[PATCH 1/3] updated OVAL checks which inspect login.defs to support Values (variables)

Jeffrey Blank blank at eclipse.ncsc.mil
Tue May 29 21:26:50 UTC 2012


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 .../checks/accounts_maximum_age_login_defs.xml     |   26 ++++++++++-----
 .../checks/accounts_minimum_age_login_defs.xml     |   31 ++++++++++++-------
 .../checks/accounts_password_minlen_login_defs.xml |   17 ++++------
 .../accounts_password_warn_age_login_defs.xml      |   32 ++++++++++++--------
 4 files changed, 63 insertions(+), 43 deletions(-)

diff --git a/rhel6/src/input/checks/accounts_maximum_age_login_defs.xml b/rhel6/src/input/checks/accounts_maximum_age_login_defs.xml
index c6333d1..10bc279 100644
--- a/rhel6/src/input/checks/accounts_maximum_age_login_defs.xml
+++ b/rhel6/src/input/checks/accounts_maximum_age_login_defs.xml
@@ -6,21 +6,29 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <reference ref_id="CCE-4092-3" source="CCE" />
-      <description>The "maximum password age" policy should meet
-      minimum requirements. This particular check looks for a
-      maximum password age of 60 days.</description>
+      <description>The maximum password age policy should meet
+      minimum requirements.</description>
     </metadata>
-    <criteria comment="the value PASS_MAX_DAYS should be set to 60 in /etc/login.defs">
-      <criterion test_ref="test_pass_max_days_sixty" />
+    <criteria comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
+      <criterion test_ref="test_pass_max_days" />
     </criteria>
   </definition>
-  <ind:textfilecontent54_test check="all" comment="the value PASS_MAX_DAYS should be set to 60 in /etc/login.defs" id="test_pass_max_days_sixty" version="1">
+
+  <ind:textfilecontent54_test check="all" comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs" id="test_pass_max_days" version="1">
     <ind:object object_ref="object_etc_login_defs_pass_max" />
+    <ind:state state_ref="state_password_max_age" />
   </ind:textfilecontent54_test>
+
   <ind:textfilecontent54_object id="object_etc_login_defs_pass_max" version="1">
-    <ind:path>/etc</ind:path>
-    <ind:filename>login.defs</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*PASS_MAX_DAYS[\s]+60$</ind:pattern>
+    <ind:filepath>/etc/login.defs</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*PASS_MAX_DAYS[\s]+(\d+)\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_password_max_age" version="1">
+    <ind:subexpression operation="less than or equal" var_ref="var_password_max_age" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="maximum password age" datatype="int" id="var_password_max_age" version="1" />
+
 </def-group>
diff --git a/rhel6/src/input/checks/accounts_minimum_age_login_defs.xml b/rhel6/src/input/checks/accounts_minimum_age_login_defs.xml
index f5a89ce..0afa38b 100644
--- a/rhel6/src/input/checks/accounts_minimum_age_login_defs.xml
+++ b/rhel6/src/input/checks/accounts_minimum_age_login_defs.xml
@@ -6,21 +6,30 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <reference ref_id="CCE-4180-6" source="CCE" />
-      <description>The "minimum password age" policy should meet
-      minimum requirements. This particular check looks for a
-      minimum password age of 7 days.</description>
+      <description>The minimum password age policy should be set appropriately.</description>
     </metadata>
-    <criteria comment="the value PASS_MIN_DAYS should be set to 7 in /etc/login.defs">
-      <criterion test_ref="test_pass_min_days_seven" />
+    <criteria comment="the value PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
+      <criterion test_ref="test_pass_min_days" />
     </criteria>
   </definition>
-  <ind:textfilecontent54_test check="all" comment="the value PASS_MIN_DAYS should be set to 7 in /etc/login.defs" id="test_pass_min_days_seven" version="1">
-    <ind:object object_ref="object_etc_login_defs_pass_min" />
+
+  <ind:textfilecontent54_test check="all"
+  comment="Tests the value of PASS_MIN_DAYS in /etc/login.defs" 
+  id="test_pass_min_days" version="1">
+    <ind:object object_ref="object_etc_login_defs_pass_min_age" />
+    <ind:state state_ref="state_etc_login_defs_pass_min_age" />
   </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="object_etc_login_defs_pass_min" version="1">
-    <ind:path>/etc</ind:path>
-    <ind:filename>login.defs</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*PASS_MIN_DAYS[\s]+7$</ind:pattern>
+
+  <ind:textfilecontent54_object id="object_etc_login_defs_pass_min_age" version="1">
+    <ind:filepath>/etc/login.defs</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*PASS_MIN_DAYS[\s]+(\d+)\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_etc_login_defs_pass_min_age" version="1">
+    <ind:subexpression operation="greater than or equal" var_ref="var_password_min_age" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="minimum password age in days" datatype="int" id="var_password_min_age" version="1" />
+
 </def-group>
diff --git a/rhel6/src/input/checks/accounts_password_minlen_login_defs.xml b/rhel6/src/input/checks/accounts_password_minlen_login_defs.xml
index 4f8ccdc..e8cd30b 100644
--- a/rhel6/src/input/checks/accounts_password_minlen_login_defs.xml
+++ b/rhel6/src/input/checks/accounts_password_minlen_login_defs.xml
@@ -7,8 +7,7 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <reference ref_id="CCE-4154-1" source="CCE" />
-      <description>The password minimum length should be set
-      appropriately</description>
+      <description>The password minimum length should be set appropriately.</description>
     </metadata>
     <criteria operator="AND">
       <criterion test_ref="test_pam_minlen_set" />
@@ -27,23 +26,21 @@
   </ind:textfilecontent54_test>
 
   <ind:textfilecontent54_object id="object_pam_minlen_set" version="1">
-    <ind:path>/etc/pam.d</ind:path>
-    <ind:filename>system-auth</ind:filename>
-    <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*minlen=([0-9]*).*$</ind:pattern>
+    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+    <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*minlen=(\d+).*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
   <ind:textfilecontent54_object id="object_etc_login_defs" version="1">
-    <ind:path>/etc</ind:path>
-    <ind:filename>login.defs</ind:filename>
-    <ind:pattern operation="pattern match">^PASS_MIN_LEN\s+([0-9]*)$</ind:pattern>
+    <ind:filepath>/etc/login.defs</ind:filepath>
+    <ind:pattern operation="pattern match">^PASS_MIN_LEN\s+(\d+)\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
   <ind:textfilecontent54_state id="state_password_min_len" version="1">
-    <ind:subexpression operation="equals" var_check="all" var_ref="var_password_min_len" />
+    <ind:subexpression operation="greater than or equal" var_ref="var_password_min_len" />
   </ind:textfilecontent54_state>
 
-  <external_variable comment="password minimum length" datatype="string" id="var_password_min_len" version="1" />
+  <external_variable comment="password minimum length" datatype="int" id="var_password_min_len" version="1" />
 
 </def-group>
diff --git a/rhel6/src/input/checks/accounts_password_warn_age_login_defs.xml b/rhel6/src/input/checks/accounts_password_warn_age_login_defs.xml
index bea68d2..1c6a24d 100644
--- a/rhel6/src/input/checks/accounts_password_warn_age_login_defs.xml
+++ b/rhel6/src/input/checks/accounts_password_warn_age_login_defs.xml
@@ -1,30 +1,36 @@
 <def-group>
-  <definition class="compliance"
-  id="accounts_password_warn_age_login_defs" version="1">
+  <definition class="compliance" id="accounts_password_warn_age_login_defs" version="1">
     <metadata>
       <title>Set Password Expiration Parameters</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <reference ref_id="CCE-4097-2" source="CCE" />
-      <description>The password warn age should be set
-      appropriately</description>
+      <description>The password expiration warning age should be set appropriately.</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_20074" />
+      <criterion test_ref="test_pass_warn_age" />
     </criteria>
   </definition>
+
   <ind:textfilecontent54_test check="all"
-  check_existence="all_exist"
-  comment="Tests the value of the PASS_WARN_AGE[\s]*=[\s]*(.*) expression in the /etc/login.defs file"
-  id="test_20074" version="1">
-    <ind:object object_ref="obj_20074" />
+  comment="Tests the value of PASS_WARN_AGE in /etc/login.defs"
+  id="test_pass_warn_age" version="1">
+    <ind:object object_ref="object_etc_login_defs_pass_warn_age" />
+    <ind:state state_ref="state_etc_login_defs_pass_warn_age" />
   </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_20074"
+
+  <ind:textfilecontent54_object id="object_etc_login_defs_pass_warn_age"
   version="1">
-    <ind:path>/etc</ind:path>
-    <ind:filename>login.defs</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*PASS_WARN_AGE[\s]*14$</ind:pattern>
+    <ind:filepath>/etc/login.defs</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*PASS_WARN_AGE[\s]*(\d+)\s*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_etc_login_defs_pass_warn_age" version="1">
+    <ind:subexpression operation="greater than or equal" var_ref="var_password_warn_age" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="password expiration warning age in days" datatype="int" id="var_password_warn_age" version="1" />
+
 </def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list