Issue with PASS_MIN_DAYS validation
Shawn Wells
shawn at redhat.com
Sat Oct 26 04:03:10 UTC 2013
On 10/25/13, 7:21 AM, wm-lists wrote:
> yes mine is different since we use sssd for authentication, the
> placement of the cracklib is the same though. Switching to your
> cracklib values, actually caused me to fail more of the categories
> auth required pam_env.so
> auth sufficient pam_unix.so try_first_pass
> auth requisite pam_succeed_if.so uid >= 500 quiet
> auth sufficient pam_sss.so use_first_pass
> auth [default=die] pam_faillock.so authfail deny=3
> unlock_time=604800 fail_interval=900
> auth required pam_faillock.so authsucc deny=3
> unlock_time=604800 fail_interval=900
> auth required pam_deny.so
>
> account required pam_unix.so
> account sufficient pam_localuser.so
> account sufficient pam_succeed_if.so uid < 500 quiet
> account [default=bad success=ok user_unknown=ignore] pam_sss.so
> account required pam_permit.so
>
> password requisite pam_cracklib.so try_first_pass retry=3
> dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4
> password sufficient pam_unix.so sha512 shadow try_first_pass
> use_authtok remember=5
> password sufficient pam_sss.so use_authtok
> password required pam_deny.so
>
> session optional pam_keyinit.so revoke
> session required pam_limits.so
> session optional pam_oddjob_mkhomedir.so
> session [success=1 default=ignore] pam_succeed_if.so service in
> crond quiet use_uid
> session required pam_unix.so
> session optional pam_sss.so
>
> I grabbed the zipfile this morning and used it
> <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1"
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="RHEL-6"
> resolved="1" xml:lang="en-US">
> <status date="2013-10-24">draft</status>
>
My results:
http://people.redhat.com/swells/ssg-results/report.html
system-auth:
http://people.redhat.com/swells/ssg-results/system-auth
password-auth:
http://people.redhat.com/swells/ssg-results/password-auth
Tweaked a few of your settings. You can do a wget & diff against your
local copies to identify them.
More information about the scap-security-guide
mailing list