[PATCH 3/8] OVAL signoff for accounts_passwords_pam_fail_interval
Shawn Wells
shawn at redhat.com
Sat Oct 26 03:28:13 UTC 2013
-------------- next part --------------
>From 63250173b0dc713a1d677422d07eeb996c5c5415 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 25 Oct 2013 22:05:59 -0400
Subject: [PATCH 3/8] OVAL signoff for accounts_passwords_pam_fail_interval
- Updated XCCDF naming from deny_password_attempts_fail_interval=>accounts_passwords_pam_fail_interval
- OVAL signoff
---
RHEL6/input/auxiliary/stig_overlay.xml | 2 +-
.../accounts_passwords_pam_fail_interval.xml | 1 +
RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +-
RHEL6/input/profiles/nist-CL-IL-AL.xml | 2 +-
RHEL6/input/profiles/stig-rhel6-server.xml | 2 +-
RHEL6/input/system/accounts/pam.xml | 11 ++++++-----
6 files changed, 11 insertions(+), 9 deletions(-)
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index b65c320..bbe8d09 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -774,7 +774,7 @@
<overlay owner="disastig" ruleid="deny_password_attempts_unlock_time" ownerid="RHEL-06-000356" disa="47" severity="medium">
<title>The system must require administrator action to unlock an account locked by excessive failed login attempts.</title>
</overlay>
- <overlay owner="disastig" ruleid="deny_password_attempts_fail_interval" ownerid="RHEL-06-000357" disa="1452" severity="medium">
+ <overlay owner="disastig" ruleid="accounts_passwords_pam_fail_interval" ownerid="RHEL-06-000357" disa="1452" severity="medium">
<title>The system must disable accounts after excessive login failures within a 15-minute interval.</title>
</overlay>
<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000359" disa="20" severity="medium">
diff --git a/RHEL6/input/checks/accounts_passwords_pam_fail_interval.xml b/RHEL6/input/checks/accounts_passwords_pam_fail_interval.xml
index 58f73d3..78322ad 100644
--- a/RHEL6/input/checks/accounts_passwords_pam_fail_interval.xml
+++ b/RHEL6/input/checks/accounts_passwords_pam_fail_interval.xml
@@ -6,6 +6,7 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The number of allowed failed logins should be set correctly.</description>
+ <reference source="swells" ref_id="20131025" ref_url="test_attestation" />
</metadata>
<criteria>
<criterion comment="default is set to 900" test_ref="test_accounts_passwords_pam_faillock_fail_interval_system-auth" />
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index 9b6da2d..0d48dbf 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -79,7 +79,7 @@
<refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="3"/>
<refine-value idref="var_accounts_passwords_pam_faillock_fail_interval" selector="900" />
<select idref="deny_password_attempts" selected="true" />
-<select idref="deny_password_attempts_fail_interval" selected="true" />
+<select idref="accounts_passwords_pam_fail_interval" selected="true" />
<!-- AC-7(b)
FISMA Refine: Locks until admin action
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 4b1601f..2e7a17f 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -167,7 +167,7 @@ assurance."</description>
<!-- AC-7(a) -->
<select idref="deny_password_attempts" selected="true" \>
-<select idref="deny_password_attempts_fail_interval" selected="true" \>
+<select idref="accounts_passwords_pam_fail_interval" selected="true" \>
<!-- AC-7(b) -->
<select idref="deny_password_attempts_unlock_time" selected="true" \>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index e6a140a..3b8ea26 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -84,7 +84,7 @@
<select idref="deny_password_attempts_unlock_time" selected="true" />
<refine-value idref="var_accounts_passwords_pam_faillock_unlock_time" selector="604800"/>
-<select idref="deny_password_attempts_fail_interval" selected="true" />
+<select idref="accounts_passwords_pam_fail_interval" selected="true" />
<refine-value idref="var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
<!-- from inherited Rule, limiting_password_reuse -->
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 4bfb0c2..042abef 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -421,7 +421,7 @@ To configure the system to lock out accounts after a number of incorrect login
attempts using <tt>pam_faillock.so</tt>:
<br /><br />
Add the following lines immediately below the <tt>pam_unix.so</tt> statement in <tt>AUTH</tt> section of
-<tt>/etc/pam.d/system-auth</tt>:
+both <tt>/etc/pam.d/system-auth</tt> and /etc/pam.d/password-auth:
<pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</pre>
<pre>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</pre>
</description>
@@ -465,13 +465,14 @@ situations.
<ref nist="AC-7(b)" disa="47" />
</Rule>
-<Rule id="deny_password_attempts_fail_interval" severity="medium">
+<Rule id="accounts_passwords_pam_fail_interval" severity="medium">
<title>Set Interval For Counting Failed Password Attempts</title>
<description>
-To configure the system to lock out accounts after a number of incorrect login
-attempts within a 15 minute interval using <tt>pam_faillock.so</tt>:
+Utilizing <tt>pam_faillock.so</tt>, the <tt>fail_interval</tt> directive configures the system to lock out accounts after a number of incorrect login
+attempts.
<br /><br />
-Add the following lines immediately below the <tt>pam_env.so</tt> statement in <tt>/etc/pam.d/system-auth</tt>:
+Add the following <tt>fail_interval</tt> directives to <tt>pam_faillock.so</tt> immediately below the <tt>pam_env.so</tt> statement in
+<tt>/etc/pam.d/system-auth</tt> and <tt>/etc/pam.d/password-auth</tt>:
<pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</pre>
<pre>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</pre>
</description>
--
1.7.1
More information about the scap-security-guide
mailing list