From: Matt Keeler <mkeeler(a)tresys.com>
---
testing/data/EtcPasswdPerms/Passwd.xccdf.xml | 6 +++-
testing/data/PuppetManifests/passwd.pp | 46 +++++++++++++++++--------
2 files changed, 36 insertions(+), 16 deletions(-)
diff --git a/testing/data/EtcPasswdPerms/Passwd.xccdf.xml
b/testing/data/EtcPasswdPerms/Passwd.xccdf.xml
index 03f5474..a22f509 100644
--- a/testing/data/EtcPasswdPerms/Passwd.xccdf.xml
+++ b/testing/data/EtcPasswdPerms/Passwd.xccdf.xml
@@ -99,7 +99,11 @@
</check>
<fix system="urn:xccdf:fix:script:puppet">
class : passwd
- parameter : etc_passwd_mode : 644
+ parameter : etc_passwd_gwrite : false
+ parameter : etc_passwd_owrite : false
+ parameter : etc_passwd_uexec : false
+ parameter : etc_passwd_gexec : false
+ parameter : etc_passwd_oexec : false
</fix>
</Rule>
</Benchmark>
diff --git a/testing/data/PuppetManifests/passwd.pp
b/testing/data/PuppetManifests/passwd.pp
index 90eeb7b..7acca06 100644
--- a/testing/data/PuppetManifests/passwd.pp
+++ b/testing/data/PuppetManifests/passwd.pp
@@ -1,20 +1,36 @@
class passwd {
- file { '/etc/passwd' :
- mode => $etc_passwd_mode? {
- '' => undef,
- default => $etc_passwd_mode
- },
- owner => $etc_passwd_owner? {
- '' => undef,
- default => $etc_passwd_owner
- },
- group => $etc_passwd_group_owner? {
- '' => undef,
- default => $etc_passwd_group_owner
- }
- }
+ file_perms { '/etc/passwd' :
+ owrite => $etc_passwd_owrite? {
+ '' => undef,
+ default => $etc_passwd_owrite
+ },
+ gwrite => $etc_passwd_gwrite? {
+ '' => undef,
+ default => $etc_passwd_gwrite
+ },
+ uexec => $etc_passwd_uexec? {
+ '' => undef,
+ default => $etc_passwd_uexec
+ },
+ gexec =>$etc_passwd_gexec? {
+ '' => undef,
+ default => $etc_passwd_gexec
+ },
+ oexec =>$etc_passwd_oexec? {
+ '' => undef,
+ default => $etc_passwd_oexec
+ },
+ owner => $etc_passwd_owner? {
+ '' => undef,
+ default => $etc_passwd_owner
+ },
+ group => $etc_passwd_group_owner? {
+ '' => undef,
+ default => $etc_passwd_group_owner
+ }
+ }
}
-
+
class passwd_complexity {
pam {"pam_cracklib.so":
type => "password",
--
1.6.5.2
Show replies by date