Issue with PASS_MIN_DAYS validation
Jeff Bachtel
jbachtel at bericotechnologies.com
Thu Oct 24 17:29:33 UTC 2013
Will,
I'm seeing the same failures using SCC 3.1 (which is DISA's packaging of
SSG). I suspect a profile problem (leading to improper external variables
possibly being set). What happens when you run the test with profile
stig-rhel6-server
?
Actually, checking /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml the
"server" profile specifies
<refine-value idref="var_password_min_age" selector="7"/> so that's the
minimum acceptable with the profile you're using.
But thanks for the email, now I have an idea what might be goobering up on
SCC...
Jeff
On Thu, Oct 24, 2013 at 11:40 AM, wm-lists <wm-lists at nixpeeps.com> wrote:
> I'm using scap-security-guide-0.1-12.el6.noarch as my source from
>
>
> http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/
>
> Running oscap xccdf eval --profile server
> /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
> Generates a failure for
> Title Set Password Minimum Age
> Rule password_min_age
> Ident CCE-27013-2
> Result fail
>
> Title Set Password Maximum Age
> Rule password_max_age
> Ident CCE-26985-2
> Result fail
>
> Title Set Password Strength Minimum Uppercase Characters
> Rule password_require_uppercases
> Ident CCE-26601-5
> Result fail
>
> Title Set Password Strength Minimum Special Characters
> Rule password_require_specials
> Ident CCE-26409-3
> Result fail
>
> Title Set Password Strength Minimum Lowercase Characters
> Rule password_require_lowercases
> Ident CCE-26631-2
> Result fail
>
> Among others.
> I have cracklib configured what I believe is correct (according to the CCE)
> # grep cracklib /etc/pam.d/system-auth-ac
> password requisite pam_cracklib.so dcredit=-1 ucredit=-1 ocredit=-1
> lcredit=-1 difok=4 try_first_pass retry=3 minlen=14 type=
> # grep PASS /etc/login.defs
>
> PASS_MAX_DAYS 180
> PASS_MIN_DAYS 1
> PASS_MIN_LEN 14
> PASS_WARN_AGE 7
>
> Any help on what I might be missing here?
>
> Thanks!
> Will
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131024/538fa1e7/attachment-0001.html>
More information about the scap-security-guide
mailing list