[PATCH] quick Rule edits

David Smith dsmith at eclipse.ncsc.mil
Tue Oct 16 19:56:49 UTC 2012


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/services/dhcp.xml                      |    2 +-
 RHEL6/input/system/accounts/banners.xml            |    4 ++--
 RHEL6/input/system/accounts/pam.xml                |   16 +++++++---------
 .../accounts/restrictions/password_expiration.xml  |    1 -
 4 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/RHEL6/input/services/dhcp.xml b/RHEL6/input/services/dhcp.xml
index f432092..991cf7d 100644
--- a/RHEL6/input/services/dhcp.xml
+++ b/RHEL6/input/services/dhcp.xml
@@ -41,7 +41,7 @@ any system that does not need to act as a DHCP server.
 </description>
 <ocil><service-disable-check-macro service="dhcpd" /></ocil>
 <rationale>
-Unmanaged or unintentionally activate DHCP servers may provide faulty information
+Unmanaged or unintentionally activated DHCP servers may provide faulty information
 to clients, interfering with the operation of a legitimate site
 DHCP server if there is one.
 </rationale>
diff --git a/RHEL6/input/system/accounts/banners.xml b/RHEL6/input/system/accounts/banners.xml
index eadaa41..c7ccd4d 100644
--- a/RHEL6/input/system/accounts/banners.xml
+++ b/RHEL6/input/system/accounts/banners.xml
@@ -67,11 +67,11 @@ above, using this IS does not constitute consent to PM, LE or CI investigative
 searching or monitoring of the content of privileged communications, or work
 product, related to personal representation or services by attorneys,
 psychotherapists, or clergy, and their assistants. Such communications and work
-product are private and confidential. See User Agreement for details. 
+product are private and confidential. See User Agreement for details.
 <br/>
 or:
 <br/>
-I've read &amp; consent to terms in IS user agreement.
+<pre>I've read &amp; consent to terms in IS user agreement.</pre>
 </description>
 <ocil clause="it does not display the required banner">
 To check if the system login banner is compliant,
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index d530deb..225c779 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -175,15 +175,13 @@ operator="equals" interactive="0">
 </Value>
 
 <Rule id="password_retry">
-<title>Set Password Retry Prompts Permitted Per-session</title>
-<description>The pam_cracklib module's <tt>retry=</tt> parameter
-controls how many times a program will re-prompt a user after an incorrect
-password entry, on a per-session basis.  To configure this, open
-<tt>/etc/pam.d/system-auth</tt> and locate the <tt>retry=</tt> parameter for
-<tt>pam_cracklib</tt> in the <tt>password</tt> portion of the PAM stack.
-The system default is 3.  
-The DoD required value is 3.
-Add or correct<tt>retry=3</tt> after pam_cracklib.so to allow 3 retries.
+<title>Set Password Retry Prompts Permitted Per-Session</title>
+<description>To configure the number of retry prompts that are permitted per-session:
+<br /><br />
+Edit the <tt>pam_cracklib.so</tt> statement in <tt>/etc/pam.d/system-auth</tt> to 
+show <tt>retry=3</tt>.
+<br /><br />
+The DoD requirement is three prompts per session.
 </description>
 <ocil clause="it is not the required value">
 To check how many retry attempts are permitted on a per-session basis, run the following command:
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index 89643b7..4dd28df 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -82,7 +82,6 @@ age, and 7 day warning period with the following command:
 edit the file <tt>/etc/login.defs</tt> and add or correct the following
 lines:
 <pre>PASS_MIN_LEN 14<!-- <sub idref="var_password_min_len"> --></pre>
-TODO: More research needed to understand exact interaction: when precisely is this file consulted?
 <br/><br/>
 The DoD requirement is <tt>14</tt>. 
 If a program consults <tt>/etc/login.defs</tt> and also another PAM module
-- 
1.7.1



More information about the scap-security-guide mailing list