This patch converts (and includes) four existing rules from RHEL6 'Set Password Expiration Parameters' section to (into) Fedora.
Testing: * all tests of make fedora-tarball, fedora-srpm, fedora-rpm have passed, * all tests within Fedora of 'make / make validate / make validate-xml / make checks / make guide / make content / make eval-common' have passed with the proposal.
Please review.
Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
On 10/10/13 12:45 PM, Jan Lieskovsky wrote:
This patch converts (and includes) four existing rules from RHEL6 'Set Password Expiration Parameters' section to (into) Fedora.
Testing:
- all tests of make fedora-tarball, fedora-srpm, fedora-rpm have passed,
- all tests within Fedora of 'make / make validate / make validate-xml / make checks / make guide / make content / make eval-common' have passed with the proposal.
Please review.
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
0001-Fedora-Convert-four-RHEL6-rules-from-Set-Password-Ex.patch
From 5e5dbb929fe8376f72d71f526f5e02e4ed4a841d Mon Sep 17 00:00:00 2001 From: Jan Lieskovskyjlieskov@redhat.com Date: Thu, 10 Oct 2013 18:39:11 +0200 Subject: [PATCH] [Fedora] Convert four RHEL6 rules from 'Set Password Expiration Parameters' section to Fedora
Signed-off-by: Jan Lieskovskyjlieskov@redhat.com
.../checks/accounts_maximum_age_login_defs.xml | 32 ++++ .../checks/accounts_minimum_age_login_defs.xml | 34 ++++ .../checks/accounts_password_minlen_login_defs.xml | 33 ++++ .../accounts_password_warn_age_login_defs.xml | 35 ++++ Fedora/input/guide.xml | 2 +- Fedora/input/guide.xslt | 1 + Fedora/input/profiles/common.xml | 4 + .../accounts/restrictions/password_expiration.xml | 177 +++++++++++++++++++++ Fedora/scap-security-guide.spec | 5 +- 9 files changed, 321 insertions(+), 2 deletions(-) create mode 100644 Fedora/input/checks/accounts_maximum_age_login_defs.xml create mode 100644 Fedora/input/checks/accounts_minimum_age_login_defs.xml create mode 100644 Fedora/input/checks/accounts_password_minlen_login_defs.xml create mode 100644 Fedora/input/checks/accounts_password_warn_age_login_defs.xml create mode 100644 Fedora/input/system/accounts/restrictions/password_expiration.xml
diff --git a/Fedora/input/checks/accounts_maximum_age_login_defs.xml b/Fedora/input/checks/accounts_maximum_age_login_defs.xml new file mode 100644 index 0000000..5e96118 --- /dev/null +++ b/Fedora/input/checks/accounts_maximum_age_login_defs.xml @@ -0,0 +1,32 @@ +<def-group>
<definition class="compliance" id="accounts_maximum_age_login_defs" version="1">
<metadata>
<title>Set Password Expiration Parameters</title>
<affected family="unix">
<platform>Fedora 19</platform>
</affected>
<description>The maximum password age policy should meet minimum requirements.</description>
</metadata>
<criteria comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
<criterion test_ref="test_pass_max_days" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs" id="test_pass_max_days" version="1">
- <ind:object object_ref="object_etc_login_defs_pass_max" />
- <ind:state state_ref="state_accounts_maximum_age_login_defs" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_etc_login_defs_pass_max" version="1">
- ind:filepath/etc/login.defs</ind:filepath>
- <ind:pattern operation="pattern match">^[\s]*PASS_MAX_DAYS[\s]+(\d+)\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_state id="state_accounts_maximum_age_login_defs" version="1">
- <ind:subexpression operation="less than or equal" var_ref="var_accounts_maximum_age_login_defs" datatype="int" />
- </ind:textfilecontent54_state>
<external_variable comment="maximum password age" datatype="int" id="var_accounts_maximum_age_login_defs" version="1" />
+</def-group> diff --git a/Fedora/input/checks/accounts_minimum_age_login_defs.xml b/Fedora/input/checks/accounts_minimum_age_login_defs.xml new file mode 100644 index 0000000..87917e0 --- /dev/null +++ b/Fedora/input/checks/accounts_minimum_age_login_defs.xml @@ -0,0 +1,34 @@ +<def-group>
<definition class="compliance" id="accounts_minimum_age_login_defs" version="1">
<metadata>
<title>Set Password Expiration Parameters</title>
<affected family="unix">
<platform>Fedora 19</platform>
</affected>
<description>The minimum password age policy should be set appropriately.</description>
</metadata>
<criteria comment="the value PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
<criterion test_ref="test_pass_min_days" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all"
- comment="Tests the value of PASS_MIN_DAYS in /etc/login.defs"
- id="test_pass_min_days" version="1">
- <ind:object object_ref="object_etc_login_defs_pass_min_age" />
- <ind:state state_ref="state_etc_login_defs_pass_min_age" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_etc_login_defs_pass_min_age" version="1">
- ind:filepath/etc/login.defs</ind:filepath>
- <ind:pattern operation="pattern match">^[\s]*PASS_MIN_DAYS[\s]+(\d+)\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_state id="state_etc_login_defs_pass_min_age" version="1">
- <ind:subexpression operation="greater than or equal" var_ref="var_accounts_minimum_age_login_defs" datatype="int" />
- </ind:textfilecontent54_state>
<external_variable comment="minimum password age in days" datatype="int" id="var_accounts_minimum_age_login_defs" version="1" />
+</def-group> diff --git a/Fedora/input/checks/accounts_password_minlen_login_defs.xml b/Fedora/input/checks/accounts_password_minlen_login_defs.xml new file mode 100644 index 0000000..e3ce130 --- /dev/null +++ b/Fedora/input/checks/accounts_password_minlen_login_defs.xml @@ -0,0 +1,33 @@ +<def-group>
<definition class="compliance" id="accounts_password_minlen_login_defs" version="1">
<metadata>
<title>Set Password Expiration Parameters</title>
<affected family="unix">
<platform>Fedora 19</platform>
</affected>
<description>The password minimum length should be set appropriately.</description>
</metadata>
<criteria operator="AND">
<criterion test_ref="test_etc_login_defs" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" comment="check PASS_MIN_LEN in /etc/login.defs" id="test_etc_login_defs" version="1">
- <ind:object object_ref="object_etc_login_defs" />
- <ind:state state_ref="state_accounts_password_minlen_login_defs" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_etc_login_defs" version="1">
- ind:filepath/etc/login.defs</ind:filepath>
- <ind:pattern operation="pattern match">^PASS_MIN_LEN\s+(\d+)\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_state id="state_accounts_password_minlen_login_defs" version="1">
- <ind:subexpression operation="greater than or equal" var_ref="var_accounts_password_minlen_login_defs" datatype="int" />
- </ind:textfilecontent54_state>
<external_variable comment="password minimum length" datatype="int" id="var_accounts_password_minlen_login_defs" version="1" />
+</def-group> diff --git a/Fedora/input/checks/accounts_password_warn_age_login_defs.xml b/Fedora/input/checks/accounts_password_warn_age_login_defs.xml new file mode 100644 index 0000000..5230af1 --- /dev/null +++ b/Fedora/input/checks/accounts_password_warn_age_login_defs.xml @@ -0,0 +1,35 @@ +<def-group>
<definition class="compliance" id="accounts_password_warn_age_login_defs" version="1">
<metadata>
<title>Set Password Expiration Parameters</title>
<affected family="unix">
<platform>Fedora 19</platform>
</affected>
<description>The password expiration warning age should be set appropriately.</description>
</metadata>
<criteria>
<criterion test_ref="test_pass_warn_age" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all"
- comment="Tests the value of PASS_WARN_AGE in /etc/login.defs"
- id="test_pass_warn_age" version="1">
- <ind:object object_ref="object_etc_login_defs_pass_warn_age" />
- <ind:state state_ref="state_etc_login_defs_pass_warn_age" />
- </ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_etc_login_defs_pass_warn_age"
- version="1">
- ind:filepath/etc/login.defs</ind:filepath>
- <ind:pattern operation="pattern match">^[\s]*PASS_WARN_AGE[\s]*(\d+)\s*$</ind:pattern>
- <ind:instance datatype="int">1</ind:instance>
- </ind:textfilecontent54_object>
- <ind:textfilecontent54_state id="state_etc_login_defs_pass_warn_age" version="1">
- <ind:subexpression operation="greater than or equal" var_ref="var_accounts_password_warn_age_login_defs" datatype="int" />
- </ind:textfilecontent54_state>
<external_variable comment="password expiration warning age in days" datatype="int" id="var_accounts_password_warn_age_login_defs" version="1" />
+</def-group> diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml index c76b795..6e276b1 100644 --- a/Fedora/input/guide.xml +++ b/Fedora/input/guide.xml @@ -36,5 +36,5 @@ trademarks or trademarks of Red Hat, Inc. in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies.</rear-matter>
<platform idref="cpe:/o:fedoraproject:fedora:19" /> -<version>0.0.1</version> +<version>0.0.2</version> </Benchmark> diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt index 8bdf86e..559042e 100644 --- a/Fedora/input/guide.xslt +++ b/Fedora/input/guide.xslt @@ -46,6 +46,7 @@ <xsl:copy> <xsl:copy-of select="@*|node()" /> <xsl:apply-templates select="document('system/accounts/restrictions/password_storage.xml')" /> + <xsl:apply-templates select="document('system/accounts/restrictions/password_expiration.xml')" /> </xsl:copy> </xsl:template>
diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/common.xml index 2739a33..83e3478 100644 --- a/Fedora/input/profiles/common.xml +++ b/Fedora/input/profiles/common.xml @@ -8,5 +8,9 @@
<select idref="no_hashes_outside_shadow" selected="true"/> <select idref="gid_passwd_group_same" selected="true"/> <select idref="no_netrc_files" selected="true"/> +<select idref="accounts_password_minlen_login_defs" selected="true"/> +<select idref="accounts_minimum_age_login_defs" selected="true"/> +<select idref="accounts_maximum_age_login_defs" selected="true"/> +<select idref="accounts_password_warn_age_login_defs" selected="true"/>
</Profile> diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml new file mode 100644 index 0000000..73d48c6 --- /dev/null +++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml @@ -0,0 +1,177 @@ +<Group id="password_expiration"> +<title>Set Password Expiration Parameters</title> +<description>The file <tt>/etc/login.defs</tt> controls several +password-related settings. Programs such as <tt>passwd</tt>, +<tt>su</tt>, and <tt>login</tt> consult <tt>/etc/login.defs</tt> to determine +behavior with regard to password aging, expiration warnings, +and length. See the man page <tt>login.defs(5)</tt> for more information. +<br/><br/> +Users should be forced to change their passwords, in order to +decrease the utility of compromised passwords. However, the need to +change passwords often should be balanced against the risk that +users will reuse or write down passwords if forced to change them +too often. Forcing password changes every 90-360 days, depending on +the environment, is recommended. Set the appropriate value as +<tt>PASS_MAX_DAYS</tt> and apply it to existing accounts with the +<tt>-M</tt> flag. +<br /><br /> +The <tt>PASS_MIN_DAYS</tt> (<tt>-m</tt>) setting prevents password +changes for 7 days after the first change, to discourage password +cycling. If you use this setting, train users to contact an administrator +for an emergency password change in case a new password becomes +compromised. The <tt>PASS_WARN_AGE</tt> (<tt>-W</tt>) setting gives +users 7 days of warnings at login time that their passwords are about to expire. +<br /><br /> +For example, for each existing human user <i>USER</i>, expiration parameters +could be adjusted to a 180 day maximum password age, 7 day minimum password +age, and 7 day warning period with the following command: +<pre># chage -M 180 -m 7 -W 7 USER</pre> +</description> + +<Value id="var_accounts_password_minlen_login_defs" type="number" > +<title>minimum password length</title> +<description>Minimum number of characters in password</description> +<warning category="general">This will only check new passwords</warning> +<value selector="">12</value> +<value selector="6">6</value> +<!-- NIST 800-53 requires 1 in a million using brute force which translates to six numbers --> +<value selector="8">8</value> +<value selector="10">10</value> +<value selector="12">12</value> +<value selector="14">14</value> +</Value> + +<Value id="var_accounts_maximum_age_login_defs" type="number" > +<title>maximum password age</title> +<description>Maximum age of password in days</description> +<warning category="general">This will only apply to newly created accounts</warning> +<value selector="">60</value> +<value selector="60">60</value> +<value selector="90">90</value> +<value selector="120">120</value> +<value selector="180">180</value> +</Value> + +<Value id="var_accounts_minimum_age_login_defs" type="number" > +<title>minimum password age</title> +<description>Minimum age of password in days</description> +<warning category="general">This will only apply to newly created accounts</warning> +<value selector="">7</value> +<value selector="7">7</value> +<value selector="5">5</value> +<value selector="1">1</value> +<value selector="2">2</value> +<value selector="0">0</value> +</Value> + +<Value id="var_accounts_password_warn_age_login_defs" type="number" > +<title>warning days before password expires</title> +<description>The number of days' warning given before a password expires.</description> +<warning category="general">This will only apply to newly created accounts</warning> +<value selector="">7</value> +<value selector="0">0</value> +<value selector="7">7</value> +<value selector="14">14</value> +</Value> + +<Rule id="accounts_password_minlen_login_defs" severity="medium"> +<title>Set Password Minimum Length in login.defs</title> +<description>To specify password length requirements for new accounts, +edit the file <tt>/etc/login.defs</tt> and add or correct the following +lines: +<pre>PASS_MIN_LEN 12<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre> +<br/><br/> +Nowadays recommended values, considered as secure by various organizations +focused on topic of computer security, range from <tt>12 (FISMA)</tt> up to +<tt>14 (DoD)</tt> characters for password length requirements. +If a program consults <tt>/etc/login.defs</tt> and also another PAM module +(such as <tt>pam_cracklib</tt>) during a password change operation, +then the most restrictive must be satisfied. See PAM section +for more information about enforcing password quality requirements. +</description> +<ocil clause="it is not set to the required value"> +To check the minimum password length, run the command: +<pre>$ grep PASS_MIN_LEN /etc/login.defs</pre> +Passwords of length <tt>12</tt> characters and more are nowadays +considered to be a standard requirement. +</ocil> +<rationale> +Requiring a minimum password length makes password +cracking attacks more difficult by ensuring a larger +search space. However, any security benefit from an onerous requirement +must be carefully weighed against usability problems, support costs, or +counterproductive behavior that may result. +</rationale> +<oval id="accounts_password_minlen_login_defs" value="var_accounts_password_minlen_login_defs"/> +<ref nist="IA-5(f),IA-5(1)(a)" disa="205"/> +</Rule> + +<Rule id="accounts_minimum_age_login_defs" severity="medium"> +<title>Set Password Minimum Age</title> +<description>To specify password minimum age for new accounts, +edit the file <tt>/etc/login.defs</tt> and add or correct the +following line, replacing the <i>DAYS</i> item as appropriate: +<pre>PASS_MIN_DAYS <i>DAYS</i></pre> +A value of 1 day is considered to be sufficient for many environments. +</description> +<ocil clause="it is not set to the required value"> +To check the minimum password age, run the command: +<pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre> +A value of 1 day is considered to be sufficient for many environments. +</ocil> +<rationale> +Setting the minimum password age protects against users cycling +back to a favorite password after satisfying the password reuse +requirement. +</rationale> +<oval id="accounts_minimum_age_login_defs" value="var_accounts_minimum_age_login_defs"/> +<ref nist="IA-5(f),IA-5(1)(d)" disa="198"/> +</Rule> + +<Rule id="accounts_maximum_age_login_defs" severity="medium"> +<title>Set Password Maximum Age</title> +<description>To specify password maximum age for new accounts, +edit the file <tt>/etc/login.defs</tt> and add or correct the +following line, replacing the <i>DAYS</i> item appropriately: +<pre>PASS_MAX_DAYS <i>DAYS</i></pre> +A value of 180 days is sufficient for many environments. +</description> +<ocil clause="it is not set to the required value"> +To check the maximum password age, run the command: +<pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre> +A value of 180 days is sufficient for many environments. +</ocil> +<rationale> +Setting the password maximum age ensures users are required to +periodically change their passwords. This could possibly decrease +the utility of a stolen password. Requiring shorter password lifetimes +increases the risk of users writing down the password in a convenient +location subject to physical compromise.</rationale> +<oval id="accounts_maximum_age_login_defs" value="var_accounts_maximum_age_login_defs"/> +<ref nist="IA-5(f),IA-5(g),IA-5(1)(d)" disa="180,199" /> +</Rule> + +<Rule id="accounts_password_warn_age_login_defs"> +<title>Set Password Warning Age</title> +<description>To specify how many days prior to password +expiration that a warning will be issued to users, +edit the file <tt>/etc/login.defs</tt> and add or correct + the following line, replacing the <i>DAYS</i> item as appropriate: +<pre>PASS_WARN_AGE <i>DAYS</i></pre> +A value of 7 days would be nowadays considered to be a standard. +<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> --> +</description> +<ocil clause="it is not set to the required value"> +To check the password warning age, run the command: +<pre>$ grep PASS_WARN_AGE /etc/login.defs</pre> +A value of 7 days would be nowadays considered to be a standard. +</ocil> +<rationale> +Setting the password warning age enables users to make the change +at a practical time. +</rationale> +<oval id="accounts_password_warn_age_login_defs" value="var_accounts_password_warn_age_login_defs" /> +<ref nist="IA-5(f)" /> +</Rule> + +</Group> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec index 73eab57..1abe666 100644 --- a/Fedora/scap-security-guide.spec +++ b/Fedora/scap-security-guide.spec @@ -5,7 +5,7 @@ # file one level up - in the main scap-security-guide directory (instead of # this one).
-%global fedorassgrelease 2.rc2 +%global fedorassgrelease 2.rc3
Name: scap-security-guide Version: 0.1 @@ -50,6 +50,9 @@ rm -rf $RPM_BUILD_ROOT %{_datadir}/xml/scap/ssg/fedora/19/*
%changelog +* Thu Oct 10 2013 Jan iankko Lieskovskyjlieskov@redhat.com 0.1-2.rc3 +- Convert four RHEL6 'Set Password Expiration Parameter' rules to Fedora
- Thu Oct 10 2013 Jan iankko Lieskovskyjlieskov@redhat.com 0.1-2.rc2
- Introduce 'Account and Access Control' section
- Convert following "Verify Proper Storage and Existence of Password Hashes" section
-- 1.7.11.7
ack
scap-security-guide@lists.fedorahosted.org