[PATCH 06/31] Renamed XCCDF password_require_diffchars to
Shawn Wells
shawn at redhat.com
Fri Dec 27 23:26:59 UTC 2013
-------------- next part --------------
>From b225c50d538f0d409fcfde6ff3aac4fe5a676af7 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Tue, 24 Dec 2013 03:16:35 -0500
Subject: [PATCH 06/31] Renamed XCCDF password_require_diffchars to
accounts_password_pam_cracklib_difok.xml, added to shared/
- Renamed XCCDF rule to reflect granular configuration setting vs broader requirement
- Moved OVAL to shared/
- Tested on RHEL7, updated CPE info
---
RHEL/6/input/auxiliary/stig_overlay.xml | 2 +-
.../accounts_password_pam_cracklib_difok.xml | 39 +---------------------
RHEL/6/input/profiles/CS2.xml | 2 +-
RHEL/6/input/profiles/common.xml | 2 +-
.../6/input/profiles/fisma-medium-rhel6-server.xml | 4 +--
RHEL/6/input/profiles/rht-ccp.xml | 2 +-
RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +-
RHEL/6/input/system/accounts/pam.xml | 2 +-
RHEL/7/input/auxiliary/stig_overlay.xml | 2 +-
.../accounts_password_pam_cracklib_difok.xml | 1 +
RHEL/7/input/profiles/rht-ccp.xml | 2 +-
RHEL/7/input/system/accounts/pam.xml | 2 +-
.../oval/accounts_password_pam_cracklib_difok.xml | 38 +++++++++++++++++++++
13 files changed, 51 insertions(+), 49 deletions(-)
mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml
create mode 120000 RHEL/7/input/checks/accounts_password_pam_cracklib_difok.xml
create mode 100644 shared/oval/accounts_password_pam_cracklib_difok.xml
diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml
index d89720c..0e77ee6 100644
--- a/RHEL/6/input/auxiliary/stig_overlay.xml
+++ b/RHEL/6/input/auxiliary/stig_overlay.xml
@@ -184,7 +184,7 @@
<VMSinfo VKey="38571" SVKey="50372" VRelease="1" />
<title>The system must require passwords to contain at least one lowercase alphabetic character.</title>
</overlay>
- <overlay owner="disastig" ruleid="password_require_diffchars" ownerid="RHEL-06-000060" disa="195" severity="low">
+ <overlay owner="disastig" ruleid="accounts_password_pam_cracklib_difok" ownerid="RHEL-06-000060" disa="195" severity="low">
<VMSinfo VKey="38572" SVKey="50373" VRelease="1" />
<title>The system must require at least four characters be changed between the old and new passwords during a password change.</title>
</overlay>
diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml
deleted file mode 100644
index 80fd21e..0000000
--- a/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml
+++ /dev/null
@@ -1,38 +0,0 @@
-<def-group>
- <definition class="compliance" id="accounts_password_pam_cracklib_difok" version="1">
- <metadata>
- <title>Set Password difok Requirements</title>
- <affected family="unix">
- <platform>Red Hat Enterprise Linux 6</platform>
- </affected>
- <description>The password difok should meet minimum
- requirements using pam_cracklib</description>
- <reference source="DS" ref_id="20131011" ref_url="test_attestation" />
- </metadata>
- <criteria>
- <criterion comment="Conditions for difok are satisfied"
- test_ref="test_accounts_password_pam_cracklib_difok" />
- </criteria>
- </definition>
-
- <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="test_accounts_password_pam_cracklib_difok" version="1">
- <ind:object object_ref="object_accounts_password_pam_cracklib_difok" />
- <ind:state state_ref="state_accounts_password_pam_cracklib_difok" />
- </ind:textfilecontent54_test>
-
- <external_variable comment="External variable for pam_cracklib difok"
- datatype="int" id="var_password_pam_cracklib_difok" version="1" />
-
- <ind:textfilecontent54_object id="object_accounts_password_pam_cracklib_difok" version="1">
- <ind:path>/etc/pam.d</ind:path>
- <ind:filename>system-auth</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]difok=(-?\d+)(?:[\s]|$)</ind:pattern>
- <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
- </ind:textfilecontent54_object>
-
- <ind:textfilecontent54_state id="state_accounts_password_pam_cracklib_difok" version="1">
- <ind:instance datatype="int">1</ind:instance>
- <ind:subexpression datatype="int" operation="greater than or equal" var_ref="var_password_pam_cracklib_difok" />
- </ind:textfilecontent54_state>
-
-</def-group>
diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml
new file mode 120000
index 0000000..ca78167
--- /dev/null
+++ b/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml
@@ -0,0 +1 @@
+../../../../shared/oval/accounts_password_pam_cracklib_difok.xml
\ No newline at end of file
diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml
index fc348ae..8bb284c 100644
--- a/RHEL/6/input/profiles/CS2.xml
+++ b/RHEL/6/input/profiles/CS2.xml
@@ -12,7 +12,7 @@
<select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
<select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
<select idref="accounts_password_pam_cracklib_lcredit" selected="true"/>
-<select idref="password_require_diffchars" selected="true"/>
+<select idref="accounts_password_pam_cracklib_difok" selected="true"/>
<select idref="accounts_password_reuse_limit" selected="true"/>
<refine-value idref="var_password_history_retain_limit" selector="10"/>
<select idref="accounts_password_warn_age_login_defs" selected="true"/>
diff --git a/RHEL/6/input/profiles/common.xml b/RHEL/6/input/profiles/common.xml
index 01ad314..3944bd4 100644
--- a/RHEL/6/input/profiles/common.xml
+++ b/RHEL/6/input/profiles/common.xml
@@ -56,7 +56,7 @@
<select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
<select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
<select idref="accounts_password_pam_cracklib_lcredit" selected="true"/>
-<select idref="password_require_diffchars" selected="true"/>
+<select idref="accounts_password_pam_cracklib_difok" selected="true"/>
<select idref="deny_password_attempts" selected="true"/>
<select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
<select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
diff --git a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
index 7522ca2..16d7d29 100644
--- a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
@@ -281,7 +281,7 @@
<select idref="accounts_password_pam_cracklib_ucredit" selected="true" />
<select idref="accounts_password_pam_cracklib_ocredit" selected="true" />
<select idref="accounts_password_pam_cracklib_lcredit" selected="true" />
-<select idref="password_require_diffchars" selected="true" />
+<select idref="accounts_password_pam_cracklib_difok" selected="true" />
<refine-value idref="var_password_history_retain_limit" selector="24" />
<select idref="accounts_password_reuse_limit" selected="true" />
<select idref="set_password_hashing_algorithm_systemauth" selected="true" />
@@ -297,6 +297,6 @@
<select idref="accounts_password_warn_age_login_defs" selected="true" />
<select idref="require_singleuser_auth" selected="true" />
<refine-value idref="var_password_pam_cracklib_difok" selector="1" />
-<select idref="password_require_diffchars" selected="true" />
+<select idref="accounts_password_pam_cracklib_difok" selected="true" />
</Profile>
diff --git a/RHEL/6/input/profiles/rht-ccp.xml b/RHEL/6/input/profiles/rht-ccp.xml
index d5f983a..9040055 100644
--- a/RHEL/6/input/profiles/rht-ccp.xml
+++ b/RHEL/6/input/profiles/rht-ccp.xml
@@ -58,7 +58,7 @@
<select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
<select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
<select idref="accounts_password_pam_cracklib_lcredit" selected="true"/>
-<select idref="password_require_diffchars" selected="true"/>
+<select idref="accounts_password_pam_cracklib_difok" selected="true"/>
<select idref="deny_password_attempts" selected="true"/>
<select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
<select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
index 704aa62..4693fae 100644
--- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
@@ -81,7 +81,7 @@
<refine-value idref="var_password_pam_cracklib_ocredit" selector="1" />
<select idref="accounts_password_pam_cracklib_ocredit" selected="true" />
<refine-value idref="var_password_pam_cracklib_difok" selector="3" />
-<select idref="password_require_diffchars" selected="true" />
+<select idref="accounts_password_pam_cracklib_difok" selected="true" />
<refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="5" />
<select idref="deny_password_attempts" selected="true" />
<select idref="set_password_hashing_algorithm_systemauth" selected="true" />
diff --git a/RHEL/6/input/system/accounts/pam.xml b/RHEL/6/input/system/accounts/pam.xml
index fb3a72e..f566344 100644
--- a/RHEL/6/input/system/accounts/pam.xml
+++ b/RHEL/6/input/system/accounts/pam.xml
@@ -367,7 +367,7 @@ more difficult by ensuring a larger search space.
<tested by="DS" on="20121024"/>
</Rule>
-<Rule id="password_require_diffchars">
+<Rule id="accounts_password_pam_cracklib_difok">
<title>Set Password Strength Minimum Different Characters</title>
<description>The pam_cracklib module's <tt>difok</tt> parameter controls requirements for
usage of different characters during a password change.
diff --git a/RHEL/7/input/auxiliary/stig_overlay.xml b/RHEL/7/input/auxiliary/stig_overlay.xml
index 32eb751..721e4b9 100644
--- a/RHEL/7/input/auxiliary/stig_overlay.xml
+++ b/RHEL/7/input/auxiliary/stig_overlay.xml
@@ -184,7 +184,7 @@
<VMSinfo VKey="38571" SVKey="50372" VRelease="1" />
<title>The system must require passwords to contain at least one lowercase alphabetic character.</title>
</overlay>
- <overlay owner="disastig" ruleid="password_require_diffchars" ownerid="RHEL-06-000060" disa="195" severity="low">
+ <overlay owner="disastig" ruleid="accounts_password_pam_cracklib_difok" ownerid="RHEL-06-000060" disa="195" severity="low">
<VMSinfo VKey="38572" SVKey="50373" VRelease="1" />
<title>The system must require at least four characters be changed between the old and new passwords during a password change.</title>
</overlay>
diff --git a/RHEL/7/input/checks/accounts_password_pam_cracklib_difok.xml b/RHEL/7/input/checks/accounts_password_pam_cracklib_difok.xml
new file mode 120000
index 0000000..ca78167
--- /dev/null
+++ b/RHEL/7/input/checks/accounts_password_pam_cracklib_difok.xml
@@ -0,0 +1 @@
+../../../../shared/oval/accounts_password_pam_cracklib_difok.xml
\ No newline at end of file
diff --git a/RHEL/7/input/profiles/rht-ccp.xml b/RHEL/7/input/profiles/rht-ccp.xml
index fc36e04..f761500 100644
--- a/RHEL/7/input/profiles/rht-ccp.xml
+++ b/RHEL/7/input/profiles/rht-ccp.xml
@@ -57,7 +57,7 @@
<select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
<select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
<select idref="accounts_password_pam_cracklib_lcredit" selected="true"/>
-<select idref="password_require_diffchars" selected="true"/>
+<select idref="accounts_password_pam_cracklib_difok" selected="true"/>
<select idref="deny_password_attempts" selected="true"/>
<select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
<select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
diff --git a/RHEL/7/input/system/accounts/pam.xml b/RHEL/7/input/system/accounts/pam.xml
index 2e0243e..d17c439 100644
--- a/RHEL/7/input/system/accounts/pam.xml
+++ b/RHEL/7/input/system/accounts/pam.xml
@@ -367,7 +367,7 @@ more difficult by ensuring a larger search space.
<tested by="DS" on="20121024"/>
</Rule>
-<Rule id="password_require_diffchars">
+<Rule id="accounts_password_pam_cracklib_difok">
<title>Set Password Strength Minimum Different Characters</title>
<description>The pam_cracklib module's <tt>difok</tt> parameter controls requirements for
usage of different characters during a password change.
diff --git a/shared/oval/accounts_password_pam_cracklib_difok.xml b/shared/oval/accounts_password_pam_cracklib_difok.xml
new file mode 100644
index 0000000..80fd21e
--- /dev/null
+++ b/shared/oval/accounts_password_pam_cracklib_difok.xml
@@ -0,0 +1,38 @@
+<def-group>
+ <definition class="compliance" id="accounts_password_pam_cracklib_difok" version="1">
+ <metadata>
+ <title>Set Password difok Requirements</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <description>The password difok should meet minimum
+ requirements using pam_cracklib</description>
+ <reference source="DS" ref_id="20131011" ref_url="test_attestation" />
+ </metadata>
+ <criteria>
+ <criterion comment="Conditions for difok are satisfied"
+ test_ref="test_accounts_password_pam_cracklib_difok" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="test_accounts_password_pam_cracklib_difok" version="1">
+ <ind:object object_ref="object_accounts_password_pam_cracklib_difok" />
+ <ind:state state_ref="state_accounts_password_pam_cracklib_difok" />
+ </ind:textfilecontent54_test>
+
+ <external_variable comment="External variable for pam_cracklib difok"
+ datatype="int" id="var_password_pam_cracklib_difok" version="1" />
+
+ <ind:textfilecontent54_object id="object_accounts_password_pam_cracklib_difok" version="1">
+ <ind:path>/etc/pam.d</ind:path>
+ <ind:filename>system-auth</ind:filename>
+ <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]difok=(-?\d+)(?:[\s]|$)</ind:pattern>
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_accounts_password_pam_cracklib_difok" version="1">
+ <ind:instance datatype="int">1</ind:instance>
+ <ind:subexpression datatype="int" operation="greater than or equal" var_ref="var_password_pam_cracklib_difok" />
+ </ind:textfilecontent54_state>
+
+</def-group>
--
1.8.3.1
More information about the scap-security-guide
mailing list