[PATCH 47/64] Mapped IA-5(1)(e) to password_history_retain

Shawn Wells shawn.d.wells at gmail.com
Fri Apr 26 02:17:27 UTC 2013


-------------- next part --------------
>From 8777746dc8d732460fda0f71b8fec38d33c81200 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Thu, 25 Apr 2013 20:28:18 -0400
Subject: [PATCH 47/64] Mapped IA-5(1)(e) to password_history_retain
 - Updated XCCDF to reflect FISMA following DOD regulation of 24 passwords
 - Since DoD and FISMA both require a value of 24, setting that to default value

---
 RHEL6/input/system/accounts/pam.xml |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 1e82c6d..f9b6435 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -48,7 +48,7 @@ operator="equals" interactive="0">
 <tt>/etc/security/opasswd</tt> in order to force password change history and
 keep the user from alternating between the same password too
 frequently.</description>
-<value selector="">5</value>
+<value selector="">24</value>
 <value selector="0">0</value>
 <value selector="5">5</value>
 <value selector="10">10</value>
@@ -495,7 +495,7 @@ be accomplished by using the <tt>remember</tt> option for the <tt>pam_unix</tt>
 module.  In the file <tt>/etc/pam.d/system-auth</tt>, append <tt>remember=24</tt> to the 
 line which refers to the <tt>pam_unix.so</tt> module, as shown:
 <pre>password sufficient pam_unix.so <i>existing_options</i> remember=24</pre>
-The DoD requirement is 24 passwords.</description>
+The DoD and FISMA requirement is 24 passwords.</description>
 <ocil clause="it does not">
 To verify the password reuse setting is compliant, run the following command:
 <pre>$ grep remember /etc/pam.d/system-auth</pre>
@@ -507,7 +507,7 @@ Preventing re-use of previous passwords helps ensure that a compromised password
 </rationale>
 <ident cce="26741-9" />
 <oval id="accounts_password_reuse_limit" value="password_history_retain_number" />
-<ref nist="IA-5(f)" disa="200" />
+<ref nist="IA-5(f),IA-5(1)(e)" disa="200" />
 <tested by="DS" on="20121024"/>
 </Rule>
 </Group>
-- 
1.7.1



More information about the scap-security-guide mailing list