[PATCH] Some corrections to the PAM cracklib guidance...

Maura Dailey maura at eclipse.ncsc.mil
Mon Jun 24 17:36:01 UTC 2013


It's my understanding that the setting in login.defs is for local system 
accounts. The advantage of a separate setting for pam_cracklib is that 
it will apply to remote accounts stored in LDAP, for example.

On 06/24/2013 01:26 PM, Jeffrey Blank wrote:
> Yes -- please push these corrections.  It should eventually get picked
> up in a STIG update, too.
>
> Is the minlen needed here at all, or is the setting in login.defs
> (discussed elsewhere in the guide) adequate?
>
>
>
> On 06/18/2013 04:31 PM, Maura Dailey wrote:
>> In addition to the changes I made (outlined just below), I noticed that there is no rule for the minlen
>> parameter for cracklib. Should I add a new rule, modeled on its neighbors?
>>
>> I'm open to wording corrections. I noticed that the latest draft STIG is also incorrect with regards
>> to maxrepeat (it shares identical wording).
>>
>> - Maura Dailey
>>
>> Maura Dailey (1):
>>    Some corrections to the PAM cracklib guidance as follows: corrected
>>      pam_cracklib.so line to include all discussed parameters and edited
>>      them to contain plausible values (ucredit was set to 0 for some reason),
>>      corrected maxrepeat description to match other rules (it
>>      incorrectly suggested that a brand new line be inserted, and
>>      also gave an incorrect line insertion location as it referred to
>>       lines that do not exist by default), and I added a suggestion to
>>      add cracklib line if one does not exist
>>
>>   RHEL6/input/system/accounts/pam.xml |   11 ++++++-----
>>   1 files changed, 6 insertions(+), 5 deletions(-)
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide



More information about the scap-security-guide mailing list