[PATCH 03/31] Renamed password_require_specials to

Shawn Wells shawn at redhat.com
Fri Dec 27 23:26:43 UTC 2013


-------------- next part --------------
>From a4f67dbf25920dba03ba8ea8d98a647a336d2016 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Tue, 24 Dec 2013 02:59:26 -0500
Subject: [PATCH 03/31] Renamed password_require_specials to
 accounts_password_pam_cracklib_ocredit, added to shared/

- Renamed XCCDF rule to reflect granular configuration setting, vs broader requirement

- Moved OVAL to shared/

- Tested on RHEL7, updated CPE
---
 RHEL/6/input/auxiliary/stig_overlay.xml            |   2 +-
 .../accounts_password_pam_cracklib_ocredit.xml     |  44 +--------------------
 RHEL/6/input/profiles/CS2.xml                      |   2 +-
 RHEL/6/input/profiles/common.xml                   |   2 +-
 .../6/input/profiles/fisma-medium-rhel6-server.xml |   2 +-
 RHEL/6/input/profiles/rht-ccp.xml                  |   2 +-
 RHEL/6/input/profiles/usgcb-rhel6-server.xml       |   2 +-
 RHEL/6/input/system/accounts/pam.xml               |   2 +-
 .../accounts_password_pam_cracklib_ocredit.xml     |   1 +
 RHEL/7/input/profiles/.rht-ccp.xml.swp             | Bin 20480 -> 0 bytes
 .../accounts_password_pam_cracklib_ocredit.xml     |  44 +++++++++++++++++++++
 11 files changed, 53 insertions(+), 50 deletions(-)
 mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml
 create mode 120000 RHEL/7/input/checks/accounts_password_pam_cracklib_ocredit.xml
 delete mode 100644 RHEL/7/input/profiles/.rht-ccp.xml.swp
 create mode 100644 shared/oval/accounts_password_pam_cracklib_ocredit.xml

diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml
index 08a0424..b2416cc 100644
--- a/RHEL/6/input/auxiliary/stig_overlay.xml
+++ b/RHEL/6/input/auxiliary/stig_overlay.xml
@@ -176,7 +176,7 @@
 		<VMSinfo VKey="38569" SVKey="50370" VRelease="1" />
 		<title>The system must require passwords to contain at least one uppercase alphabetic character.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="password_require_specials" ownerid="RHEL-06-000058" disa="1619" severity="low">
+	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_ocredit" ownerid="RHEL-06-000058" disa="1619" severity="low">
 		<VMSinfo VKey="38570" SVKey="50371" VRelease="1" />
 		<title>The system must require passwords to contain at least one special character.</title>
 	</overlay>
diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml
deleted file mode 100644
index 8a3c115..0000000
--- a/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml
+++ /dev/null
@@ -1,43 +0,0 @@
-<def-group>
-  <definition class="compliance" id="accounts_password_pam_cracklib_ocredit" version="1">
-    <metadata>
-      <title>Set Password ocredit Requirements</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The password ocredit should meet minimum
-      requirements using pam_cracklib</description>
-      <reference source="DS" ref_id="20131011" ref_url="test_attestation" />
-    </metadata>
-    <criteria>
-      <criterion comment="Conditions for ocredit are satisfied"
-      test_ref="test_password_pam_cracklib_ocredit" />
-    </criteria>
-  </definition>
-
-  <ind:textfilecontent54_test check="all"
-  comment="check the configuration of /etc/pam.d/system-auth"
-  id="test_password_pam_cracklib_ocredit" version="1">
-    <ind:object object_ref="obj_password_pam_cracklib_ocredit" />
-    <ind:state state_ref="state_password_pam_cracklib_ocredit" />
-  </ind:textfilecontent54_test>
-
-  <ind:textfilecontent54_state id="state_password_pam_cracklib_ocredit"
-  version="1">
-    <ind:instance datatype="int">1</ind:instance>
-    <ind:subexpression datatype="int"
-    operation="less than or equal"
-    var_ref="var_password_pam_cracklib_ocredit" />
-  </ind:textfilecontent54_state>
-
-  <external_variable comment="External variable for pam_cracklib ocredit"
-  datatype="int" id="var_password_pam_cracklib_ocredit"
-  version="1" />
-
-  <ind:textfilecontent54_object id="obj_password_pam_cracklib_ocredit"
-  version="1">
-    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
-    <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]ocredit=(-?\d+)(?:[\s]|$)</ind:pattern>
-    <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
-  </ind:textfilecontent54_object>
-</def-group>
diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml
new file mode 120000
index 0000000..6355aa0
--- /dev/null
+++ b/RHEL/6/input/checks/accounts_password_pam_cracklib_ocredit.xml
@@ -0,0 +1 @@
+../../../../shared/oval/accounts_password_pam_cracklib_ocredit.xml
\ No newline at end of file
diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml
index 375a4cc..b615f09 100644
--- a/RHEL/6/input/profiles/CS2.xml
+++ b/RHEL/6/input/profiles/CS2.xml
@@ -10,7 +10,7 @@
 <refine-value idref="var_acounts_maximum_age_login_defs" selector="180"/>
 <select idref="accounts_password_pam_cracklib_dcredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
-<select idref="password_require_specials" selected="true"/>
+<select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
 <select idref="password_require_lowercases" selected="true"/>
 <select idref="password_require_diffchars" selected="true"/>
 <select idref="accounts_password_reuse_limit" selected="true"/>
diff --git a/RHEL/6/input/profiles/common.xml b/RHEL/6/input/profiles/common.xml
index 6d38c66..e6987ff 100644
--- a/RHEL/6/input/profiles/common.xml
+++ b/RHEL/6/input/profiles/common.xml
@@ -54,7 +54,7 @@
 <select idref="accounts_password_pam_cracklib_retry" selected="true"/>
 <select idref="accounts_password_pam_cracklib_dcredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
-<select idref="password_require_specials" selected="true"/>
+<select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
 <select idref="password_require_lowercases" selected="true"/>
 <select idref="password_require_diffchars" selected="true"/>
 <select idref="deny_password_attempts" selected="true"/>
diff --git a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
index eec8086..b5d860d 100644
--- a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
@@ -279,7 +279,7 @@
 <select idref="accounts_password_pam_cracklib_retry" selected="true" />
 <select idref="password_require_consecrepeat" selected="true" />
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true" />
-<select idref="password_require_specials" selected="true" />
+<select idref="accounts_password_pam_cracklib_ocredit" selected="true" />
 <select idref="password_require_lowercases" selected="true" />
 <select idref="password_require_diffchars" selected="true" />
 <refine-value idref="var_password_history_retain_limit" selector="24" />
diff --git a/RHEL/6/input/profiles/rht-ccp.xml b/RHEL/6/input/profiles/rht-ccp.xml
index 48d9bb3..ef14e6d 100644
--- a/RHEL/6/input/profiles/rht-ccp.xml
+++ b/RHEL/6/input/profiles/rht-ccp.xml
@@ -56,7 +56,7 @@
 <select idref="accounts_password_pam_cracklib_retry" selected="true"/>
 <select idref="accounts_password_pam_cracklib_dcredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
-<select idref="password_require_specials" selected="true"/>
+<select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
 <select idref="password_require_lowercases" selected="true"/>
 <select idref="password_require_diffchars" selected="true"/>
 <select idref="deny_password_attempts" selected="true"/>
diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
index 8432dd0..e323b38 100644
--- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
@@ -79,7 +79,7 @@
 <refine-value idref="var_password_pam_cracklib_lcredit" selector="1" />
 <select idref="password_require_lowercases" selected="true" />
 <refine-value idref="var_password_pam_cracklib_ocredit" selector="1" />
-<select idref="password_require_specials" selected="true" />
+<select idref="accounts_password_pam_cracklib_ocredit" selected="true" />
 <refine-value idref="var_password_pam_cracklib_difok" selector="3" />
 <select idref="password_require_diffchars" selected="true" />
 <refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="5" />
diff --git a/RHEL/6/input/system/accounts/pam.xml b/RHEL/6/input/system/accounts/pam.xml
index f7cba14..aeecc28 100644
--- a/RHEL/6/input/system/accounts/pam.xml
+++ b/RHEL/6/input/system/accounts/pam.xml
@@ -317,7 +317,7 @@ more difficult by ensuring a larger search space.
 <tested by="DS" on="20121024"/>
 </Rule>
 
-<Rule id="password_require_specials">
+<Rule id="accounts_password_pam_cracklib_ocredit">
 <title>Set Password Strength Minimum Special Characters</title>
 <description>The pam_cracklib module's <tt>ocredit=</tt> parameter controls requirements for
 usage of special (or ``other'') characters in a password. When set to a negative number, any password will be required to
diff --git a/RHEL/7/input/checks/accounts_password_pam_cracklib_ocredit.xml b/RHEL/7/input/checks/accounts_password_pam_cracklib_ocredit.xml
new file mode 120000
index 0000000..6355aa0
--- /dev/null
+++ b/RHEL/7/input/checks/accounts_password_pam_cracklib_ocredit.xml
@@ -0,0 +1 @@
+../../../../shared/oval/accounts_password_pam_cracklib_ocredit.xml
\ No newline at end of file
diff --git a/RHEL/7/input/profiles/.rht-ccp.xml.swp b/RHEL/7/input/profiles/.rht-ccp.xml.swp
deleted file mode 100644
index 97717044d1504ade012cc16cd29c2b0745d565a9..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 20480
zcmeHOON<;x8Eyy=2sW`C#Dz;|iBRHXcl;n;C#+Yj#uIxL at 54L05g>(9O?S;qXM4Ij
zRn at aQ5lT2AMFcqn2`(H^0Et|3;UPdEq!0-uxdb8Q01{G;0fGpKi+zBv`Z2HVneCpn
zgcQ}tpU3N&|F6Hks`~5ys%smkA6s3s7Z*Nf;dR2YZhYYvTi>_8Y5i!$vSgd?1^WLF
zdHLL-ew$0R5dX{N9qQ%TRk~DE_V)HFZPoEB(xKtJWKJYJ)thfcp35p*S87))ixn>j
zBUK3nZ+bqH7137njuS5Icl<*lF&`TS3<J3gM5;M|;rPzEvu950&p$JFw|&>io!qaQ
z|1=C31`Gp+0mFb{z%XDKFbo(5-k%Jp at HXoibnSy__Z~{$KQQ+Gq4ejEr|%cXKEEyf
z`BM6RdF=D_NAqSFFbo(53<HJ%!+>GHFkl!k3>XFs1BL;^!2f{(>RQ$d5dSY|0gvbZ
zng0LvotEVT$AEV~VOcK&PXPA<Zy&d;?*SXYCxJJPS=Lv9Mc|(}Ab1IA0G|fly2G-r
z1Dn8c;27}U$1LkNz_Y+L;4a`KaO0zv^<!Wkr~-ex-Ln1)yaT)mTnDZJ$AC9JVp*>P
zuK~{k*8v}R0C?xami1Gh2Yep*4-PMW0_+0!0Dnebb$`DFJO_Bd1>h!lcm?PJ_XB^y
zA;=Gb9{|q*+rR}Nel1DnGe_B;D_Ha5TqK#`djS(fwx at hVUA{;3t%f-}v1jhZIVB=C
zS6Q|mS-o1bH)~sKtM&To#=2d-QmZ~%x2!RLf;|~|f)VKjEuZOz35`@c&*PY-WQv4T
z$~`Vz(x$Qv4}|(Hjw=}L4)MK)_U7=Qc?+EJmKV6JDUa?-_M~E+f_-#Z&>M7;Dp-c9
zNDzHuGJajJ*>u`e%w+8IJupcn%dE$Sf;tY50wo8bhBW at lQh_gah$E=8i}50nBbe){
z0wm|PIONE^RgMHxqBm1KdsGC3wixmC+#v-gPrqLsFYr21=LjD9Qvj}f7R(q&zzHrh
z5w`EJP?4vQ7YeWeBfTJ*Bs@|QccG9+bh0RBs^|D%)@M^r4JVheX@&OCn(rr6H#zcF
zvdYqVS)koM at qOBa&PGThoe2~2?)iCprCQzCS>LwTR at PT8*VbzIXOida`T6Aoxh}*s
z*E51 at M!Y~O>if*i3+{j^3uJ^W*$P`un>o8AU|nQN*ORm{!NnLw;|^LrZ=m at ep^oyp
z6zt~3G3F$@;D&Xs5QijDNE9b7%nMkjAz+EOsnT89WxeS%ENPB+HZQGgudZJnVb+R2
z5*YMFyCL{4d)Ph at tM3KTK6V5ji?8cBEWUq7eA>WXm)F~P%qDmVx$ikW)eDPs6q{k(
zGzNGAF}h#Vf at gsqSCTnuaISn#T_$p9PQun6>$R(^>pNc at A!@8YAr;C~9uJ6KCAh+<
z(*kzfVp%uWIwz#@P5yvgX&coEb8U3Db)`}NQhmF&HrjKPGG4&uyVQ?ZR at o#OqCo>)
z+$gr+-)p$gWlzg#=uAx`U+EfVDbIx_t)DI8f+gxuxtoQj9i3iWoNC_BF>OyOE_wvp
z3~rf at CL8VO!D4PgI=uIJO+FIMxfz`JqZ_D><?IY at _^oj>Ru{|~%~(~S-JF at BQzJEj
zb~2sd{#@yg`jpZ at yPH0D`tGJz2!}iBhtr|RlC6GX)0PjNp2|x<hJlYsHHP+fexfre
z+b;23q&nqw7>Wg?B&^oqwe%oCM<a#ObJBv;d7ZQbkHSQ=V2vlK{(vumJUZRYkv!<k
zkfrQo!yp0ejPyoP(PDbDoz$6OA0zvRCXxln+75J1Y_4-(bz}XJ)yq3u*dd{@Ha7KJ
zJ=qalCLQ60I at vF8BhlFSL+w+ppiOnku2)w!?etQ*4X^eVbL}fs*;R%eqUqtMs?Q_W
z-W0rxdPT^k%CJXk3Hyl8miuO0gj`_1(*~OU*y%)P_PtwI>}qxMzNJdy$6CtlJc!8j
zlKh;FTk?UtIM-Gxe7I7HYabsuQ!WJfd!fa<m3_x?o0T&QXXchIt^XIHX&vZYt^Y5j
z^7i-8{m%lMz^8z>q5EF~Lf|ZL6T1I*!1KT+a1!_<^#6B&$AQlR|A7AgIq)^$8Gr-l
zfdAqQ;8(!YKoz(hcn$jh8^Ahn0=N^ni8FxLf$sv31NQ*$Li_&~&}RW(0qzHGK=Z!>
zd>e3pQ^3EW`+o^M4OD?UfImR{zX|*d=m9IhG2ks|{}+Kaa3An at aPcxAfB?|kGywCO
ziGig`I!~7^UE+_GS8+bmvVn#n)(vxs<ArT3o-CtH5izl?%Spg-uE7Lk2Z^f-7IceR
zr)8twU-V%}QsxvjPQ?T%FTaw=6D>k?j!m>?frhg-_3zshKKIdkMrJ6qWnp&pk<l(=
zA@#j(KP?|NB-&_riz?8qm=FjL9FOq;8Vhqlafkb7^K9$&D|W at +s;zBo*R-Il)$3^;
zdq4%^JWC51BG7#&;~-DU9GI7>;gg}~_Q at +_$X)jd-k8ZWP at xuxvxJLNGTxLkS*n?0
zr43QeFq?<8OWR)F=#C|b?E9*z@&!$DkebPr2<tdLCLr1XzhEXH`%5&_3mZ7MEMPEb
zs2A#13YcVF5wWH!W5D*AQ|9}!$Z_zX2ST>XGo_dxV4<fgtUz>w_J&Lg4bH%FANo`k
z8J>*m$p$Oy+pE`hR<>)Ga15~Z*ecS<f%LJ<M8JH~;cgUH++nF4GHNZ{QtNWmSUM^!
zv#Lj}UHtlF8S6NKhf1HQAm&8f69EbejB=K7QAa2C$rf8=%m$|COWTfi*bBSo36CrJ
zGW|}g0lnJraD at 3qf=+D&4e*Pv-ct;Ej7XeY=5qCDZEL-D74vOdpU)kfZ-Zm2{)2%6
zl*hG?l#neFsxE4ff{$=w1xOMBSH><bvdWvqXJ)$4!BY=ittAl`=wB>X<MuErAwhzs
zI016KLPcV1Jk;JS=7YBJ%taif at sjpBZat<@>JuLuj_sF2vc8m^9 at K11OEh<YUZ$L6
z?iN`*L&3%eBW}@N4x%k*mlB#hTq)YvP?W85mV+=$8s^ek_>s_1z=y=E_5YWl-CqQ>
z{)aq|U#~**e;rr_P5`e$^Y?%UfPdk;?*V_x>{1)^W*9IG7zPXjh5^HXVZbn87%&VN
t1`Gp7VPH(&4;1Ag%Ff&-&cEgSzPL?1?P_QLhDmmjS%%E<sGs}H?|%<gmyrMf

diff --git a/shared/oval/accounts_password_pam_cracklib_ocredit.xml b/shared/oval/accounts_password_pam_cracklib_ocredit.xml
new file mode 100644
index 0000000..e4077ac
--- /dev/null
+++ b/shared/oval/accounts_password_pam_cracklib_ocredit.xml
@@ -0,0 +1,44 @@
+<def-group>
+  <definition class="compliance" id="accounts_password_pam_cracklib_ocredit" version="1">
+    <metadata>
+      <title>Set Password ocredit Requirements</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+        <platform>Red Hat Enterprise Linux 7</platform>
+      </affected>
+      <description>The password ocredit should meet minimum
+      requirements using pam_cracklib</description>
+      <reference source="DS" ref_id="20131011" ref_url="test_attestation" />
+    </metadata>
+    <criteria>
+      <criterion comment="Conditions for ocredit are satisfied"
+      test_ref="test_password_pam_cracklib_ocredit" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all"
+  comment="check the configuration of /etc/pam.d/system-auth"
+  id="test_password_pam_cracklib_ocredit" version="1">
+    <ind:object object_ref="obj_password_pam_cracklib_ocredit" />
+    <ind:state state_ref="state_password_pam_cracklib_ocredit" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_state id="state_password_pam_cracklib_ocredit"
+  version="1">
+    <ind:instance datatype="int">1</ind:instance>
+    <ind:subexpression datatype="int"
+    operation="less than or equal"
+    var_ref="var_password_pam_cracklib_ocredit" />
+  </ind:textfilecontent54_state>
+
+  <external_variable comment="External variable for pam_cracklib ocredit"
+  datatype="int" id="var_password_pam_cracklib_ocredit"
+  version="1" />
+
+  <ind:textfilecontent54_object id="obj_password_pam_cracklib_ocredit"
+  version="1">
+    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]ocredit=(-?\d+)(?:[\s]|$)</ind:pattern>
+    <ind:instance datatype="int" operation="less than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
-- 
1.8.3.1



More information about the scap-security-guide mailing list