[PATCH 0/3] support for Values in login.defs settings

Jeffrey Blank blank at eclipse.ncsc.mil
Wed May 30 22:18:05 UTC 2012



On 05/30/2012 04:13 PM, Michael Palmiotto wrote:
>> Some remaining issues exist, such as the prose not being
>> quite good yet, and I believe we will also break apart the
>> OVAL check for minimum length to separately cover the
>> settings in login.defs and pam_cracklib.  But not today.
> 
> I'm assuming this is one example of prose that needs
> resolution:
> 
>> <pre>PASS_MIN_LEN=12
>> <!-- <sub idref="var_password_min_len"> --></pre>
>> TODO: More research needed to understand exact
>> interaction: when precisely is this file consulted?


Yes.  And the usage of "<sub idref=" should be supported by the
transforms (but currently isn't).

I was calling this out because although I think that my commit is a very
significant improvement, it's not completely done yet.
I am waiting for an ACK.

> For the more applicable MD5 and SHA configurations,
> the entire key is used, so maybe PASS_MIN_LEN
> needs to be different for different ENCRYPT_METHOD
> values?  

PASS_MIN_LEN controls what the system will require for minimum password
length (at least for the usual programs in the "shadow password suite").
 I am unaware of any USG password policy that adjusts its length
requirement based on relevant information such as the strength of the
underlying algorithm.


More information about the scap-security-guide mailing list