[PATCH] The name of the check did not reflect its content.

Maura Dailey maura at eclipse.ncsc.mil
Wed Oct 16 00:24:27 UTC 2013


On 10/15/2013 08:01 PM, Shawn Wells wrote:
> On 10/15/13 4:28 PM, Maura Dailey wrote:
>> The alternative, by the way, is to delete the check entirely, if no 
>> profiles reference it.
>>
>> On 10/15/2013 04:05 PM, Maura Dailey wrote:
>>> Somewhat confusingly, the name of the check for pam_cracklib's 
>>> minclass option was accounts_password_minclass_login_defs.xml. I 
>>> corrected it and the id of the check inside the file.
>>>
>>> - Maura Dailey
>>>
>>> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
>>> ---
>>>   .../accounts_password_pam_cracklib_minclass.xml    |   43 
>>> ++++++++++++++++++++
>>>   1 files changed, 43 insertions(+), 0 deletions(-)
>>>   create mode 100644 
>>> RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>>>
>>> diff --git 
>>> a/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml 
>>> b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>>> new file mode 100644
>>> index 0000000..539164b
>>> --- /dev/null
>>> +++ b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>>> @@ -0,0 +1,43 @@
>>> +<def-group>
>>> +  <definition class="compliance" 
>>> id="accounts_password_pam_cracklib_minclass" version="1">
>>> +    <metadata>
>>> +      <title>Set Password minclass Requirements</title>
>>> +      <affected family="unix">
>>> +        <platform>Red Hat Enterprise Linux 6</platform>
>>> +      </affected>
>>> +      <description>The password minclass should meet minimum
>>> +      requirements using pam_cracklib</description>
>>> +    </metadata>
>>> +    <criteria>
>>> +      <criterion comment="Conditions for minclass are satisfied"
>>> + test_ref="test_password_pam_cracklib_minclass" />
>>> +    </criteria>
>>> +  </definition>
>>> +
>>> +  <ind:textfilecontent54_test check="all"
>>> +                              comment="check the configuration of 
>>> /etc/pam.d/system-auth"
>>> + id="test_password_pam_cracklib_minclass" version="1">
>>> +    <ind:object object_ref="obj_password_pam_cracklib_minclass" />
>>> +    <ind:state state_ref="state_password_pam_cracklib_minclass" />
>>> +  </ind:textfilecontent54_test>
>>> +
>>> +  <ind:textfilecontent54_state 
>>> id="state_password_pam_cracklib_minclass"
>>> +                               version="1">
>>> +    <ind:instance datatype="int">1</ind:instance>
>>> +    <ind:subexpression datatype="int"
>>> +                       operation="less than or equal"
>>> + var_ref="var_password_pam_cracklib_minclass" />
>>> +  </ind:textfilecontent54_state>
>>> +
>>> +  <external_variable comment="External variable for pam_cracklib 
>>> minclass"
>>> +                     datatype="int" 
>>> id="var_password_pam_cracklib_minclass"
>>> +                     version="1" />
>>> +
>>> +  <ind:textfilecontent54_object 
>>> id="obj_password_pam_cracklib_minclass"
>>> +                                version="1">
>>> +    <ind:path>/etc/pam.d</ind:path>
>>> +    <ind:filename>system-auth</ind:filename>
>>> +    <ind:pattern operation="pattern 
>>> match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minclass=(-?\d+)(?:[\s]|$)</ind:pattern>
>>> +    <ind:instance datatype="int" operation="less than or 
>>> equal">1</ind:instance>
>>> +  </ind:textfilecontent54_object>
>>> +</def-group>
>
> Between the accounts_password_pam_cracklib_{dcredit ucredit ocredit 
> lcredit} checks I'm unsure if this is even needed (as further evident 
> by no profile calling the check)...
>
> ack to the rename, though
>

I guess I'll push the rename for now. I found it because make validate 
complains about it (since it's not referenced anywhere in the XCCDF).

>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131015/2b4bbce5/attachment-0001.html>


More information about the scap-security-guide mailing list