Configuration of password-auth-ac should mirror that of system-auth-ac

Shawn Wells shawn at redhat.com
Tue Mar 5 05:49:06 UTC 2013


On 3/1/13 12:18 AM, Roach, Brian wrote:
> Hello all. I'm new to this list/project, and to development teams in general (usually fly solo) so please forgive and explain any faux pas. Now, on to the point...
>
> Depending on where a user is being authenticated, the configuration for that authentication is set in either /etc/pam.d/system-auth-ac or /etc/pam.d/password-auth-ac. For example, when logging into Gnome, the initial login authentication is configured in password-auth-ac. However, the screensaver password for that session is configured in system-auth-ac. After reading and searching through specs, STIGs, forums, mailing lists, etc... I have yet to find any awareness of this configuration distinction. To my experience thus far, the content of the two files should be the same, though I'm sure there is some rationale in having them separate. In any event, the STIG (and derived works) should carry instructions for password-auth-ac in addition to system-auth-ac.
>
> The PAM configuration is actually more complicated than just those two files, but most of the other files in the /etc/pam.d directory point to either password-auth-ac or system-auth-ac for the majority of their instructions. It would be prudent to specify and programmatically verify the configuration of these ancillary files as well.
>
> Comments and questions are always welcome.


Crap. You're right. It's funny how this wasn't picked up in the past 
(e.g. RHEL5 content). To ensure this gets addressed as part of the RHEL6 
STIG feedback, can you forward your note to DISA FSO ( 
disa.letterkenny.FSO.mbx.stig-customer-support-mailbox at mail.mil 
<mailto:disa.letterkenny.FSO.mbx.stig-customer-support-mailbox at mail.mil>)? 
This will create a formal tracking ticket to make sure we sort this out.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130305/839c76e0/attachment-0001.html>


More information about the scap-security-guide mailing list