[PATCH 07/16] Created mappings to CCI-000200

Shawn Wells shawn at redhat.com
Wed Jul 18 14:58:44 UTC 2012


- Updated rule text
- Ensured selector was called out in common and STIG profile
---
 RHEL6/input/profiles/STIG-server.xml |    5 +++++
 RHEL6/input/profiles/common.xml      |    3 +++
 RHEL6/input/system/accounts/pam.xml  |   31 ++++++++++++-------------------
 3 files changed, 20 insertions(+), 19 deletions(-)

diff --git a/RHEL6/input/profiles/STIG-server.xml b/RHEL6/input/profiles/STIG-server.xml
index 5ccf94c..8521546 100644
--- a/RHEL6/input/profiles/STIG-server.xml
+++ b/RHEL6/input/profiles/STIG-server.xml
@@ -5,4 +5,9 @@
 <select idref="disable_xwindows_with_runlevel" selected="true"/>
 <select idref="packagegroup_xwindows_remove" selected="true"/>
 <select idref="disable_dhcp_client" selected="true"/>
+
+
+<!-- Password history -->
+<refine-value idref="password_history_retain_number" selector="5"/>
+
 </Profile>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 22de485..f927cac 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -166,8 +166,11 @@ these should likely be moved out of common.
 <select idref="disable_snmpd" selected="true"/>
 <select idref="uninstall_net-snmp" selected="true"/>
 <!-- Refine Values -->
+<!-- Password history -->
+<refine-value idref="password_history_retain_number" selector="5"/>
 <!-- Permissions for passwd -->
 <refine-value idref="var_umask_for_daemons" selector="027"/>
+<refine-value idref="var_umask_for_daemons" selector="027"/>
 <!-- daemon umask -->
 <refine-value idref="var_password_min_len" selector="14"/>
 <!-- password minimum length -->
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index c02d1c5..69d7c90 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -337,17 +337,6 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
 <ref nist="IA-5" />
 </Rule>
 
-<Group id="limiting_password_reuse">
-<title>Limit Password Reuse</title>
-<description>Do not allow users to reuse recent passwords. This can
-be accomplished by using the remember option for the <tt>pam_unix</tt> PAM
-module. For example, in order to prevent a user from re-using any of his or her
-last 5 passwords, append <tt>remember=5</tt> to the password line which uses
-the <tt>pam_unix</tt> module in the file <tt>/etc/pam.d/system-auth</tt>, as shown:
-<pre>password sufficient pam_unix.so existing_options remember=5</pre>
-Old (and thus no longer valid) passwords are stored in the
-file <tt>/etc/security/opasswd</tt>.</description>
-
 <Value id="password_history_retain_number" type="number"
 operator="equals" interactive="0">
 <title>remember</title>
@@ -361,17 +350,21 @@ frequently.</description>
 <value selector="10">10</value>
 </Value>
 
-<Rule id="limit_password_reuse">
+<Group id="limiting_password_reuse">
 <title>Limit Password Reuse</title>
-<description>The passwords to remember should be set to:
-<sub idref="password_history_retain_number" /></description>
-<rationale>
-Allowing users to reuse passwords means that a password which was once
-compromised could be used yet again by an attacker.
-</rationale>
+<description>Do not allow users to reuse recent passwords. This can
+be accomplished by using the <tt>remember</tt> option for the <tt>pam_unix</tt> PAM
+module. In order to prevent a user from re-using any of their
+last <sub idref="password_history_retain_number" /> passwords, 
+append <tt>remember=<sub idref="password_history_retain_number" /></tt> to
+the password line which uses the <tt>pam_unix</tt> module in the file
+<tt>/etc/pam.d/system-auth</tt>, as shown:
+<pre>password sufficient pam_unix.so existing_options remember=<sub idref="password_history_retain_number" /></pre>
+Old (and thus no longer valid) passwords are stored in the
+file <tt>/etc/security/opasswd</tt>.</description>
 <ident cce="14939-3" />
 <oval id="accounts_password_reuse_limit" value="password_history_retain_number"/>
 <ref nist="IA-5" disa="200"/>
-</Rule>
 </Group>
+
 </Group>
-- 
1.7.1


--vkogqOf2sHV7VnPd--


More information about the scap-security-guide mailing list