*** BLURB HERE ***
root (2): Some minor cosmetic changes, but a major change to the REGEX to correctly match sha512 no matter where it is on the line see: "^[\s]*password[\s]+sufficient[\s]+(?:[\w_.-=\s]+[\s])sha512" vs "^\s*password\s+sufficient\s+pam_unix.so\s+sha512.*$" added extra values for the dcredit, ucredit, etc. then removed the comments so the oval check will be created.
.../checks/accounts_password_hashing_algorithm.xml | 20 +++++++++++------ RHEL6/input/system/accounts/pam.xml | 22 ++++++++++---------- 2 files changed, 24 insertions(+), 18 deletions(-)
From: root root@localhost.localdomain
--- .../checks/accounts_password_hashing_algorithm.xml | 20 +++++++++++++------- 1 files changed, 13 insertions(+), 7 deletions(-)
diff --git a/RHEL6/input/checks/accounts_password_hashing_algorithm.xml b/RHEL6/input/checks/accounts_password_hashing_algorithm.xml index 3e64c2c..1a9771a 100644 --- a/RHEL6/input/checks/accounts_password_hashing_algorithm.xml +++ b/RHEL6/input/checks/accounts_password_hashing_algorithm.xml @@ -14,31 +14,37 @@ </criteria> </definition>
- <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/system-auth for correct settings" id="test_pam_unix_sha512" version="1"> + <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/system-auth for correct settings" + id="test_pam_unix_sha512" version="1"> <ind:object object_ref="object_pam_unix_sha512" /> </ind:textfilecontent54_test>
- <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check MD5_CRYPT_ENAB in /etc/login.defs" id="test_etc_logins_defs_md5_crypt_enab" version="1"> + <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check MD5_CRYPT_ENAB in /etc/login.defs" + id="test_etc_logins_defs_md5_crypt_enab" version="1"> <ind:object object_ref="object_etc_logins_defs_md5_crypt_enab" /> </ind:textfilecontent54_test>
- <ind:textfilecontent54_test check="all" comment="check ENCRYPT_METHOD in /etc/login.defs" id="test_etc_logins_defs_encrypt_method" version="1"> + <ind:textfilecontent54_test check="all" comment="check ENCRYPT_METHOD in /etc/login.defs" + id="test_etc_logins_defs_encrypt_method" version="1"> <ind:object object_ref="object_etc_logins_defs_encrypt_method" /> </ind:textfilecontent54_test>
- <ind:textfilecontent54_object comment="check /etc/pam.d/system-auth for correct settings" id="object_pam_unix_sha512" version="1"> + <ind:textfilecontent54_object comment="check /etc/pam.d/system-auth for correct settings" + id="object_pam_unix_sha512" version="1"> ind:filepath/etc/pam.d/system-auth</ind:filepath> - <ind:pattern operation="pattern match">^\s*password\s+sufficient\s+pam_unix.so\s+sha512.*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*password[\s]+sufficient[\s]+(?:[\w_.-=\s]+[\s])sha512</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object>
- <ind:textfilecontent54_object comment="check MD5_CRYPT_ENAB in /etc/login.defs" id="object_etc_logins_defs_md5_crypt_enab" version="1"> + <ind:textfilecontent54_object comment="check MD5_CRYPT_ENAB in /etc/login.defs" + id="object_etc_logins_defs_md5_crypt_enab" version="1"> ind:filepath/etc/login.defs</ind:filepath> <ind:pattern operation="pattern match">^MD5_CRYPT_ENAB\s+no$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object>
- <ind:textfilecontent54_object comment="check ENCRYPT_METHOD in /etc/login.defs" id="object_etc_logins_defs_encrypt_method" version="1"> + <ind:textfilecontent54_object comment="check ENCRYPT_METHOD in /etc/login.defs" + id="object_etc_logins_defs_encrypt_method" version="1"> ind:filepath/etc/login.defs</ind:filepath> <ind:pattern operation="pattern match">^\s*ENCRYPT_METHOD\s+SHA512\s*$</ind:pattern> <ind:instance datatype="int">1</ind:instance>
From: root root@localhost.localdomain
--- RHEL6/input/system/accounts/pam.xml | 22 +++++++++++----------- 1 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml index 9089911..4f60fb1 100644 --- a/RHEL6/input/system/accounts/pam.xml +++ b/RHEL6/input/system/accounts/pam.xml @@ -118,9 +118,9 @@ operator="equals" interactive="0"> <title>dcredit</title> <description>Minimum number of digits in password</description> <value selector="">-1</value> -<value selector="2">-2</value> <value selector="1">-1</value> -<value selector="0">0</value> +<value selector="2">-2</value> +<value selector="3">-3</value> </Value> <Value id="var_password_pam_cracklib_ocredit" type="number" operator="equals" interactive="0"> @@ -128,27 +128,27 @@ operator="equals" interactive="0"> <description>Minimum number of other (special characters) in password</description> <value selector="">-1</value> -<value selector="2">-2</value> <value selector="1">-1</value> -<value selector="0">0</value> +<value selector="2">-2</value> +<value selector="3">-3</value> </Value> <Value id="var_password_pam_cracklib_lcredit" type="number" operator="equals" interactive="0"> <title>lcredit</title> <description>Minimum number of lower case in password</description> <value selector="">-1</value> -<value selector="2">-2</value> <value selector="1">-1</value> -<value selector="0">0</value> +<value selector="2">-2</value> +<value selector="3">-3</value> </Value> <Value id="var_password_pam_cracklib_ucredit" type="number" operator="equals" interactive="0"> <title>ucredit</title> <description>Minimum number of upper case in password</description> <value selector="">-1</value> -<value selector="2">-2</value> <value selector="1">-1</value> -<value selector="0">0</value> +<value selector="2">-2</value> +<value selector="3">-3</value> </Value> <Value id="var_password_pam_cracklib_difok" type="number" operator="equals" interactive="0"> @@ -515,7 +515,7 @@ ensure that the <tt>pam_unix.so</tt> module includes the argument Using a stronger hashing algorithm makes password cracking attacks more difficult. </rationale> <ident cce="26303-8" /> -<!-- <oval id="accounts_password_hashing_algorithm" /> --> +<oval id="accounts_password_hashing_algorithm" /> <ref nist="IA-5" disa="803"/> <tested by="DS" on="20121024"/> </Rule> @@ -534,7 +534,7 @@ Inspect <tt>/etc/login.defs</tt> and ensure the following line appears: <rationale> Using a stronger hashing algorithm makes password cracking attacks more difficult. </rationale> -<!-- <oval id="accounts_password_hashing_algorithm" /> --> +<oval id="accounts_password_hashing_algorithm" /> <ident cce="TODO" /> <ref nist="IA-5" disa="803"/> <tested by="DS" on="20121024"/> @@ -556,7 +556,7 @@ in the <tt>[default]</tt> section: <rationale> Using a stronger hashing algorithm makes password cracking attacks more difficult. </rationale> -<!-- <oval id="accounts_password_hashing_algorithm" /> --> +<oval id="accounts_password_hashing_algorithm" /> <ident cce="TODO" /> <ref nist="IA-5" disa="803"/> <tested by="DS" on="20121026"/>
Cool -- thanks for the patch. You may want to do a few things (and possibly reset away this commit, and try again):
1) Fill in SUBJECT HERE and BLURB HERE :) 2) Inspect (using git diff) your changes prior to commit, to make sure you've got exactly what you want. 3) Tell git your username, so you'll get proper credit for your changes in the commit log. This should do it: https://help.github.com/articles/setting-your-username-in-git
Thanks again for the patch -- let us know if you want this one, or if you want to "git reset" and send again!
On 02/07/2013 04:25 PM, Brian Millett wrote:
*** BLURB HERE ***
root (2): Some minor cosmetic changes, but a major change to the REGEX to correctly match sha512 no matter where it is on the line see: "^[\s]*password[\s]+sufficient[\s]+(?:[\w_.-=\s]+[\s])sha512" vs "^\s*password\s+sufficient\s+pam_unix.so\s+sha512.*$" added extra values for the dcredit, ucredit, etc. then removed the comments so the oval check will be created.
.../checks/accounts_password_hashing_algorithm.xml | 20 +++++++++++------ RHEL6/input/system/accounts/pam.xml | 22 ++++++++++---------- 2 files changed, 24 insertions(+), 18 deletions(-)
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org