[PATCH] The name of the check did not reflect its content.

Shawn Wells shawn at redhat.com
Wed Oct 16 00:01:40 UTC 2013


On 10/15/13 4:28 PM, Maura Dailey wrote:
> The alternative, by the way, is to delete the check entirely, if no 
> profiles reference it.
>
> On 10/15/2013 04:05 PM, Maura Dailey wrote:
>> Somewhat confusingly, the name of the check for pam_cracklib's 
>> minclass option was accounts_password_minclass_login_defs.xml. I 
>> corrected it and the id of the check inside the file.
>>
>> - Maura Dailey
>>
>> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
>> ---
>>   .../accounts_password_pam_cracklib_minclass.xml    |   43 
>> ++++++++++++++++++++
>>   1 files changed, 43 insertions(+), 0 deletions(-)
>>   create mode 100644 
>> RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>>
>> diff --git 
>> a/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml 
>> b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>> new file mode 100644
>> index 0000000..539164b
>> --- /dev/null
>> +++ b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>> @@ -0,0 +1,43 @@
>> +<def-group>
>> +  <definition class="compliance" 
>> id="accounts_password_pam_cracklib_minclass" version="1">
>> +    <metadata>
>> +      <title>Set Password minclass Requirements</title>
>> +      <affected family="unix">
>> +        <platform>Red Hat Enterprise Linux 6</platform>
>> +      </affected>
>> +      <description>The password minclass should meet minimum
>> +      requirements using pam_cracklib</description>
>> +    </metadata>
>> +    <criteria>
>> +      <criterion comment="Conditions for minclass are satisfied"
>> + test_ref="test_password_pam_cracklib_minclass" />
>> +    </criteria>
>> +  </definition>
>> +
>> +  <ind:textfilecontent54_test check="all"
>> +                              comment="check the configuration of 
>> /etc/pam.d/system-auth"
>> + id="test_password_pam_cracklib_minclass" version="1">
>> +    <ind:object object_ref="obj_password_pam_cracklib_minclass" />
>> +    <ind:state state_ref="state_password_pam_cracklib_minclass" />
>> +  </ind:textfilecontent54_test>
>> +
>> +  <ind:textfilecontent54_state 
>> id="state_password_pam_cracklib_minclass"
>> +                               version="1">
>> +    <ind:instance datatype="int">1</ind:instance>
>> +    <ind:subexpression datatype="int"
>> +                       operation="less than or equal"
>> + var_ref="var_password_pam_cracklib_minclass" />
>> +  </ind:textfilecontent54_state>
>> +
>> +  <external_variable comment="External variable for pam_cracklib 
>> minclass"
>> +                     datatype="int" 
>> id="var_password_pam_cracklib_minclass"
>> +                     version="1" />
>> +
>> +  <ind:textfilecontent54_object id="obj_password_pam_cracklib_minclass"
>> +                                version="1">
>> +    <ind:path>/etc/pam.d</ind:path>
>> +    <ind:filename>system-auth</ind:filename>
>> +    <ind:pattern operation="pattern 
>> match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minclass=(-?\d+)(?:[\s]|$)</ind:pattern>
>> +    <ind:instance datatype="int" operation="less than or 
>> equal">1</ind:instance>
>> +  </ind:textfilecontent54_object>
>> +</def-group>

Between the accounts_password_pam_cracklib_{dcredit ucredit ocredit 
lcredit} checks I'm unsure if this is even needed (as further evident by 
no profile calling the check)...

ack to the rename, though
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131015/c72de456/attachment.html>


More information about the scap-security-guide mailing list