Maura - Thanks for that comprehensive reply. Yes that makes sense.
Rob - You could indeed be correct there.
Cheers,
Stu
On 21/08/2013 16:31, Robert Sanders wrote:
I thought the values in login.defs are used at account creation, at
least in regard to the min/max/warn/expire values. Once the account is created the
min/max/warn/expire/invalid fields of the users entry in /etc/shadow would be effective,
but those values had to originate somewhere. Just editing /etc/login.defs shouldn't
impact existing accounts.
-Rob
From: scap-security-guide-bounces(a)lists.fedorahosted.org
[scap-security-guide-bounces(a)lists.fedorahosted.org] on behalf of Maura Dailey
[maura(a)eclipse.ncsc.mil]
Sent: Wednesday, August 21, 2013 11:21 AM
To: scap-security-guide(a)lists.fedorahosted.org
Subject: Re: False Pass: PASS_MIN_DAYS /etc/login.defs
High numbers for PASS_MIN_DAYS are to prevent password cycling for a
longer period, so the interpretation in this check is that higher values
than the profile calls for should be fine. (The STIG wants a value of 1,
but the common profiles want a value of 7, so it seems that there isn't
a clear consensus on what is the best value to deter password cycling.)
A value of 100 is obviously ridiculous, but the OVAL check (which isn't
configured to handle ranges) is written correctly *under the assumption*
that system administrators can choose higher values in an effort to curb
their users' bad behavior. If the assumption should be something
different, it's a simple 2 second fix to make the check only accept
exact values.
As for whether it should still exist at all, I think it should, in case
something dodgy happens and something is bypassing PAM. Obviously, other
people can chime in here.
- Maura Dailey
On 08/21/2013 10:55 AM, Stuart Green wrote:
> Just happened across this while I was modding an incorrect parameter.
>
> Rule password_min_age: PASS_MIN_DAYS in /etc/login.defs seems to pass
> regardless of the number being higher than 1. Mine was set to 7 and
> was passing, so I set it to 100 for another run through and it still
> passed.
>
> Note: I'm not sure if these login.defs are actually necessary, well
> not in a PAM environment. When PAM's handling the restrictions
> login.defs is not involved.
> Citation:
http://www.linuxmanpages.com/man5/login.defs.5.php (bug
> section)
>
> Cheers,
> Stu
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide