[PATCH] The name of the check did not reflect its content.
Maura Dailey
maura at eclipse.ncsc.mil
Wed Oct 16 00:24:27 UTC 2013
On 10/15/2013 08:01 PM, Shawn Wells wrote:
> On 10/15/13 4:28 PM, Maura Dailey wrote:
>> The alternative, by the way, is to delete the check entirely, if no
>> profiles reference it.
>>
>> On 10/15/2013 04:05 PM, Maura Dailey wrote:
>>> Somewhat confusingly, the name of the check for pam_cracklib's
>>> minclass option was accounts_password_minclass_login_defs.xml. I
>>> corrected it and the id of the check inside the file.
>>>
>>> - Maura Dailey
>>>
>>> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
>>> ---
>>> .../accounts_password_pam_cracklib_minclass.xml | 43
>>> ++++++++++++++++++++
>>> 1 files changed, 43 insertions(+), 0 deletions(-)
>>> create mode 100644
>>> RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>>>
>>> diff --git
>>> a/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>>> b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>>> new file mode 100644
>>> index 0000000..539164b
>>> --- /dev/null
>>> +++ b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
>>> @@ -0,0 +1,43 @@
>>> +<def-group>
>>> + <definition class="compliance"
>>> id="accounts_password_pam_cracklib_minclass" version="1">
>>> + <metadata>
>>> + <title>Set Password minclass Requirements</title>
>>> + <affected family="unix">
>>> + <platform>Red Hat Enterprise Linux 6</platform>
>>> + </affected>
>>> + <description>The password minclass should meet minimum
>>> + requirements using pam_cracklib</description>
>>> + </metadata>
>>> + <criteria>
>>> + <criterion comment="Conditions for minclass are satisfied"
>>> + test_ref="test_password_pam_cracklib_minclass" />
>>> + </criteria>
>>> + </definition>
>>> +
>>> + <ind:textfilecontent54_test check="all"
>>> + comment="check the configuration of
>>> /etc/pam.d/system-auth"
>>> + id="test_password_pam_cracklib_minclass" version="1">
>>> + <ind:object object_ref="obj_password_pam_cracklib_minclass" />
>>> + <ind:state state_ref="state_password_pam_cracklib_minclass" />
>>> + </ind:textfilecontent54_test>
>>> +
>>> + <ind:textfilecontent54_state
>>> id="state_password_pam_cracklib_minclass"
>>> + version="1">
>>> + <ind:instance datatype="int">1</ind:instance>
>>> + <ind:subexpression datatype="int"
>>> + operation="less than or equal"
>>> + var_ref="var_password_pam_cracklib_minclass" />
>>> + </ind:textfilecontent54_state>
>>> +
>>> + <external_variable comment="External variable for pam_cracklib
>>> minclass"
>>> + datatype="int"
>>> id="var_password_pam_cracklib_minclass"
>>> + version="1" />
>>> +
>>> + <ind:textfilecontent54_object
>>> id="obj_password_pam_cracklib_minclass"
>>> + version="1">
>>> + <ind:path>/etc/pam.d</ind:path>
>>> + <ind:filename>system-auth</ind:filename>
>>> + <ind:pattern operation="pattern
>>> match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minclass=(-?\d+)(?:[\s]|$)</ind:pattern>
>>> + <ind:instance datatype="int" operation="less than or
>>> equal">1</ind:instance>
>>> + </ind:textfilecontent54_object>
>>> +</def-group>
>
> Between the accounts_password_pam_cracklib_{dcredit ucredit ocredit
> lcredit} checks I'm unsure if this is even needed (as further evident
> by no profile calling the check)...
>
> ack to the rename, though
>
I guess I'll push the rename for now. I found it because make validate
complains about it (since it's not referenced anywhere in the XCCDF).
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131015/2b4bbce5/attachment-0001.html>
More information about the scap-security-guide
mailing list