[PATCH 36/64] Added granularity to IA-5* checks for PAM
Shawn Wells
shawn.d.wells at gmail.com
Fri Apr 26 02:14:41 UTC 2013
-------------- next part --------------
>From ee17f1f1a29c87a4a9d8deda1cd476d8938eb975 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 19:30:51 -0400
Subject: [PATCH 36/64] Added granularity to IA-5* checks for PAM
IA-5(f) deals with "Establishing minimum and maximum lifetime restrictions and reuse conditions for
authenticators (if appropriate)"
Updated mapping granularity of PAM rules to reflect IA-5(f)
---
.../accounts/restrictions/password_expiration.xml | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index 72a3a9d..5372c13 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -103,7 +103,7 @@ behavior that may result.
</rationale>
<ident cce="27002-5" />
<oval id="accounts_password_minlen_login_defs" value="var_password_min_len"/>
-<ref nist="IA-5" disa="205"/>
+<ref nist="IA-5(f)" disa="205"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -130,7 +130,7 @@ after satisfying the password reuse requirement.
</rationale>
<ident cce="27013-2" />
<oval id="accounts_minimum_age_login_defs" value="var_password_min_age"/>
-<ref nist="IA-5" disa="198"/>
+<ref nist="IA-5(f)" disa="198"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -158,7 +158,7 @@ increases the risk of users writing down the password in a convenient
location subject to physical compromise.</rationale>
<ident cce="26985-2" />
<oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/>
-<ref nist="IA-5" disa="180,199" />
+<ref nist="IA-5(f),IA-5(g)" disa="180,199" />
<tested by="DS" on="20121026"/>
</Rule>
@@ -183,7 +183,7 @@ make the change at a practical time.
</rationale>
<ident cce="26988-6" />
<oval id="accounts_password_warn_age_login_defs" value="var_password_warn_age" />
-<ref nist="IA-5" />
+<ref nist="IA-5(f)" />
<tested by="DS" on="20121026"/>
</Rule>
</Group>
--
1.7.1
More information about the scap-security-guide
mailing list