[PATCH 36/64] Added granularity to IA-5* checks for PAM

Shawn Wells shawn.d.wells at gmail.com
Fri Apr 26 02:14:41 UTC 2013


-------------- next part --------------
>From ee17f1f1a29c87a4a9d8deda1cd476d8938eb975 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 19:30:51 -0400
Subject: [PATCH 36/64] Added granularity to IA-5* checks for PAM
 IA-5(f) deals with "Establishing minimum and maximum lifetime restrictions and reuse conditions for
 authenticators (if appropriate)"

Updated mapping granularity of PAM rules to reflect IA-5(f)
---
 .../accounts/restrictions/password_expiration.xml  |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index 72a3a9d..5372c13 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -103,7 +103,7 @@ behavior that may result.
 </rationale>
 <ident cce="27002-5" />
 <oval id="accounts_password_minlen_login_defs" value="var_password_min_len"/>
-<ref nist="IA-5" disa="205"/>
+<ref nist="IA-5(f)" disa="205"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -130,7 +130,7 @@ after satisfying the password reuse requirement.
 </rationale>
 <ident cce="27013-2" />
 <oval id="accounts_minimum_age_login_defs" value="var_password_min_age"/>
-<ref nist="IA-5" disa="198"/>
+<ref nist="IA-5(f)" disa="198"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -158,7 +158,7 @@ increases the risk of users writing down the password in a convenient
 location subject to physical compromise.</rationale>
 <ident cce="26985-2" />
 <oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/>
-<ref nist="IA-5" disa="180,199" />
+<ref nist="IA-5(f),IA-5(g)" disa="180,199" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
@@ -183,7 +183,7 @@ make the change at a practical time.
 </rationale>
 <ident cce="26988-6" />
 <oval id="accounts_password_warn_age_login_defs" value="var_password_warn_age" />
-<ref nist="IA-5" />
+<ref nist="IA-5(f)" />
 <tested by="DS" on="20121026"/>
 </Rule>
 </Group>
-- 
1.7.1



More information about the scap-security-guide mailing list