bug: deny_password_attempts* seems broken

Shawn Wells shawn at redhat.com
Sun Sep 8 23:05:29 UTC 2013


On 9/5/13 2:26 PM, Paul Tittle (Contractor) wrote:
> Using deny_password_attempts as an example, it says:
>
> Add the following lines immediately below the|pam_unix.so|statement 
> in|AUTH|section of|/etc/pam.d/system-auth|:
>
> |auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900|
> |auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900|
>
> -----------
>
> Looking at input/checks/accounts_passwords_pam_faillock_deny.xml , 
> accounts_passwords_pam_faillock_deny seems to test for the bottom line 
> in /etc/pam.d/system-auth and the top line in 
> /etc/pam.d/password-auth, but password-auth is not mentioned in the 
> deny_password_attempts description.
>
> For the other two deny_password_attempts tests, it's a similar 
> situation. Is the test wrong or the description wrong?

Thanks for reporting this -- and even more so for providing the actual 
XCCDF and OVAL names!

These lines should likely be in both system-auth and password-auth. For 
example, on a stock RHEL6 image, SSH will use password-auth (not 
system-auth) as defined in /etc/pam.d/sshd:
> #%PAM-1.0
> auth       required     pam_sepermit.so
> auth       include      password-auth
> account    required     pam_nologin.so
> account    include      password-auth
> password   include      password-auth
> # pam_selinux.so close should be the first session rule
> session    required     pam_selinux.so close
> session    required     pam_loginuid.so
> # pam_selinux.so open should only be followed by sessions to be 
> executed in the user context
> session    required     pam_selinux.so open env_params
> session    optional     pam_keyinit.so force revoke
> session    include      password-auth

Looks like we might have to update both prose and OVAL for this...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20130908/ce132f41/attachment.html>


More information about the scap-security-guide mailing list