False Pass: PASS_MIN_DAYS /etc/login.defs
Robert Sanders
rsanders at TrustedCS.com
Wed Aug 21 15:31:51 UTC 2013
I thought the values in login.defs are used at account creation, at least in regard to the min/max/warn/expire values. Once the account is created the min/max/warn/expire/invalid fields of the users entry in /etc/shadow would be effective, but those values had to originate somewhere. Just editing /etc/login.defs shouldn't impact existing accounts.
-Rob
From: scap-security-guide-bounces at lists.fedorahosted.org [scap-security-guide-bounces at lists.fedorahosted.org] on behalf of Maura Dailey [maura at eclipse.ncsc.mil]
Sent: Wednesday, August 21, 2013 11:21 AM
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: False Pass: PASS_MIN_DAYS /etc/login.defs
High numbers for PASS_MIN_DAYS are to prevent password cycling for a
longer period, so the interpretation in this check is that higher values
than the profile calls for should be fine. (The STIG wants a value of 1,
but the common profiles want a value of 7, so it seems that there isn't
a clear consensus on what is the best value to deter password cycling.)
A value of 100 is obviously ridiculous, but the OVAL check (which isn't
configured to handle ranges) is written correctly *under the assumption*
that system administrators can choose higher values in an effort to curb
their users' bad behavior. If the assumption should be something
different, it's a simple 2 second fix to make the check only accept
exact values.
As for whether it should still exist at all, I think it should, in case
something dodgy happens and something is bypassing PAM. Obviously, other
people can chime in here.
- Maura Dailey
On 08/21/2013 10:55 AM, Stuart Green wrote:
> Just happened across this while I was modding an incorrect parameter.
>
> Rule password_min_age: PASS_MIN_DAYS in /etc/login.defs seems to pass
> regardless of the number being higher than 1. Mine was set to 7 and
> was passing, so I set it to 100 for another run through and it still
> passed.
>
> Note: I'm not sure if these login.defs are actually necessary, well
> not in a PAM environment. When PAM's handling the restrictions
> login.defs is not involved.
> Citation: http://www.linuxmanpages.com/man5/login.defs.5.php (bug
> section)
>
> Cheers,
> Stu
>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
_______________________________________________
scap-security-guide mailing list
scap-security-guide at lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
More information about the scap-security-guide
mailing list