False Pass: PASS_MIN_DAYS /etc/login.defs

Stuart Green stuart.green at doccentrics.com
Wed Aug 21 15:55:37 UTC 2013


Maura - Thanks for that comprehensive reply. Yes that makes sense.

Rob - You could indeed be correct there.


Cheers,
Stu


On 21/08/2013 16:31, Robert Sanders wrote:
> I thought the values in login.defs are used at account creation, at least in regard to the min/max/warn/expire values.  Once the account is created the min/max/warn/expire/invalid fields of the users entry in /etc/shadow would be effective, but those values had to originate somewhere.  Just editing /etc/login.defs shouldn't impact existing accounts.
>
> -Rob
>
>
> From: scap-security-guide-bounces at lists.fedorahosted.org [scap-security-guide-bounces at lists.fedorahosted.org] on behalf of Maura Dailey [maura at eclipse.ncsc.mil]
> Sent: Wednesday, August 21, 2013 11:21 AM
> To: scap-security-guide at lists.fedorahosted.org
> Subject: Re: False Pass: PASS_MIN_DAYS  /etc/login.defs
>
> High numbers for PASS_MIN_DAYS are to prevent password cycling for a
> longer period, so the interpretation in this check is that higher values
> than the profile calls for should be fine. (The STIG wants a value of 1,
> but the common profiles want a value of 7, so it seems that there isn't
> a clear consensus on what is the best value to deter password cycling.)
> A value of 100 is obviously ridiculous, but the OVAL check (which isn't
> configured to handle ranges) is written correctly *under the assumption*
> that system administrators can choose higher values in an effort to curb
> their users' bad behavior. If the assumption should be something
> different, it's a simple 2 second fix to make the check only accept
> exact values.
>
> As for whether it should still exist at all, I think it should, in case
> something dodgy happens and something is bypassing PAM. Obviously, other
> people can chime in here.
>
> - Maura Dailey
>
> On 08/21/2013 10:55 AM, Stuart Green wrote:
>> Just happened across this while I was modding an incorrect parameter.
>>
>> Rule password_min_age: PASS_MIN_DAYS in /etc/login.defs  seems to pass
>> regardless of the number being higher than 1.  Mine was set to 7 and
>> was passing, so I set it to 100 for another run through and it still
>> passed.
>>
>> Note: I'm not sure if these login.defs are actually necessary, well
>> not in a PAM environment.  When PAM's handling the restrictions
>> login.defs is not involved.
>> Citation: http://www.linuxmanpages.com/man5/login.defs.5.php  (bug
>> section)
>>
>> Cheers,
>> Stu
>>
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list