam_cracklib_minclass.xml | 43
>> ++++++++++++++++++++
>> 1 files changed, 43 insertions(+), 0 deletions(-)
>> create mode 100644
>> RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>>
>> diff --git
>> a/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>> b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>> new file mode 100644
>> index 0000000..539164b
>> --- /dev/null
>> +++ b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>> @@ -0,0 +1,43 @@
>> +<def-group>
>> + <definition class="compliance"
>> id="accounts_password_pam_cracklib_minclass" version="1">
>> + <metadata>
>> + <title>Set Password minclass Requirements</title>
>> + <affected family="unix">
>> + <platform>Red Hat Enterprise Linux 6</platform>
>> + </affected>
>> + <description>The password minclass should meet minimum
>> + requirements using pam_cracklib</description>
>> + </metadata>
>> + <criteria>
>> + <criterion comment="Conditions for minclass are satisfied"
>> + test_ref="test_password_pam_cracklib_minclass" />
>> + </criteria>
>> + </definition>
>> +
>> + <ind:textfilecontent54_test check="all"
>> + comment="check the configuration of
>> /etc/pam.d/system-auth"
>> + id="test_password_pam_cracklib_minclass" version="1">
>> + <ind:object object_ref="obj_password_pam_cracklib_minclass"
/>
>> + <ind:state state_ref="state_password_pam_cracklib_minclass"
/>
>> + </ind:textfilecontent54_test>
>> +
>> + <ind:textfilecontent54_state
>> id="state_password_pam_cracklib_minclass"
>> + version="1">
>> + <ind:instance datatype="int">1</ind:instance>
>> + <ind:subexpression datatype="int"
>> + operation="less than or equal"
>> + var_ref="var_password_pam_cracklib_minclass" />
>> + </ind:textfilecontent54_state>
>> +
>> + <external_variable comment="External variable for pam_cracklib
>> minclass"
>> + datatype="int"
>> id="var_password_pam_cracklib_minclass"
>> + version="1" />
>> +
>> + <ind:textfilecontent54_object
>> id="obj_password_pam_cracklib_minclass"
>> + version="1">
>> + <ind:path>/etc/pam.d</ind:path>
>> + <ind:filename>system-auth</ind:filename>
>> + <ind:pattern operation="pattern
>>
match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minclass=(-?\d+)(?:[\s]|$)</ind:pattern>
>> + <ind:instance datatype="int" operation="less than or
>> equal">1</ind:instance>
>> + </ind:textfilecontent54_object>
>> +</def-group>
Between the accounts_password_pam_cracklib_{dcredit ucredit ocredit
lcredit} checks I'm unsure if this is even needed (as further evident
by no profile calling the check)...
ack to the rename, though
I guess I'll push the rename for now. I found it because make validate
complains about it (since it's not referenced anywhere in the XCCDF).
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide