[PATCH 07/16] Created mappings to CCI-000200
Shawn Wells
shawn at redhat.com
Wed Jul 18 14:58:44 UTC 2012
- Updated rule text
- Ensured selector was called out in common and STIG profile
---
RHEL6/input/profiles/STIG-server.xml | 5 +++++
RHEL6/input/profiles/common.xml | 3 +++
RHEL6/input/system/accounts/pam.xml | 31 ++++++++++++-------------------
3 files changed, 20 insertions(+), 19 deletions(-)
diff --git a/RHEL6/input/profiles/STIG-server.xml b/RHEL6/input/profiles/STIG-server.xml
index 5ccf94c..8521546 100644
--- a/RHEL6/input/profiles/STIG-server.xml
+++ b/RHEL6/input/profiles/STIG-server.xml
@@ -5,4 +5,9 @@
<select idref="disable_xwindows_with_runlevel" selected="true"/>
<select idref="packagegroup_xwindows_remove" selected="true"/>
<select idref="disable_dhcp_client" selected="true"/>
+
+
+<!-- Password history -->
+<refine-value idref="password_history_retain_number" selector="5"/>
+
</Profile>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 22de485..f927cac 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -166,8 +166,11 @@ these should likely be moved out of common.
<select idref="disable_snmpd" selected="true"/>
<select idref="uninstall_net-snmp" selected="true"/>
<!-- Refine Values -->
+<!-- Password history -->
+<refine-value idref="password_history_retain_number" selector="5"/>
<!-- Permissions for passwd -->
<refine-value idref="var_umask_for_daemons" selector="027"/>
+<refine-value idref="var_umask_for_daemons" selector="027"/>
<!-- daemon umask -->
<refine-value idref="var_password_min_len" selector="14"/>
<!-- password minimum length -->
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index c02d1c5..69d7c90 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -337,17 +337,6 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
<ref nist="IA-5" />
</Rule>
-<Group id="limiting_password_reuse">
-<title>Limit Password Reuse</title>
-<description>Do not allow users to reuse recent passwords. This can
-be accomplished by using the remember option for the <tt>pam_unix</tt> PAM
-module. For example, in order to prevent a user from re-using any of his or her
-last 5 passwords, append <tt>remember=5</tt> to the password line which uses
-the <tt>pam_unix</tt> module in the file <tt>/etc/pam.d/system-auth</tt>, as shown:
-<pre>password sufficient pam_unix.so existing_options remember=5</pre>
-Old (and thus no longer valid) passwords are stored in the
-file <tt>/etc/security/opasswd</tt>.</description>
-
<Value id="password_history_retain_number" type="number"
operator="equals" interactive="0">
<title>remember</title>
@@ -361,17 +350,21 @@ frequently.</description>
<value selector="10">10</value>
</Value>
-<Rule id="limit_password_reuse">
+<Group id="limiting_password_reuse">
<title>Limit Password Reuse</title>
-<description>The passwords to remember should be set to:
-<sub idref="password_history_retain_number" /></description>
-<rationale>
-Allowing users to reuse passwords means that a password which was once
-compromised could be used yet again by an attacker.
-</rationale>
+<description>Do not allow users to reuse recent passwords. This can
+be accomplished by using the <tt>remember</tt> option for the <tt>pam_unix</tt> PAM
+module. In order to prevent a user from re-using any of their
+last <sub idref="password_history_retain_number" /> passwords,
+append <tt>remember=<sub idref="password_history_retain_number" /></tt> to
+the password line which uses the <tt>pam_unix</tt> module in the file
+<tt>/etc/pam.d/system-auth</tt>, as shown:
+<pre>password sufficient pam_unix.so existing_options remember=<sub idref="password_history_retain_number" /></pre>
+Old (and thus no longer valid) passwords are stored in the
+file <tt>/etc/security/opasswd</tt>.</description>
<ident cce="14939-3" />
<oval id="accounts_password_reuse_limit" value="password_history_retain_number"/>
<ref nist="IA-5" disa="200"/>
-</Rule>
</Group>
+
</Group>
--
1.7.1
--vkogqOf2sHV7VnPd--
More information about the scap-security-guide
mailing list