[PATCH] Modified no_empty_password rule.

Willy Santos wsantos at redhat.com
Mon Jul 30 19:21:14 UTC 2012


Modified no_empty_password rule to check for nullok option in /etc/pam.d/system-auth instead of checking password field in /etc/shadow. Also created OVAL check accounts_pam_no_nullok.xml to support this. See Trac ticket #92: https://fedorahosted.org/scap-security-guide/ticket/92
---
 RHEL6/input/checks/accounts_pam_no_nullok.xml      |   24 ++++++++++++++++++++
 .../accounts/restrictions/password_storage.xml     |   18 ++++++++++-----
 2 files changed, 36 insertions(+), 6 deletions(-)
 create mode 100644 RHEL6/input/checks/accounts_pam_no_nullok.xml

diff --git a/RHEL6/input/checks/accounts_pam_no_nullok.xml b/RHEL6/input/checks/accounts_pam_no_nullok.xml
new file mode 100644
index 0000000..054cb94
--- /dev/null
+++ b/RHEL6/input/checks/accounts_pam_no_nullok.xml
@@ -0,0 +1,24 @@
+<def-group>
+  <definition class="compliance" id="accounts_pam_no_nullok" version="1">
+    <metadata>
+      <title>No nullok Option in /etc/pam.d/system-auth</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <reference ref_id="TO:DO" source="CCE" />
+      <description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
+    </metadata>
+    <criteria>
+      <criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="test_accounts_pam_no_nullok" />
+    </criteria>
+  </definition>
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure nullok is not used in /etc/pam.d/system-auth" id="test_accounts_pam_no_nullok" version="1">
+    <ind:object object_ref="object_accounts_pam_no_nullok" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_accounts_pam_no_nullok" version="1">
+    <ind:path>/etc/pam.d/</ind:path>
+    <ind:filename>system-auth</ind:filename>
+    <ind:pattern operation="pattern match">\s*nullok\s*</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index 8e1014b..8f39126 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -17,11 +17,17 @@ should allow administrators to avoid such misconfiguration.
 </description>
 
 <Rule id="no_empty_passwords" severity="high">
-<title>Verify that No Accounts Have Empty Password Fields</title>
-<description>Run the command:
-<pre># awk -F: '($2 == "") {print}' /etc/shadow</pre>
-If this produces any output, fix the problem by locking each
-account or by setting a password.
+<title>Prevent Log In to Accounts With Empty Password</title>
+<description>If an account is configured for password authentication
+but does not have an assigned password, it may be possible to log
+into the account without authentication. Ensuring that the <tt>nullok</tt>
+option is <b>NOT</b> used in the <tt>/etc/pam.d/system-auth-ac</tt>
+prevents logins with empty passwords.
+<br /><br />
+To verify manually, the following command can be used:
+<pre># grep nullok /etc/pam.d/system-auth /etc/pam.d/system-auth-ac</pre>
+If this produces any output, fix the problem by removing any instance
+of <tt>nullok</tt> in <tt>/etc/pam.d/system-auth-ac</tt>.
 </description>
 <rationale>
 If an account has an empty password, anybody may log in and
@@ -30,7 +36,7 @@ empty passwords should never be used in operational
 environments.
 </rationale>
 <ident cce="4238-2" />
-<oval id="accounts_no_empty_passwords" />
+<oval id="accounts_pam_no_nullok" />
 <ref nist="AC-3, CM-6, IA-5" />
 </Rule>
 
-- 
1.7.7.6



More information about the scap-security-guide mailing list