bug: deny_password_attempts* seems broken
Shawn Wells
shawn at redhat.com
Sun Sep 8 23:05:29 UTC 2013
On 9/5/13 2:26 PM, Paul Tittle (Contractor) wrote:
> Using deny_password_attempts as an example, it says:
>
> Add the following lines immediately below the|pam_unix.so|statement
> in|AUTH|section of|/etc/pam.d/system-auth|:
>
> |auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900|
> |auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900|
>
> -----------
>
> Looking at input/checks/accounts_passwords_pam_faillock_deny.xml ,
> accounts_passwords_pam_faillock_deny seems to test for the bottom line
> in /etc/pam.d/system-auth and the top line in
> /etc/pam.d/password-auth, but password-auth is not mentioned in the
> deny_password_attempts description.
>
> For the other two deny_password_attempts tests, it's a similar
> situation. Is the test wrong or the description wrong?
Thanks for reporting this -- and even more so for providing the actual
XCCDF and OVAL names!
These lines should likely be in both system-auth and password-auth. For
example, on a stock RHEL6 image, SSH will use password-auth (not
system-auth) as defined in /etc/pam.d/sshd:
> #%PAM-1.0
> auth required pam_sepermit.so
> auth include password-auth
> account required pam_nologin.so
> account include password-auth
> password include password-auth
> # pam_selinux.so close should be the first session rule
> session required pam_selinux.so close
> session required pam_loginuid.so
> # pam_selinux.so open should only be followed by sessions to be
> executed in the user context
> session required pam_selinux.so open env_params
> session optional pam_keyinit.so force revoke
> session include password-auth
Looks like we might have to update both prose and OVAL for this...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130908/ce132f41/attachment.html>
More information about the scap-security-guide
mailing list