[PATCH] A check and fix pam_cracklib.so minclass=X in system-auth

Brian Millett bmillett at gmail.com
Tue Jul 2 12:39:10 UTC 2013


Yep, got it.

Thanks.  

By the way, I've found that the template works better if there is a blank line
after the "populate",

__BEGIN__
source ./templates/support.sh
populate var_password_pam_cracklib_minclass

grep -q minclass /etc/pam.d/system-auth
__END__

Other wise when expanded, the var is on the same line as the grep, which holds
only for the grep.  
IE:
var_password_pam_cracklib_minclas=3 grep -q minclass /etc/pam.d/system-auth

But I really like the template.

Tha nks.
 On Mon, 01 Jul 2013 23:32:13 -0400
Shawn Wells <shawn at redhat.com> wrote:

> On 6/28/13 9:15 AM, Brian Millett wrote:
> > +++ b/RHEL6/input/fixes/bash/password_require_minimun_class.sh
> > @@ -0,0 +1,6 @@
> > +grep -q minclass /etc/pam.d/system-auth
> > +if [ $? = "0" ]; then
> > +    sed --follow-symlinks -i
> > "/pam_cracklib.so/s/minclass=[0-4]/minclass=3/" /etc/pam.d/system-auth
> > +else
> > +    sed --follow-symlinks -i
> > "/pam_cracklib.so/s/pam_cracklib.so /pam_cracklib.so
> > minclass=3 /" /etc/pam.d/system-auth +fi
> 
> Per Jeff's note, the pseudo code for remediation parameters should be 
> something like:
> 
> source ./templates/support.sh
> populate var_password_pam_cracklib_minclass
> grep -q minclass /etc/pam.d/system-auth
> if [ $? = "0" ]; then
>      sed --follow-symlinks -i
> "/pam_cracklib.so/s/minclass=[0-4]/minclass=$var_password_pam_cracklib_minclass /" /etc/pam.d/system-auth
> else
>      sed --follow-symlinks -i
> "/pam_cracklib.so/s/pam_cracklib.so /pam_cracklib.so
> minclass=$var_password_pam_cracklib_minclass /" /etc/pam.d/system-auth fi
> 
> 
> 



-- 
Brian Millett
"Ah. You seek meaning."
'Yes.'
"Then listen to the music, not the song."
   -- [ Kosh and Talia, "Deathwalker"]


More information about the scap-security-guide mailing list