[PATCH 35/64] Added IA-5(c) mappings to PAM
Shawn Wells
shawn.d.wells at gmail.com
Fri Apr 26 02:14:26 UTC 2013
-------------- next part --------------
>From 10f2e79298b7fd115c386c640a63dcfbf2dcd371 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 19:25:49 -0400
Subject: [PATCH 35/64] Added IA-5(c) mappings to PAM
IA-5(c) ensures "authenticators have sufficient strength of mechanism" which
is reflected through PAM password complexity and hashing rules
---
RHEL6/input/system/accounts/pam.xml | 16 ++++++++--------
1 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index b86b259..8fa7c5e 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -287,7 +287,7 @@ search space.
</rationale>
<ident cce="26374-9" />
<oval id="accounts_password_pam_cracklib_dcredit" value="var_password_pam_cracklib_dcredit"/>
-<ref nist="IA-5(b),194" disa="194"/>
+<ref nist="IA-5(b),IA-5(c),194" disa="194"/>
<tested by="DS" on="20121024"/>
</Rule>
@@ -312,7 +312,7 @@ more difficult by ensuring a larger search space.
</rationale>
<ident cce="26601-5" />
<oval id="accounts_password_pam_cracklib_ucredit" value="var_password_pam_cracklib_ucredit"/>
-<ref nist="IA-5(b)" disa="192" />
+<ref nist="IA-5(b),IA-5(c)" disa="192" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -337,7 +337,7 @@ more difficult by ensuring a larger search space.
</rationale>
<ident cce="26409-3" />
<oval id="accounts_password_pam_cracklib_ocredit" value="var_password_pam_cracklib_ocredit"/>
-<ref nist="IA-5(b)" disa="1619" />
+<ref nist="IA-5(b),IA-5(c)" disa="1619" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -362,7 +362,7 @@ more difficult by ensuring a larger search space.
</rationale>
<ident cce="26631-2" />
<oval id="accounts_password_pam_cracklib_lcredit" value="var_password_pam_cracklib_lcredit"/>
-<ref nist="IA-5(b)" disa="193" />
+<ref nist="IA-5(b),IA-5(c)" disa="193" />
<tested by="DS" on="20121024"/>
</Rule>
@@ -388,7 +388,7 @@ Note that passwords which are changed on compromised systems will still be compr
</rationale>
<ident cce="26615-5" />
<oval id="accounts_password_pam_cracklib_difok" value="var_password_pam_cracklib_difok"/>
-<ref nist="IA-5(b)" disa="195"/>
+<ref nist="IA-5(b),IA-5(c)" disa="195"/>
<tested by="DS" on="20121024"/>
</Rule>
</Group>
@@ -541,7 +541,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
</rationale>
<ident cce="26303-8" />
<!-- <oval id="accounts_password_hashing_algorithm" /> -->
-<ref nist="IA-5(b)" disa="803"/>
+<ref nist="IA-5(b),IA-5(c)" disa="803"/>
<tested by="DS" on="20121024"/>
<oval id="set_password_hashing_algorithm_systemauth" />
</Rule>
@@ -562,7 +562,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
</rationale>
<!-- <oval id="accounts_password_hashing_algorithm" /> -->
<ident cce="27228-6" />
-<ref nist="IA-5(b)" disa="803"/>
+<ref nist="IA-5(b),IA-5(c)" disa="803"/>
<tested by="DS" on="20121024"/>
<oval id="set_password_hashing_algorithm_logindefs" />
</Rule>
@@ -585,7 +585,7 @@ Using a stronger hashing algorithm makes password cracking attacks more difficul
</rationale>
<!-- <oval id="accounts_password_hashing_algorithm" /> -->
<ident cce="27229-4" />
-<ref nist="IA-5(b)" disa="803"/>
+<ref nist="IA-5(b),IA-5(c)" disa="803"/>
<tested by="DS" on="20121026"/>
<oval id="set_password_hashing_algorithm_libuserconf" />
</Rule>
--
1.7.1
More information about the scap-security-guide
mailing list