[PATCH 43/64] Mapped IA-5(1)(d) to password min/max length rules
Shawn Wells
shawn.d.wells at gmail.com
Fri Apr 26 02:16:21 UTC 2013
-------------- next part --------------
>From e7d569dc7a8bbf392c2adef1557910155db2b3e9 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 20:11:56 -0400
Subject: [PATCH 43/64] Mapped IA-5(1)(d) to password min/max length rules
---
.../accounts/restrictions/password_expiration.xml | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index 5b45aa1..099b4aa 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -122,7 +122,7 @@ The DoD requirement is 1.
<ocil clause="it is not set to the required value">
To check the minimum password age, run the command:
<pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
-The DoD requirement is 1.
+The DoD and FISMA requirement is 1.
</ocil>
<rationale>
Setting the minimum password age protects against
@@ -131,7 +131,7 @@ after satisfying the password reuse requirement.
</rationale>
<ident cce="27013-2" />
<oval id="accounts_minimum_age_login_defs" value="var_password_min_age"/>
-<ref nist="IA-5(f)" disa="198"/>
+<ref nist="IA-5(f),IA-5(1)(d)" disa="198"/>
<tested by="DS" on="20121026"/>
</Rule>
@@ -148,7 +148,7 @@ The DoD requirement is 60.
<ocil clause="it is not set to the required value">
To check the maximum password age, run the command:
<pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
-The DoD requirement is 60.
+The DoD and FISMA requirement is 60.
A value of 180 days is sufficient for many environments.
</ocil>
<rationale>
@@ -159,7 +159,7 @@ increases the risk of users writing down the password in a convenient
location subject to physical compromise.</rationale>
<ident cce="26985-2" />
<oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/>
-<ref nist="IA-5(f),IA-5(g)" disa="180,199" />
+<ref nist="IA-5(f),IA-5(g),IA-5(1)(d)" disa="180,199" />
<tested by="DS" on="20121026"/>
</Rule>
--
1.7.1
More information about the scap-security-guide
mailing list