Issue with PASS_MIN_DAYS validation
Shawn Wells
shawn at redhat.com
Fri Oct 25 00:22:22 UTC 2013
On 10/24/13, 2:40 PM, wm-lists wrote:
> still getting the same result..
> oscap xccdf eval --report /var/www/html/report.html --profile server
> /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
>
> <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="RHEL-6"
> resolved="1" xml:lang="en-US">
> <status date="2013-10-22">draft</status>
>
>
> Title Set Password Strength Minimum Uppercase Characters
> Rule password_require_uppercases
> Ident CCE-26601-5
> Result fail
>
> Title Set Password Strength Minimum Special Characters
> Rule password_require_specials
> Ident CCE-26409-3
> Result fail
>
> Title Set Password Strength Minimum Lowercase Characters
> Rule password_require_lowercases
> Ident CCE-26631-2
> Result fail
These XCCDF names reflect nomenclature from prior releases ;) Try
rebasing via yum update or 'git pull' the latest source -- is it still
happening?
In case you're still failing here's my /etc/pam.d/system-auth (which
passes the checks).... is something different in yours?
> auth required pam_env.so
> auth sufficient pam_fprintd.so
> auth sufficient pam_unix.so try_first_pass
> auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800
> fail_interval=900
> auth required pam_faillock.so authsucc deny=3 unlock_time=604800
> fail_interval=900
> auth requisite pam_succeed_if.so uid >= 500 quiet
> auth required pam_deny.so
>
> account required pam_unix.so
> account sufficient pam_localuser.so
> account sufficient pam_succeed_if.so uid < 500 quiet
> account required pam_permit.so
>
> password requisite pam_cracklib.so try_first_pass retry=5 type=
> ucredit=-1 lcredit=-1 ocredit=-1
> password sufficient pam_unix.so sha512 shadow try_first_pass
> use_authtok
> password required pam_deny.so
>
> session optional pam_keyinit.so revoke
> session required pam_limits.so
> session [success=1 default=ignore] pam_succeed_if.so service in
> crond quiet use_uid
> session required pam_unix.so
More information about the scap-security-guide
mailing list