[PATCH] Some corrections to the PAM cracklib guidance...

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jun 24 17:26:09 UTC 2013


Yes -- please push these corrections.  It should eventually get picked
up in a STIG update, too.

Is the minlen needed here at all, or is the setting in login.defs
(discussed elsewhere in the guide) adequate?



On 06/18/2013 04:31 PM, Maura Dailey wrote:
> In addition to the changes I made (outlined just below), I noticed that there is no rule for the minlen
> parameter for cracklib. Should I add a new rule, modeled on its neighbors?
> 
> I'm open to wording corrections. I noticed that the latest draft STIG is also incorrect with regards
> to maxrepeat (it shares identical wording).
> 
> - Maura Dailey
> 
> Maura Dailey (1):
>   Some corrections to the PAM cracklib guidance as follows: corrected
>     pam_cracklib.so line to include all discussed parameters and edited
>     them to contain plausible values (ucredit was set to 0 for some reason),
>     corrected maxrepeat description to match other rules (it
>     incorrectly suggested that a brand new line be inserted, and
>     also gave an incorrect line insertion location as it referred to   
>      lines that do not exist by default), and I added a suggestion to
>     add cracklib line if one does not exist
> 
>  RHEL6/input/system/accounts/pam.xml |   11 ++++++-----
>  1 files changed, 6 insertions(+), 5 deletions(-)
> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list