On 8/19/13 3:28 PM, Maura Dailey wrote:
Small edit to ensure that sha512 can be set anywhere in the list of
options in the pam_unix.so line.
- Maura Dailey
Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
.../set_password_hashing_algorithm_systemauth.xml | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/checks/set_password_hashing_algorithm_systemauth.xml
b/RHEL6/input/checks/set_password_hashing_algorithm_systemauth.xml
index e999d0d..ac86592 100644
--- a/RHEL6/input/checks/set_password_hashing_algorithm_systemauth.xml
+++ b/RHEL6/input/checks/set_password_hashing_algorithm_systemauth.xml
@@ -6,6 +6,7 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The password hashing algorithm should be set correctly in
/etc/pam.d/system-auth.</description>
+ <reference source="MED" ref_id="20130819"
ref_url="test_attestation" />
</metadata>
<criteria operator="AND">
<criterion test_ref="test_pam_unix_sha512" />
@@ -18,7 +19,7 @@
<ind:textfilecontent54_object comment="check /etc/pam.d/system-auth for
correct settings" id="object_pam_unix_sha512" version="1">
<ind:filepath>/etc/pam.d/system-auth</ind:filepath>
- <ind:pattern operation="pattern
match">^\s*password\s+sufficient\s+pam_unix.so\s+sha512.*$</ind:pattern>
+ <ind:pattern operation="pattern
match">^[\s]*password[\s]+sufficient[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
ack