Issue with PASS_MIN_DAYS validation
wm-lists
wm-lists at nixpeeps.com
Thu Oct 24 17:38:02 UTC 2013
I ended up setting all four values to the requirement and that resolved the
login.defs requirements.. now I'm trying to figure out what's "goobering"
up the credit's for cracklib...
While I'm sure deciphering the xml is easy enough for someone who's been
nose deep in this for a while, it's proving a bit challenging for me to
find what's connected to what...
Title Set Password Strength Minimum Uppercase Characters
Rule password_require_uppercases
Ident CCE-26601-5
Result fail
Title Set Password Strength Minimum Special Characters
Rule password_require_specials
Ident CCE-26409-3
Result fail
Title Set Password Strength Minimum Lowercase Characters
Rule password_require_lowercases
Ident CCE-26631-2
Result fail
grep cracklib /etc/pam.d/system-auth
password required pam_cracklib.so try_first_pass retry=3
maxrepeat=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4
On Thu, Oct 24, 2013 at 1:29 PM, Jeff Bachtel <
jbachtel at bericotechnologies.com> wrote:
> Will,
>
> I'm seeing the same failures using SCC 3.1 (which is DISA's packaging of
> SSG). I suspect a profile problem (leading to improper external variables
> possibly being set). What happens when you run the test with profile stig-rhel6-server
> ?
>
> Actually, checking /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
> the "server" profile specifies
> <refine-value idref="var_password_min_age" selector="7"/> so that's the
> minimum acceptable with the profile you're using.
>
> But thanks for the email, now I have an idea what might be goobering up on
> SCC...
>
> Jeff
>
>
>
> On Thu, Oct 24, 2013 at 11:40 AM, wm-lists <wm-lists at nixpeeps.com> wrote:
>
>> I'm using scap-security-guide-0.1-12.el6.noarch as my source from
>>
>>
>> http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/
>>
>> Running oscap xccdf eval --profile server
>> /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
>> Generates a failure for
>> Title Set Password Minimum Age
>> Rule password_min_age
>> Ident CCE-27013-2
>> Result fail
>>
>> Title Set Password Maximum Age
>> Rule password_max_age
>> Ident CCE-26985-2
>> Result fail
>>
>> Title Set Password Strength Minimum Uppercase Characters
>> Rule password_require_uppercases
>> Ident CCE-26601-5
>> Result fail
>>
>> Title Set Password Strength Minimum Special Characters
>> Rule password_require_specials
>> Ident CCE-26409-3
>> Result fail
>>
>> Title Set Password Strength Minimum Lowercase Characters
>> Rule password_require_lowercases
>> Ident CCE-26631-2
>> Result fail
>>
>> Among others.
>> I have cracklib configured what I believe is correct (according to the
>> CCE)
>> # grep cracklib /etc/pam.d/system-auth-ac
>> password requisite pam_cracklib.so dcredit=-1 ucredit=-1
>> ocredit=-1 lcredit=-1 difok=4 try_first_pass retry=3 minlen=14 type=
>> # grep PASS /etc/login.defs
>>
>> PASS_MAX_DAYS 180
>> PASS_MIN_DAYS 1
>> PASS_MIN_LEN 14
>> PASS_WARN_AGE 7
>>
>> Any help on what I might be missing here?
>>
>> Thanks!
>> Will
>>
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>>
>>
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131024/b2541237/attachment.html>
More information about the scap-security-guide
mailing list