False Pass: PASS_MIN_DAYS /etc/login.defs

Robert Sanders rsanders at TrustedCS.com
Wed Aug 21 15:31:51 UTC 2013


I thought the values in login.defs are used at account creation, at least in regard to the min/max/warn/expire values.  Once the account is created the min/max/warn/expire/invalid fields of the users entry in /etc/shadow would be effective, but those values had to originate somewhere.  Just editing /etc/login.defs shouldn't impact existing accounts.

-Rob


From: scap-security-guide-bounces at lists.fedorahosted.org [scap-security-guide-bounces at lists.fedorahosted.org] on behalf of Maura Dailey [maura at eclipse.ncsc.mil]
Sent: Wednesday, August 21, 2013 11:21 AM
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: False Pass: PASS_MIN_DAYS  /etc/login.defs

High numbers for PASS_MIN_DAYS are to prevent password cycling for a
longer period, so the interpretation in this check is that higher values
than the profile calls for should be fine. (The STIG wants a value of 1,
but the common profiles want a value of 7, so it seems that there isn't
a clear consensus on what is the best value to deter password cycling.)
A value of 100 is obviously ridiculous, but the OVAL check (which isn't
configured to handle ranges) is written correctly *under the assumption*
that system administrators can choose higher values in an effort to curb
their users' bad behavior. If the assumption should be something
different, it's a simple 2 second fix to make the check only accept
exact values.

As for whether it should still exist at all, I think it should, in case
something dodgy happens and something is bypassing PAM. Obviously, other
people can chime in here.

- Maura Dailey

On 08/21/2013 10:55 AM, Stuart Green wrote:
> Just happened across this while I was modding an incorrect parameter.
>
> Rule password_min_age: PASS_MIN_DAYS in /etc/login.defs  seems to pass
> regardless of the number being higher than 1.  Mine was set to 7 and
> was passing, so I set it to 100 for another run through and it still
> passed.
>
> Note: I'm not sure if these login.defs are actually necessary, well
> not in a PAM environment.  When PAM's handling the restrictions
> login.defs is not involved.
> Citation: http://www.linuxmanpages.com/man5/login.defs.5.php  (bug
> section)
>
> Cheers,
> Stu
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide


More information about the scap-security-guide mailing list