[PATCH 4/8] OVAL update

Shawn Wells shawn at redhat.com
Sat Oct 26 03:28:23 UTC 2013


-------------- next part --------------
>From 879f1b66a2f8d00e93e4243d9d17262674b8a58b Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Fri, 25 Oct 2013 22:19:04 -0400
Subject: [PATCH 4/8] OVAL update: accounts_password_reuse_limit
 - Updated XCCDF variable to var_{check_name}
 - Aligned XCCDF and OVAL names

---
 RHEL6/input/auxiliary/stig_overlay.xml             |    2 +-
 RHEL6/input/auxiliary/transition_notes.xml         |    2 +-
 .../input/checks/accounts_password_reuse_limit.xml |    9 ++++-----
 RHEL6/input/profiles/CS2.xml                       |    4 ++--
 RHEL6/input/profiles/common.xml                    |    4 ++--
 RHEL6/input/profiles/fisma-medium-rhel6-server.xml |    4 ++--
 RHEL6/input/profiles/rht-ccp.xml                   |    4 ++--
 RHEL6/input/profiles/stig-rhel6-server.xml         |    6 +++---
 RHEL6/input/profiles/usgcb-rhel6-server.xml        |    4 ++--
 RHEL6/input/system/accounts/pam.xml                |    6 +++---
 10 files changed, 22 insertions(+), 23 deletions(-)

diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index bbe8d09..d322169 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -594,7 +594,7 @@
 	<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000273" disa="366" severity="low">
 		<title>The system must use SMB client signing for connecting to samba servers using mount.cifs.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="limiting_password_reuse" ownerid="RHEL-06-000274" disa="200" severity="medium">
+	<overlay owner="disastig" ruleid="accounts_password_reuse_limit" ownerid="RHEL-06-000274" disa="200" severity="medium">
 		<title>The system must prohibit the reuse of passwords within twenty-four iterations.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="encrypt_partitions" ownerid="RHEL-06-000275" disa="1019" severity="low">
diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml
index 811d0e8..c1339c9 100644
--- a/RHEL6/input/auxiliary/transition_notes.xml
+++ b/RHEL6/input/auxiliary/transition_notes.xml
@@ -1300,7 +1300,7 @@ rule=enable_screensaver_after_idle manual=no
 <note ref="4084" auth="KS">
 Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
 does exist.
-rule=limiting_password_reuse manual=no
+rule=accounts_password_reuse_limit manual=no
 </note>
 
 <note ref="4249" auth="KS">
diff --git a/RHEL6/input/checks/accounts_password_reuse_limit.xml b/RHEL6/input/checks/accounts_password_reuse_limit.xml
index b9e5b68..0a30209 100644
--- a/RHEL6/input/checks/accounts_password_reuse_limit.xml
+++ b/RHEL6/input/checks/accounts_password_reuse_limit.xml
@@ -6,7 +6,7 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The passwords to remember should be set correctly.</description>
-      <reference source="DS" ref_id="20131002" ref_url="test_attestation" />
+      <reference source="SDW" ref_id="20131025" ref_url="test_attestation" />
     </metadata>
     <criteria>
       <criterion comment="remember parameter is set to 0" test_ref="test_accounts_password_reuse_limit" />
@@ -19,15 +19,14 @@
   </ind:textfilecontent54_test>
 
   <ind:textfilecontent54_object id="object_accounts_password_reuse_limit" version="1">
-    <ind:path>/etc/pam.d</ind:path>
-    <ind:filename>system-auth</ind:filename>
+    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
     <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*remember=([0-9]*).*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
   <ind:textfilecontent54_state id="state_accounts_password_reuse_limit" version="1">
-    <ind:subexpression datatype="int" operation="greater than or equal" var_ref="password_history_retain_number" />
+    <ind:subexpression datatype="int" operation="greater than or equal" var_ref="var_password_history_retain_limit" />
   </ind:textfilecontent54_state>
 
-  <external_variable comment="number of passwords that should be remembered" datatype="int" id="password_history_retain_number" version="1" />
+  <external_variable comment="number of passwords that should be remembered" datatype="int" id="var_password_history_retain_limit" version="1" />
 </def-group>
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index 0099b0a..ada9760 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -13,8 +13,8 @@
 <select idref="password_require_specials" selected="true"/>
 <select idref="password_require_lowercases" selected="true"/>
 <select idref="password_require_diffchars" selected="true"/>
-<select idref="limiting_password_reuse" selected="true"/>
-<refine-value idref="password_history_retain_number" selector="10"/>
+<select idref="accounts_password_reuse_limit" selected="true"/>
+<refine-value idref="var_password_history_retain_limit" selector="10"/>
 <select idref="accounts_password_warn_age_login_defs" selected="true"/>
 <select idref="account_disable_post_pw_expiration" selected="true" />
 <select idref="deny_password_attempts" selected="true" />
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 19cd181..bac6296 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -224,7 +224,7 @@ these should likely be moved out of common.
 <!-- <select idref="uninstall_squid" selected="true"/> -->
 <!-- <select idref="disable_snmpd" selected="true"/> -->
 <!-- <select idref="uninstall_net-snmp" selected="true"/> -->
-<select idref="limiting_password_reuse" selected="true"/>
+<select idref="accounts_password_reuse_limit" selected="true"/>
 <!-- Refine Values -->
 <refine-value idref="var_umask_for_daemons" selector="027"/>
 <!-- daemon umask -->
@@ -250,7 +250,7 @@ these should likely be moved out of common.
 <!-- Minimum number of lower case in password -->
 <refine-value idref="var_password_pam_cracklib_difok" selector="3"/>
 <!-- Minimum number of characters not present in old password -->
-<refine-value idref="password_history_retain_number" selector="5"/>
+<refine-value idref="var_password_history_retain_limit" selector="5"/>
 <!-- Passwords to remember -->
 
 <refine-value idref="var_accounts_user_umask" selector="077"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index 0d48dbf..a5f7e13 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -282,8 +282,8 @@
 <select idref="password_require_specials" selected="true" />
 <select idref="password_require_lowercases" selected="true" />
 <select idref="password_require_diffchars" selected="true" />
-<refine-value idref="password_history_retain_number" selector="24" />
-<select idref="limiting_password_reuse" selected="true" />
+<refine-value idref="var_password_history_retain_limit" selector="24" />
+<select idref="accounts_password_reuse_limit" selected="true" />
 <select idref="set_password_hashing_algorithm_systemauth" selected="true" />
 <select idref="set_password_hashing_algorithm_logindefs" selected="true" />
 <select idref="set_password_hashing_algorithm_libuserconf" selected="true" />
diff --git a/RHEL6/input/profiles/rht-ccp.xml b/RHEL6/input/profiles/rht-ccp.xml
index 40d4a81..daf6e9c 100644
--- a/RHEL6/input/profiles/rht-ccp.xml
+++ b/RHEL6/input/profiles/rht-ccp.xml
@@ -18,7 +18,7 @@
 <refine-value idref="var_password_pam_cracklib_ocredit" selector="2"/>
 <refine-value idref="var_password_pam_cracklib_lcredit" selector="2"/>
 <refine-value idref="var_password_pam_cracklib_difok" selector="3"/>
-<refine-value idref="password_history_retain_number" selector="5"/>
+<refine-value idref="var_password_history_retain_limit" selector="5"/>
 <refine-value idref="var_accounts_user_umask" selector="077"/>
 <refine-value idref="login_banner_text" selector="usgcb_default"/>
 
@@ -45,7 +45,7 @@
 <select idref="package_aide_installed" selected="true"/>
 
 <!-- ACCOUNT MANAGEMENT CHECKS -->
-<select idref="limiting_password_reuse" selected="true"/>
+<select idref="accounts_password_reuse_limit" selected="true"/>
 <select idref="no_shelllogin_for_systemaccounts" selected="true"/>
 <select idref="no_empty_passwords" selected="true"/>
 <select idref="no_hashes_outside_shadow" selected="true"/>
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index 3b8ea26..c917109 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -22,7 +22,7 @@
 <select idref="disable_xwindows_with_runlevel" selected="true"/>
 <select idref="packagegroup_xwindows_remove" selected="true"/>
 <select idref="disable_dhcp_client" selected="true"/>
-<select idref="limiting_password_reuse" selected="true"/>
+<select idref="accounts_password_reuse_limit" selected="true"/>
 
 <select idref="gid_passwd_group_same" selected="true"/>
 <select idref="account_unique_name" selected="true"/>
@@ -87,8 +87,8 @@
 <select idref="accounts_passwords_pam_fail_interval" selected="true" />
 <refine-value idref="var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
 
-<!-- from inherited Rule, limiting_password_reuse -->
-<refine-value idref="password_history_retain_number" selector="24"/>
+<!-- from inherited Rule, accounts_password_reuse_limit -->
+<refine-value idref="var_password_history_retain_limit" selector="24"/>
 
 <refine-value idref="var_accounts_maximum_age_login_defs" selector="60"/>
 <refine-value idref="var_accounts_minimum_age_login_defs" selector="1"/>
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 5d0407d..28ec60c 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -86,8 +86,8 @@
 <select idref="deny_password_attempts" selected="true" />
 <select idref="set_password_hashing_algorithm_systemauth" selected="true" />
 <select idref="set_password_hashing_algorithm_logindefs" selected="true" />
-<refine-value idref="password_history_retain_number" selector="24" />
-<select idref="limiting_password_reuse" selected="true" />
+<refine-value idref="var_password_history_retain_limit" selector="24" />
+<select idref="accounts_password_reuse_limit" selected="true" />
 <select idref="root_path_no_dot" selected="true" />
 <select idref="root_path_no_groupother_writable" selected="true" />
 <select idref="homedir_perms_no_groupwrite_worldread" selected="true" />
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index 042abef..2ad6609 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -41,7 +41,7 @@ a series of system defaults. One reference to the configuration
 file syntax can be found at
 http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/sag-configuration-file.html.</warning>
 
-<Value id="password_history_retain_number" type="number"
+<Value id="var_password_history_retain_limit" type="number"
 operator="equals" interactive="0">
 <title>remember</title>
 <description>The last n passwords for each user are saved in
@@ -490,7 +490,7 @@ specific period of time prevents direct password guessing attacks.
 <ref nist="AC-7(a)" disa="1452" />
 </Rule>
 
-<Rule id="limiting_password_reuse" severity="medium">
+<Rule id="accounts_password_reuse_limit" severity="medium">
 <title>Limit Password Reuse</title>
 <description>Do not allow users to reuse recent passwords. This can
 be accomplished by using the <tt>remember</tt> option for the <tt>pam_unix</tt> PAM
@@ -508,7 +508,7 @@ The output should show the following at the end of the line:
 Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.
 </rationale>
 <ident cce="26741-9" />
-<oval id="accounts_password_reuse_limit" value="password_history_retain_number" />
+<oval id="accounts_password_reuse_limit" value="var_password_history_retain_limit" />
 <ref nist="IA-5(f),IA-5(1)(e)" disa="200" />
 <tested by="DS" on="20121024"/>
 </Rule>
-- 
1.7.1



More information about the scap-security-guide mailing list