[PATCH 4/8] OVAL update
Shawn Wells
shawn at redhat.com
Sat Oct 26 03:28:23 UTC 2013
-------------- next part --------------
>From 879f1b66a2f8d00e93e4243d9d17262674b8a58b Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 25 Oct 2013 22:19:04 -0400
Subject: [PATCH 4/8] OVAL update: accounts_password_reuse_limit
- Updated XCCDF variable to var_{check_name}
- Aligned XCCDF and OVAL names
---
RHEL6/input/auxiliary/stig_overlay.xml | 2 +-
RHEL6/input/auxiliary/transition_notes.xml | 2 +-
.../input/checks/accounts_password_reuse_limit.xml | 9 ++++-----
RHEL6/input/profiles/CS2.xml | 4 ++--
RHEL6/input/profiles/common.xml | 4 ++--
RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 4 ++--
RHEL6/input/profiles/rht-ccp.xml | 4 ++--
RHEL6/input/profiles/stig-rhel6-server.xml | 6 +++---
RHEL6/input/profiles/usgcb-rhel6-server.xml | 4 ++--
RHEL6/input/system/accounts/pam.xml | 6 +++---
10 files changed, 22 insertions(+), 23 deletions(-)
diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index bbe8d09..d322169 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -594,7 +594,7 @@
<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000273" disa="366" severity="low">
<title>The system must use SMB client signing for connecting to samba servers using mount.cifs.</title>
</overlay>
- <overlay owner="disastig" ruleid="limiting_password_reuse" ownerid="RHEL-06-000274" disa="200" severity="medium">
+ <overlay owner="disastig" ruleid="accounts_password_reuse_limit" ownerid="RHEL-06-000274" disa="200" severity="medium">
<title>The system must prohibit the reuse of passwords within twenty-four iterations.</title>
</overlay>
<overlay owner="disastig" ruleid="encrypt_partitions" ownerid="RHEL-06-000275" disa="1019" severity="low">
diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml
index 811d0e8..c1339c9 100644
--- a/RHEL6/input/auxiliary/transition_notes.xml
+++ b/RHEL6/input/auxiliary/transition_notes.xml
@@ -1300,7 +1300,7 @@ rule=enable_screensaver_after_idle manual=no
<note ref="4084" auth="KS">
Check does exist in the RHEL6 prose, it can be automated and the OVAL for it
does exist.
-rule=limiting_password_reuse manual=no
+rule=accounts_password_reuse_limit manual=no
</note>
<note ref="4249" auth="KS">
diff --git a/RHEL6/input/checks/accounts_password_reuse_limit.xml b/RHEL6/input/checks/accounts_password_reuse_limit.xml
index b9e5b68..0a30209 100644
--- a/RHEL6/input/checks/accounts_password_reuse_limit.xml
+++ b/RHEL6/input/checks/accounts_password_reuse_limit.xml
@@ -6,7 +6,7 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>The passwords to remember should be set correctly.</description>
- <reference source="DS" ref_id="20131002" ref_url="test_attestation" />
+ <reference source="SDW" ref_id="20131025" ref_url="test_attestation" />
</metadata>
<criteria>
<criterion comment="remember parameter is set to 0" test_ref="test_accounts_password_reuse_limit" />
@@ -19,15 +19,14 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_accounts_password_reuse_limit" version="1">
- <ind:path>/etc/pam.d</ind:path>
- <ind:filename>system-auth</ind:filename>
+ <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
<ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*remember=([0-9]*).*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_accounts_password_reuse_limit" version="1">
- <ind:subexpression datatype="int" operation="greater than or equal" var_ref="password_history_retain_number" />
+ <ind:subexpression datatype="int" operation="greater than or equal" var_ref="var_password_history_retain_limit" />
</ind:textfilecontent54_state>
- <external_variable comment="number of passwords that should be remembered" datatype="int" id="password_history_retain_number" version="1" />
+ <external_variable comment="number of passwords that should be remembered" datatype="int" id="var_password_history_retain_limit" version="1" />
</def-group>
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index 0099b0a..ada9760 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -13,8 +13,8 @@
<select idref="password_require_specials" selected="true"/>
<select idref="password_require_lowercases" selected="true"/>
<select idref="password_require_diffchars" selected="true"/>
-<select idref="limiting_password_reuse" selected="true"/>
-<refine-value idref="password_history_retain_number" selector="10"/>
+<select idref="accounts_password_reuse_limit" selected="true"/>
+<refine-value idref="var_password_history_retain_limit" selector="10"/>
<select idref="accounts_password_warn_age_login_defs" selected="true"/>
<select idref="account_disable_post_pw_expiration" selected="true" />
<select idref="deny_password_attempts" selected="true" />
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 19cd181..bac6296 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -224,7 +224,7 @@ these should likely be moved out of common.
<!-- <select idref="uninstall_squid" selected="true"/> -->
<!-- <select idref="disable_snmpd" selected="true"/> -->
<!-- <select idref="uninstall_net-snmp" selected="true"/> -->
-<select idref="limiting_password_reuse" selected="true"/>
+<select idref="accounts_password_reuse_limit" selected="true"/>
<!-- Refine Values -->
<refine-value idref="var_umask_for_daemons" selector="027"/>
<!-- daemon umask -->
@@ -250,7 +250,7 @@ these should likely be moved out of common.
<!-- Minimum number of lower case in password -->
<refine-value idref="var_password_pam_cracklib_difok" selector="3"/>
<!-- Minimum number of characters not present in old password -->
-<refine-value idref="password_history_retain_number" selector="5"/>
+<refine-value idref="var_password_history_retain_limit" selector="5"/>
<!-- Passwords to remember -->
<refine-value idref="var_accounts_user_umask" selector="077"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index 0d48dbf..a5f7e13 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -282,8 +282,8 @@
<select idref="password_require_specials" selected="true" />
<select idref="password_require_lowercases" selected="true" />
<select idref="password_require_diffchars" selected="true" />
-<refine-value idref="password_history_retain_number" selector="24" />
-<select idref="limiting_password_reuse" selected="true" />
+<refine-value idref="var_password_history_retain_limit" selector="24" />
+<select idref="accounts_password_reuse_limit" selected="true" />
<select idref="set_password_hashing_algorithm_systemauth" selected="true" />
<select idref="set_password_hashing_algorithm_logindefs" selected="true" />
<select idref="set_password_hashing_algorithm_libuserconf" selected="true" />
diff --git a/RHEL6/input/profiles/rht-ccp.xml b/RHEL6/input/profiles/rht-ccp.xml
index 40d4a81..daf6e9c 100644
--- a/RHEL6/input/profiles/rht-ccp.xml
+++ b/RHEL6/input/profiles/rht-ccp.xml
@@ -18,7 +18,7 @@
<refine-value idref="var_password_pam_cracklib_ocredit" selector="2"/>
<refine-value idref="var_password_pam_cracklib_lcredit" selector="2"/>
<refine-value idref="var_password_pam_cracklib_difok" selector="3"/>
-<refine-value idref="password_history_retain_number" selector="5"/>
+<refine-value idref="var_password_history_retain_limit" selector="5"/>
<refine-value idref="var_accounts_user_umask" selector="077"/>
<refine-value idref="login_banner_text" selector="usgcb_default"/>
@@ -45,7 +45,7 @@
<select idref="package_aide_installed" selected="true"/>
<!-- ACCOUNT MANAGEMENT CHECKS -->
-<select idref="limiting_password_reuse" selected="true"/>
+<select idref="accounts_password_reuse_limit" selected="true"/>
<select idref="no_shelllogin_for_systemaccounts" selected="true"/>
<select idref="no_empty_passwords" selected="true"/>
<select idref="no_hashes_outside_shadow" selected="true"/>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index 3b8ea26..c917109 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -22,7 +22,7 @@
<select idref="disable_xwindows_with_runlevel" selected="true"/>
<select idref="packagegroup_xwindows_remove" selected="true"/>
<select idref="disable_dhcp_client" selected="true"/>
-<select idref="limiting_password_reuse" selected="true"/>
+<select idref="accounts_password_reuse_limit" selected="true"/>
<select idref="gid_passwd_group_same" selected="true"/>
<select idref="account_unique_name" selected="true"/>
@@ -87,8 +87,8 @@
<select idref="accounts_passwords_pam_fail_interval" selected="true" />
<refine-value idref="var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
-<!-- from inherited Rule, limiting_password_reuse -->
-<refine-value idref="password_history_retain_number" selector="24"/>
+<!-- from inherited Rule, accounts_password_reuse_limit -->
+<refine-value idref="var_password_history_retain_limit" selector="24"/>
<refine-value idref="var_accounts_maximum_age_login_defs" selector="60"/>
<refine-value idref="var_accounts_minimum_age_login_defs" selector="1"/>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 5d0407d..28ec60c 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -86,8 +86,8 @@
<select idref="deny_password_attempts" selected="true" />
<select idref="set_password_hashing_algorithm_systemauth" selected="true" />
<select idref="set_password_hashing_algorithm_logindefs" selected="true" />
-<refine-value idref="password_history_retain_number" selector="24" />
-<select idref="limiting_password_reuse" selected="true" />
+<refine-value idref="var_password_history_retain_limit" selector="24" />
+<select idref="accounts_password_reuse_limit" selected="true" />
<select idref="root_path_no_dot" selected="true" />
<select idref="root_path_no_groupother_writable" selected="true" />
<select idref="homedir_perms_no_groupwrite_worldread" selected="true" />
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 042abef..2ad6609 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -41,7 +41,7 @@ a series of system defaults. One reference to the configuration
file syntax can be found at
http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-configuration-file.html.</warning>
-<Value id="password_history_retain_number" type="number"
+<Value id="var_password_history_retain_limit" type="number"
operator="equals" interactive="0">
<title>remember</title>
<description>The last n passwords for each user are saved in
@@ -490,7 +490,7 @@ specific period of time prevents direct password guessing attacks.
<ref nist="AC-7(a)" disa="1452" />
</Rule>
-<Rule id="limiting_password_reuse" severity="medium">
+<Rule id="accounts_password_reuse_limit" severity="medium">
<title>Limit Password Reuse</title>
<description>Do not allow users to reuse recent passwords. This can
be accomplished by using the <tt>remember</tt> option for the <tt>pam_unix</tt> PAM
@@ -508,7 +508,7 @@ The output should show the following at the end of the line:
Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.
</rationale>
<ident cce="26741-9" />
-<oval id="accounts_password_reuse_limit" value="password_history_retain_number" />
+<oval id="accounts_password_reuse_limit" value="var_password_history_retain_limit" />
<ref nist="IA-5(f),IA-5(1)(e)" disa="200" />
<tested by="DS" on="20121024"/>
</Rule>
--
1.7.1
More information about the scap-security-guide
mailing list