[PATCH] [Fedora] Convert four RHEL6 rules from 'Set Password Expiration Parameters' section to Fedora

Shawn Wells shawn at redhat.com
Thu Oct 10 20:37:36 UTC 2013


On 10/10/13 12:45 PM, Jan Lieskovsky wrote:
> This patch converts (and includes) four existing rules from RHEL6
> 'Set Password Expiration Parameters' section to (into) Fedora.
>
> Testing:
> * all tests of make fedora-tarball, fedora-srpm, fedora-rpm have passed,
> * all tests within Fedora of 'make / make validate / make validate-xml /
>    make checks / make guide / make content / make eval-common' have passed
>    with the proposal.
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> 0001-Fedora-Convert-four-RHEL6-rules-from-Set-Password-Ex.patch
>
>
>  From 5e5dbb929fe8376f72d71f526f5e02e4ed4a841d Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Thu, 10 Oct 2013 18:39:11 +0200
> Subject: [PATCH] [Fedora] Convert four RHEL6 rules from 'Set Password
>   Expiration Parameters' section to Fedora
>
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   .../checks/accounts_maximum_age_login_defs.xml     |  32 ++++
>   .../checks/accounts_minimum_age_login_defs.xml     |  34 ++++
>   .../checks/accounts_password_minlen_login_defs.xml |  33 ++++
>   .../accounts_password_warn_age_login_defs.xml      |  35 ++++
>   Fedora/input/guide.xml                             |   2 +-
>   Fedora/input/guide.xslt                            |   1 +
>   Fedora/input/profiles/common.xml                   |   4 +
>   .../accounts/restrictions/password_expiration.xml  | 177 +++++++++++++++++++++
>   Fedora/scap-security-guide.spec                    |   5 +-
>   9 files changed, 321 insertions(+), 2 deletions(-)
>   create mode 100644 Fedora/input/checks/accounts_maximum_age_login_defs.xml
>   create mode 100644 Fedora/input/checks/accounts_minimum_age_login_defs.xml
>   create mode 100644 Fedora/input/checks/accounts_password_minlen_login_defs.xml
>   create mode 100644 Fedora/input/checks/accounts_password_warn_age_login_defs.xml
>   create mode 100644 Fedora/input/system/accounts/restrictions/password_expiration.xml
>
> diff --git a/Fedora/input/checks/accounts_maximum_age_login_defs.xml b/Fedora/input/checks/accounts_maximum_age_login_defs.xml
> new file mode 100644
> index 0000000..5e96118
> --- /dev/null
> +++ b/Fedora/input/checks/accounts_maximum_age_login_defs.xml
> @@ -0,0 +1,32 @@
> +<def-group>
> +  <definition class="compliance" id="accounts_maximum_age_login_defs" version="1">
> +    <metadata>
> +      <title>Set Password Expiration Parameters</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>The maximum password age policy should meet minimum requirements.</description>
> +    </metadata>
> +    <criteria comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
> +      <criterion test_ref="test_pass_max_days" />
> +    </criteria>
> +  </definition>
> +
> +  <ind:textfilecontent54_test check="all" comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs" id="test_pass_max_days" version="1">
> +    <ind:object object_ref="object_etc_login_defs_pass_max" />
> +    <ind:state state_ref="state_accounts_maximum_age_login_defs" />
> +  </ind:textfilecontent54_test>
> +
> +  <ind:textfilecontent54_object id="object_etc_login_defs_pass_max" version="1">
> +    <ind:filepath>/etc/login.defs</ind:filepath>
> +    <ind:pattern operation="pattern match">^[\s]*PASS_MAX_DAYS[\s]+(\d+)\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +  <ind:textfilecontent54_state id="state_accounts_maximum_age_login_defs" version="1">
> +    <ind:subexpression operation="less than or equal" var_ref="var_accounts_maximum_age_login_defs" datatype="int" />
> +  </ind:textfilecontent54_state>
> +
> +  <external_variable comment="maximum password age" datatype="int" id="var_accounts_maximum_age_login_defs" version="1" />
> +
> +</def-group>
> diff --git a/Fedora/input/checks/accounts_minimum_age_login_defs.xml b/Fedora/input/checks/accounts_minimum_age_login_defs.xml
> new file mode 100644
> index 0000000..87917e0
> --- /dev/null
> +++ b/Fedora/input/checks/accounts_minimum_age_login_defs.xml
> @@ -0,0 +1,34 @@
> +<def-group>
> +  <definition class="compliance" id="accounts_minimum_age_login_defs" version="1">
> +    <metadata>
> +      <title>Set Password Expiration Parameters</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>The minimum password age policy should be set appropriately.</description>
> +    </metadata>
> +    <criteria comment="the value PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
> +      <criterion test_ref="test_pass_min_days" />
> +    </criteria>
> +  </definition>
> +
> +  <ind:textfilecontent54_test check="all"
> +  comment="Tests the value of PASS_MIN_DAYS in /etc/login.defs"
> +  id="test_pass_min_days" version="1">
> +    <ind:object object_ref="object_etc_login_defs_pass_min_age" />
> +    <ind:state state_ref="state_etc_login_defs_pass_min_age" />
> +  </ind:textfilecontent54_test>
> +
> +  <ind:textfilecontent54_object id="object_etc_login_defs_pass_min_age" version="1">
> +    <ind:filepath>/etc/login.defs</ind:filepath>
> +    <ind:pattern operation="pattern match">^[\s]*PASS_MIN_DAYS[\s]+(\d+)\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +  <ind:textfilecontent54_state id="state_etc_login_defs_pass_min_age" version="1">
> +    <ind:subexpression operation="greater than or equal" var_ref="var_accounts_minimum_age_login_defs" datatype="int" />
> +  </ind:textfilecontent54_state>
> +
> +  <external_variable comment="minimum password age in days" datatype="int" id="var_accounts_minimum_age_login_defs" version="1" />
> +
> +</def-group>
> diff --git a/Fedora/input/checks/accounts_password_minlen_login_defs.xml b/Fedora/input/checks/accounts_password_minlen_login_defs.xml
> new file mode 100644
> index 0000000..e3ce130
> --- /dev/null
> +++ b/Fedora/input/checks/accounts_password_minlen_login_defs.xml
> @@ -0,0 +1,33 @@
> +<def-group>
> +
> +  <definition class="compliance" id="accounts_password_minlen_login_defs" version="1">
> +    <metadata>
> +      <title>Set Password Expiration Parameters</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>The password minimum length should be set appropriately.</description>
> +    </metadata>
> +    <criteria operator="AND">
> +      <criterion test_ref="test_etc_login_defs" />
> +    </criteria>
> +  </definition>
> +
> +  <ind:textfilecontent54_test check="all" comment="check PASS_MIN_LEN in /etc/login.defs" id="test_etc_login_defs" version="1">
> +    <ind:object object_ref="object_etc_login_defs" />
> +    <ind:state state_ref="state_accounts_password_minlen_login_defs" />
> +  </ind:textfilecontent54_test>
> +
> +  <ind:textfilecontent54_object id="object_etc_login_defs" version="1">
> +    <ind:filepath>/etc/login.defs</ind:filepath>
> +    <ind:pattern operation="pattern match">^PASS_MIN_LEN\s+(\d+)\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +  <ind:textfilecontent54_state id="state_accounts_password_minlen_login_defs" version="1">
> +    <ind:subexpression operation="greater than or equal" var_ref="var_accounts_password_minlen_login_defs" datatype="int" />
> +  </ind:textfilecontent54_state>
> +
> +  <external_variable comment="password minimum length" datatype="int" id="var_accounts_password_minlen_login_defs" version="1" />
> +
> +</def-group>
> diff --git a/Fedora/input/checks/accounts_password_warn_age_login_defs.xml b/Fedora/input/checks/accounts_password_warn_age_login_defs.xml
> new file mode 100644
> index 0000000..5230af1
> --- /dev/null
> +++ b/Fedora/input/checks/accounts_password_warn_age_login_defs.xml
> @@ -0,0 +1,35 @@
> +<def-group>
> +  <definition class="compliance" id="accounts_password_warn_age_login_defs" version="1">
> +    <metadata>
> +      <title>Set Password Expiration Parameters</title>
> +      <affected family="unix">
> +        <platform>Fedora 19</platform>
> +      </affected>
> +      <description>The password expiration warning age should be set appropriately.</description>
> +    </metadata>
> +    <criteria>
> +      <criterion test_ref="test_pass_warn_age" />
> +    </criteria>
> +  </definition>
> +
> +  <ind:textfilecontent54_test check="all"
> +  comment="Tests the value of PASS_WARN_AGE in /etc/login.defs"
> +  id="test_pass_warn_age" version="1">
> +    <ind:object object_ref="object_etc_login_defs_pass_warn_age" />
> +    <ind:state state_ref="state_etc_login_defs_pass_warn_age" />
> +  </ind:textfilecontent54_test>
> +
> +  <ind:textfilecontent54_object id="object_etc_login_defs_pass_warn_age"
> +  version="1">
> +    <ind:filepath>/etc/login.defs</ind:filepath>
> +    <ind:pattern operation="pattern match">^[\s]*PASS_WARN_AGE[\s]*(\d+)\s*$</ind:pattern>
> +    <ind:instance datatype="int">1</ind:instance>
> +  </ind:textfilecontent54_object>
> +
> +  <ind:textfilecontent54_state id="state_etc_login_defs_pass_warn_age" version="1">
> +    <ind:subexpression operation="greater than or equal" var_ref="var_accounts_password_warn_age_login_defs" datatype="int" />
> +  </ind:textfilecontent54_state>
> +
> +  <external_variable comment="password expiration warning age in days" datatype="int" id="var_accounts_password_warn_age_login_defs" version="1" />
> +
> +</def-group>
> diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml
> index c76b795..6e276b1 100644
> --- a/Fedora/input/guide.xml
> +++ b/Fedora/input/guide.xml
> @@ -36,5 +36,5 @@ trademarks or trademarks of Red Hat, Inc. in the United States and other
>   countries. All other names are registered trademarks or trademarks of their
>   respective companies.</rear-matter>
>   <platform idref="cpe:/o:fedoraproject:fedora:19" />
> -<version>0.0.1</version>
> +<version>0.0.2</version>
>   </Benchmark>
> diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt
> index 8bdf86e..559042e 100644
> --- a/Fedora/input/guide.xslt
> +++ b/Fedora/input/guide.xslt
> @@ -46,6 +46,7 @@
>       <xsl:copy>
>         <xsl:copy-of select="@*|node()" />
>         <xsl:apply-templates select="document('system/accounts/restrictions/password_storage.xml')" />
> +      <xsl:apply-templates select="document('system/accounts/restrictions/password_expiration.xml')" />
>       </xsl:copy>
>     </xsl:template>
>   
> diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/common.xml
> index 2739a33..83e3478 100644
> --- a/Fedora/input/profiles/common.xml
> +++ b/Fedora/input/profiles/common.xml
> @@ -8,5 +8,9 @@
>   <select idref="no_hashes_outside_shadow" selected="true"/>
>   <select idref="gid_passwd_group_same" selected="true"/>
>   <select idref="no_netrc_files" selected="true"/>
> +<select idref="accounts_password_minlen_login_defs" selected="true"/>
> +<select idref="accounts_minimum_age_login_defs" selected="true"/>
> +<select idref="accounts_maximum_age_login_defs" selected="true"/>
> +<select idref="accounts_password_warn_age_login_defs" selected="true"/>
>   
>   </Profile>
> diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml
> new file mode 100644
> index 0000000..73d48c6
> --- /dev/null
> +++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml
> @@ -0,0 +1,177 @@
> +<Group id="password_expiration">
> +<title>Set Password Expiration Parameters</title>
> +<description>The file <tt>/etc/login.defs</tt> controls several
> +password-related settings. Programs such as <tt>passwd</tt>,
> +<tt>su</tt>, and <tt>login</tt> consult <tt>/etc/login.defs</tt> to determine
> +behavior with regard to password aging, expiration warnings,
> +and length. See the man page <tt>login.defs(5)</tt> for more information.
> +<br/><br/>
> +Users should be forced to change their passwords, in order to
> +decrease the utility of compromised passwords. However, the need to
> +change passwords often should be balanced against the risk that
> +users will reuse or write down passwords if forced to change them
> +too often. Forcing password changes every 90-360 days, depending on
> +the environment, is recommended. Set the appropriate value as
> +<tt>PASS_MAX_DAYS</tt> and apply it to existing accounts with the
> +<tt>-M</tt> flag.
> +<br /><br />
> +The <tt>PASS_MIN_DAYS</tt> (<tt>-m</tt>) setting prevents password
> +changes for 7 days after the first change, to discourage password
> +cycling. If you use this setting, train users to contact an administrator
> +for an emergency password change in case a new password becomes
> +compromised. The <tt>PASS_WARN_AGE</tt> (<tt>-W</tt>) setting gives
> +users 7 days of warnings at login time that their passwords are about to expire.
> +<br /><br />
> +For example, for each existing human user <i>USER</i>, expiration parameters
> +could be adjusted to a 180 day maximum password age, 7 day minimum password
> +age, and 7 day warning period with the following command:
> +<pre># chage -M 180 -m 7 -W 7 USER</pre>
> +</description>
> +
> +<Value id="var_accounts_password_minlen_login_defs" type="number" >
> +<title>minimum password length</title>
> +<description>Minimum number of characters in password</description>
> +<warning category="general">This will only check new passwords</warning>
> +<value selector="">12</value>
> +<value selector="6">6</value>
> +<!-- NIST 800-53 requires 1 in a million using brute force which translates to six numbers -->
> +<value selector="8">8</value>
> +<value selector="10">10</value>
> +<value selector="12">12</value>
> +<value selector="14">14</value>
> +</Value>
> +
> +<Value id="var_accounts_maximum_age_login_defs" type="number" >
> +<title>maximum password age</title>
> +<description>Maximum age of password in days</description>
> +<warning category="general">This will only apply to newly created accounts</warning>
> +<value selector="">60</value>
> +<value selector="60">60</value>
> +<value selector="90">90</value>
> +<value selector="120">120</value>
> +<value selector="180">180</value>
> +</Value>
> +
> +<Value id="var_accounts_minimum_age_login_defs" type="number" >
> +<title>minimum password age</title>
> +<description>Minimum age of password in days</description>
> +<warning category="general">This will only apply to newly created accounts</warning>
> +<value selector="">7</value>
> +<value selector="7">7</value>
> +<value selector="5">5</value>
> +<value selector="1">1</value>
> +<value selector="2">2</value>
> +<value selector="0">0</value>
> +</Value>
> +
> +<Value id="var_accounts_password_warn_age_login_defs" type="number" >
> +<title>warning days before password expires</title>
> +<description>The number of days' warning given before a password expires.</description>
> +<warning category="general">This will only apply to newly created accounts</warning>
> +<value selector="">7</value>
> +<value selector="0">0</value>
> +<value selector="7">7</value>
> +<value selector="14">14</value>
> +</Value>
> +
> +<Rule id="accounts_password_minlen_login_defs" severity="medium">
> +<title>Set Password Minimum Length in login.defs</title>
> +<description>To specify password length requirements for new accounts,
> +edit the file <tt>/etc/login.defs</tt> and add or correct the following
> +lines:
> +<pre>PASS_MIN_LEN 12<!-- <sub idref="var_accounts_password_minlen_login_defs"> --></pre>
> +<br/><br/>
> +Nowadays recommended values, considered as secure by various organizations
> +focused on topic of computer security, range from <tt>12 (FISMA)</tt> up to
> +<tt>14 (DoD)</tt> characters for password length requirements.
> +If a program consults <tt>/etc/login.defs</tt> and also another PAM module
> +(such as <tt>pam_cracklib</tt>) during a password change operation,
> +then the most restrictive must be satisfied. See PAM section
> +for more information about enforcing password quality requirements.
> +</description>
> +<ocil clause="it is not set to the required value">
> +To check the minimum password length, run the command:
> +<pre>$ grep PASS_MIN_LEN /etc/login.defs</pre>
> +Passwords of length <tt>12</tt> characters and more are nowadays
> +considered to be a standard requirement.
> +</ocil>
> +<rationale>
> +Requiring a minimum password length makes password
> +cracking attacks more difficult by ensuring a larger
> +search space. However, any security benefit from an onerous requirement
> +must be carefully weighed against usability problems, support costs, or
> +counterproductive behavior that may result.
> +</rationale>
> +<oval id="accounts_password_minlen_login_defs" value="var_accounts_password_minlen_login_defs"/>
> +<ref nist="IA-5(f),IA-5(1)(a)" disa="205"/>
> +</Rule>
> +
> +<Rule id="accounts_minimum_age_login_defs" severity="medium">
> +<title>Set Password Minimum Age</title>
> +<description>To specify password minimum age for new accounts,
> +edit the file <tt>/etc/login.defs</tt> and add or correct the
> +following line, replacing the <i>DAYS</i> item as appropriate:
> +<pre>PASS_MIN_DAYS <i>DAYS</i></pre>
> +A value of 1 day is considered to be sufficient for many environments.
> +</description>
> +<ocil clause="it is not set to the required value">
> +To check the minimum password age, run the command:
> +<pre>$ grep PASS_MIN_DAYS /etc/login.defs</pre>
> +A value of 1 day is considered to be sufficient for many environments.
> +</ocil>
> +<rationale>
> +Setting the minimum password age protects against users cycling
> +back to a favorite password after satisfying the password reuse
> +requirement.
> +</rationale>
> +<oval id="accounts_minimum_age_login_defs" value="var_accounts_minimum_age_login_defs"/>
> +<ref nist="IA-5(f),IA-5(1)(d)" disa="198"/>
> +</Rule>
> +
> +<Rule id="accounts_maximum_age_login_defs" severity="medium">
> +<title>Set Password Maximum Age</title>
> +<description>To specify password maximum age for new accounts,
> +edit the file <tt>/etc/login.defs</tt> and add or correct the
> +following line, replacing the <i>DAYS</i> item appropriately:
> +<pre>PASS_MAX_DAYS <i>DAYS</i></pre>
> +A value of 180 days is sufficient for many environments.
> +</description>
> +<ocil clause="it is not set to the required value">
> +To check the maximum password age, run the command:
> +<pre>$ grep PASS_MAX_DAYS /etc/login.defs</pre>
> +A value of 180 days is sufficient for many environments.
> +</ocil>
> +<rationale>
> +Setting the password maximum age ensures users are required to
> +periodically change their passwords. This could possibly decrease
> +the utility of a stolen password. Requiring shorter password lifetimes
> +increases the risk of users writing down the password in a convenient
> +location subject to physical compromise.</rationale>
> +<oval id="accounts_maximum_age_login_defs" value="var_accounts_maximum_age_login_defs"/>
> +<ref nist="IA-5(f),IA-5(g),IA-5(1)(d)" disa="180,199" />
> +</Rule>
> +
> +<Rule id="accounts_password_warn_age_login_defs">
> +<title>Set Password Warning Age</title>
> +<description>To specify how many days prior to password
> +expiration that a warning will be issued to users,
> +edit the file <tt>/etc/login.defs</tt> and add or correct
> + the following line, replacing the <i>DAYS</i> item as appropriate:
> +<pre>PASS_WARN_AGE <i>DAYS</i></pre>
> +A value of 7 days would be nowadays considered to be a standard.
> +<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> -->
> +</description>
> +<ocil clause="it is not set to the required value">
> +To check the password warning age, run the command:
> +<pre>$ grep PASS_WARN_AGE /etc/login.defs</pre>
> +A value of 7 days would be nowadays considered to be a standard.
> +</ocil>
> +<rationale>
> +Setting the password warning age enables users to make the change
> +at a practical time.
> +</rationale>
> +<oval id="accounts_password_warn_age_login_defs" value="var_accounts_password_warn_age_login_defs" />
> +<ref nist="IA-5(f)" />
> +</Rule>
> +
> +</Group>
> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
> index 73eab57..1abe666 100644
> --- a/Fedora/scap-security-guide.spec
> +++ b/Fedora/scap-security-guide.spec
> @@ -5,7 +5,7 @@
>   # file one level up - in the main scap-security-guide directory (instead of
>   # this one).
>   
> -%global	fedorassgrelease	2.rc2
> +%global	fedorassgrelease	2.rc3
>   
>   Name:		scap-security-guide
>   Version:	0.1
> @@ -50,6 +50,9 @@ rm -rf $RPM_BUILD_ROOT
>   %{_datadir}/xml/scap/ssg/fedora/19/*
>   
>   %changelog
> +* Thu Oct 10 2013 Jan iankko Lieskovsky<jlieskov at redhat.com>  0.1-2.rc3
> +- Convert four RHEL6 'Set Password Expiration Parameter' rules to Fedora
> +
>   * Thu Oct 10 2013 Jan iankko Lieskovsky<jlieskov at redhat.com>  0.1-2.rc2
>   - Introduce 'Account and Access Control' section
>   - Convert following "Verify Proper Storage and Existence of Password Hashes" section
> -- 1.7.11.7

ack
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131010/beddb828/attachment-0001.html>


More information about the scap-security-guide mailing list