[PATCH 39/64] Refined IA-5 mappings in password_storage.xml

Shawn Wells shawn.d.wells at gmail.com
Fri Apr 26 02:15:26 UTC 2013


-------------- next part --------------
>From fc39cb5eb422709c794033811eb8c677d6d6b4bb Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 19:43:55 -0400
Subject: [PATCH 39/64] Refined IA-5 mappings in password_storage.xml
 Refined mappings for granularity:

a. Verifying, as part of the initial authenticator distribution, the identity of the individual and/or
device receiving the authenticator;
b. Establishing initial authenticator content for authenticators defined by the organization;
c. Ensuring that authenticators have sufficient strength of mechanism for their intended use;
d. Establishing and implementing administrative procedures for initial authenticator distribution,
for lost/compromised or damaged authenticators, and for revoking authenticators;
e. Changing default content of authenticators upon information system installation;
f. Establishing minimum and maximum lifetime restrictions and reuse conditions for
authenticators (if appropriate);
g. Changing/refreshing authenticators [Assignment: organization-defined time period by
authenticator type];
h. Protecting authenticator content from unauthorized disclosure and modification; and
i. Requiring users to take, and having devices implement, specific measures to safeguard
authenticators.
---
 .../accounts/restrictions/password_storage.xml     |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/RHEL6/input/system/accounts/restrictions/password_storage.xml b/RHEL6/input/system/accounts/restrictions/password_storage.xml
index 333e9a5..0df7f2c 100644
--- a/RHEL6/input/system/accounts/restrictions/password_storage.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_storage.xml
@@ -38,7 +38,7 @@ environments.
 </rationale>
 <ident cce="27038-9" />
 <oval id="accounts_pam_no_nullok" />
-<ref nist="IA-5" />
+<ref nist="IA-5(b),IA-5(c)" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -64,7 +64,7 @@ which is readable by all users.
 </rationale>
 <ident cce="26476-2" />
 <oval id="accounts_password_all_shadowed" />
-<ref nist="IA-5" disa="201" />
+<ref nist="IA-5(h)" disa="201" />
 <tested by="DS" on="20121024"/>
 </Rule>
 
@@ -107,7 +107,7 @@ in access scripts.
 </rationale>
 <ident cce="27225-2" />
 <oval id="TODO" />
-<ref nist="IA-5" disa="196" />
+<ref nist="IA-5(h)" disa="196" />
 </Rule>
 
 </Group>
-- 
1.7.1



More information about the scap-security-guide mailing list