[PATCH 3/8] OVAL signoff for accounts_passwords_pam_fail_interval

Shawn Wells shawn at redhat.com
Sat Oct 26 03:28:13 UTC 2013


-------------- next part --------------
>From 63250173b0dc713a1d677422d07eeb996c5c5415 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 25 Oct 2013 22:05:59 -0400
Subject: [PATCH 3/8] OVAL signoff for accounts_passwords_pam_fail_interval
 - Updated XCCDF naming from deny_password_attempts_fail_interval=>accounts_passwords_pam_fail_interval
 - OVAL signoff

---
 RHEL6/input/auxiliary/stig_overlay.xml             |    2 +-
 .../accounts_passwords_pam_fail_interval.xml       |    1 +
 RHEL6/input/profiles/fisma-medium-rhel6-server.xml |    2 +-
 RHEL6/input/profiles/nist-CL-IL-AL.xml             |    2 +-
 RHEL6/input/profiles/stig-rhel6-server.xml         |    2 +-
 RHEL6/input/system/accounts/pam.xml                |   11 ++++++-----
 6 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index b65c320..bbe8d09 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -774,7 +774,7 @@
 	<overlay owner="disastig" ruleid="deny_password_attempts_unlock_time" ownerid="RHEL-06-000356" disa="47" severity="medium">
 		<title>The system must require administrator action to unlock an account locked by excessive failed login attempts.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="deny_password_attempts_fail_interval" ownerid="RHEL-06-000357" disa="1452" severity="medium">
+	<overlay owner="disastig" ruleid="accounts_passwords_pam_fail_interval" ownerid="RHEL-06-000357" disa="1452" severity="medium">
 		<title>The system must disable accounts after excessive login failures within a 15-minute interval.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000359" disa="20" severity="medium">
diff --git a/RHEL6/input/checks/accounts_passwords_pam_fail_interval.xml b/RHEL6/input/checks/accounts_passwords_pam_fail_interval.xml
index 58f73d3..78322ad 100644
--- a/RHEL6/input/checks/accounts_passwords_pam_fail_interval.xml
+++ b/RHEL6/input/checks/accounts_passwords_pam_fail_interval.xml
@@ -6,6 +6,7 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The number of allowed failed logins should be set correctly.</description>
+      <reference source="swells" ref_id="20131025" ref_url="test_attestation" />
     </metadata>
     <criteria>
       <criterion comment="default is set to 900" test_ref="test_accounts_passwords_pam_faillock_fail_interval_system-auth" />
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index 9b6da2d..0d48dbf 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -79,7 +79,7 @@
 <refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="3"/>
 <refine-value idref="var_accounts_passwords_pam_faillock_fail_interval" selector="900" />
 <select idref="deny_password_attempts" selected="true" />
-<select idref="deny_password_attempts_fail_interval" selected="true" />
+<select idref="accounts_passwords_pam_fail_interval" selected="true" />
 
 <!--	AC-7(b)
      	FISMA Refine: Locks until admin action
diff --git a/RHEL6/input/profiles/nist-CL-IL-AL.xml b/RHEL6/input/profiles/nist-CL-IL-AL.xml
index 4b1601f..2e7a17f 100644
--- a/RHEL6/input/profiles/nist-CL-IL-AL.xml
+++ b/RHEL6/input/profiles/nist-CL-IL-AL.xml
@@ -167,7 +167,7 @@ assurance."</description>
 
 <!-- AC-7(a) -->
 <select idref="deny_password_attempts" selected="true" \>
-<select idref="deny_password_attempts_fail_interval" selected="true" \>
+<select idref="accounts_passwords_pam_fail_interval" selected="true" \>
 
 <!-- AC-7(b) -->
 <select idref="deny_password_attempts_unlock_time" selected="true" \>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index e6a140a..3b8ea26 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -84,7 +84,7 @@
 
 <select idref="deny_password_attempts_unlock_time" selected="true" />
 <refine-value idref="var_accounts_passwords_pam_faillock_unlock_time" selector="604800"/>
-<select idref="deny_password_attempts_fail_interval" selected="true" />
+<select idref="accounts_passwords_pam_fail_interval" selected="true" />
 <refine-value idref="var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
 
 <!-- from inherited Rule, limiting_password_reuse -->
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 4bfb0c2..042abef 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -421,7 +421,7 @@ To configure the system to lock out accounts after a number of incorrect login
 attempts using <tt>pam_faillock.so</tt>:
 <br /><br />
 Add the following lines immediately below the <tt>pam_unix.so</tt> statement in <tt>AUTH</tt> section of
-<tt>/etc/pam.d/system-auth</tt>:
+both <tt>/etc/pam.d/system-auth</tt> and /etc/pam.d/password-auth:
 <pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</pre>
 <pre>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</pre>
 </description>
@@ -465,13 +465,14 @@ situations.
 <ref nist="AC-7(b)" disa="47" />
 </Rule>
 
-<Rule id="deny_password_attempts_fail_interval" severity="medium">
+<Rule id="accounts_passwords_pam_fail_interval" severity="medium">
 <title>Set Interval For Counting Failed Password Attempts</title>
 <description>
-To configure the system to lock out accounts after a number of incorrect login
-attempts within a 15 minute interval using <tt>pam_faillock.so</tt>:
+Utilizing <tt>pam_faillock.so</tt>, the <tt>fail_interval</tt> directive configures the system to lock out accounts after a number of incorrect login
+attempts.
 <br /><br />
-Add the following lines immediately below the <tt>pam_env.so</tt> statement in <tt>/etc/pam.d/system-auth</tt>:
+Add the following <tt>fail_interval</tt> directives to <tt>pam_faillock.so</tt> immediately below the <tt>pam_env.so</tt> statement in
+<tt>/etc/pam.d/system-auth</tt> and <tt>/etc/pam.d/password-auth</tt>:
 <pre>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</pre>
 <pre>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</pre>
 </description>
-- 
1.7.1



More information about the scap-security-guide mailing list