[PATCH 35/64] Added IA-5(c) mappings to PAM

Shawn Wells shawn.d.wells at gmail.com
Fri Apr 26 02:14:26 UTC 2013


-------------- next part --------------
>From 10f2e79298b7fd115c386c640a63dcfbf2dcd371 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 19:25:49 -0400
Subject: [PATCH 35/64] Added IA-5(c) mappings to PAM
 IA-5(c) ensures "authenticators have sufficient strength of mechanism" which
 is reflected through PAM password complexity and hashing rules

---
 RHEL6/input/system/accounts/pam.xml |   16 ++++++++--------
 1 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index b86b259..8fa7c5e 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -287,7 +287,7 @@ search space.
 </rationale>
 <ident cce="26374-9" />
 <oval id="accounts_password_pam_cracklib_dcredit" value="var_password_pam_cracklib_dcredit"/>
-<ref nist="IA-5(b),194" disa="194"/>
+<ref nist="IA-5(b),IA-5(c),194" disa="194"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -312,7 +312,7 @@ more difficult by ensuring a larger search space.
 </rationale>
 <ident cce="26601-5" />
 <oval id="accounts_password_pam_cracklib_ucredit" value="var_password_pam_cracklib_ucredit"/>
-<ref nist="IA-5(b)" disa="192" />
+<ref nist="IA-5(b),IA-5(c)" disa="192" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -337,7 +337,7 @@ more difficult by ensuring a larger search space.
 </rationale>
 <ident cce="26409-3" />
 <oval id="accounts_password_pam_cracklib_ocredit" value="var_password_pam_cracklib_ocredit"/>
-<ref nist="IA-5(b)" disa="1619" />
+<ref nist="IA-5(b),IA-5(c)" disa="1619" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -362,7 +362,7 @@ more difficult by ensuring a larger search space.
 </rationale>
 <ident cce="26631-2" />
 <oval id="accounts_password_pam_cracklib_lcredit" value="var_password_pam_cracklib_lcredit"/>
-<ref nist="IA-5(b)" disa="193" />
+<ref nist="IA-5(b),IA-5(c)" disa="193" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -388,7 +388,7 @@ Note that passwords which are changed on compromised systems will still be compr
 </rationale>
 <ident cce="26615-5" />
 <oval id="accounts_password_pam_cracklib_difok" value="var_password_pam_cracklib_difok"/>
-<ref nist="IA-5(b)" disa="195"/>
+<ref nist="IA-5(b),IA-5(c)" disa="195"/>
 <tested by="DS" on="20121024"/>
 </Rule>
 </Group>
@@ -541,7 +541,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
 </rationale>
 <ident cce="26303-8" />
 <!-- <oval id="accounts_password_hashing_algorithm" /> -->
-<ref nist="IA-5(b)" disa="803"/>
+<ref nist="IA-5(b),IA-5(c)" disa="803"/>
 <tested by="DS" on="20121024"/>
 <oval id="set_password_hashing_algorithm_systemauth" />
 </Rule>
@@ -562,7 +562,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
 </rationale>
 <!-- <oval id="accounts_password_hashing_algorithm" /> -->
 <ident cce="27228-6" />
-<ref nist="IA-5(b)" disa="803"/>
+<ref nist="IA-5(b),IA-5(c)" disa="803"/>
 <tested by="DS" on="20121024"/>
 <oval id="set_password_hashing_algorithm_logindefs" />
 </Rule>
@@ -585,7 +585,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
 </rationale>
 <!-- <oval id="accounts_password_hashing_algorithm" /> -->
 <ident cce="27229-4" />
-<ref nist="IA-5(b)" disa="803"/>
+<ref nist="IA-5(b),IA-5(c)" disa="803"/>
 <tested by="DS" on="20121026"/>
 <oval id="set_password_hashing_algorithm_libuserconf" />
 </Rule>
-- 
1.7.1



More information about the scap-security-guide mailing list