[PATCH 02/22] OVAL signoff + remediation

Shawn Wells shawn.d.wells at gmail.com
Mon Sep 16 01:30:48 UTC 2013


-------------- next part --------------
>From 20db1925ac1d7e1ea43bc4e0ec9179d4bb03ad43 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Wed, 11 Sep 2013 19:10:12 -0400
Subject: [PATCH 02/22] OVAL signoff + remediation: accounts_password_minlen_login_defs
 - Old OVAL was checking system-auth, XCCDF calls /etc/login.defs
 - OVAL signoff
 - Added remediation

TESTING
[root at SSG-RHEL6 checks]# var_password_min_len=14 ; export var_password_min_len
[root at SSG-RHEL6 checks]# grep PASS_MIN_LEN /etc/login.defs
PASS_MIN_LEN    16
[root at SSG-RHEL6 checks]# ./testcheck.py accounts_password_minlen_login_defs.xml
external_variable with id : var_password_min_len
Evaluating with OVAL tempfile : /tmp/accounts_password_minlen_login_defst4Eyj6.xml
Writing results to : /tmp/accounts_password_minlen_login_defst4Eyj6.xml-results
Definition oval:scap-security-guide.testing:def:131: true
Evaluation done.
[root at SSG-RHEL6 checks]# sed  -i 's/^PASS_MIN_LEN.*/PASS_MIN_LEN    14/' /etc/login.defs
[root at SSG-RHEL6 checks]# ./testcheck.py accounts_password_minlen_login_defs.xml
external_variable with id : var_password_min_len
Evaluating with OVAL tempfile : /tmp/accounts_password_minlen_login_defs2Ja_12.xml
Writing results to : /tmp/accounts_password_minlen_login_defs2Ja_12.xml-results
Definition oval:scap-security-guide.testing:def:131: true
Evaluation done.
[root at SSG-RHEL6 checks]# sed  -i 's/^PASS_MIN_LEN.*/PASS_MIN_LEN    13/' /etc/login.defs
[root at SSG-RHEL6 checks]# ./testcheck.py accounts_password_minlen_login_defs.xml
external_variable with id : var_password_min_len
Evaluating with OVAL tempfile : /tmp/accounts_password_minlen_login_defsGqn_HD.xml
Writing results to : /tmp/accounts_password_minlen_login_defsGqn_HD.xml-results
Definition oval:scap-security-guide.testing:def:131: false
Evaluation done.
---
 .../checks/accounts_password_minlen_login_defs.xml |   13 +------------
 .../bash/accounts_password_minlen_login_defs.sh    |    8 ++++++++
 2 files changed, 9 insertions(+), 12 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh

diff --git a/RHEL6/input/checks/accounts_password_minlen_login_defs.xml b/RHEL6/input/checks/accounts_password_minlen_login_defs.xml
index 4dd66c8..7d20c27 100644
--- a/RHEL6/input/checks/accounts_password_minlen_login_defs.xml
+++ b/RHEL6/input/checks/accounts_password_minlen_login_defs.xml
@@ -7,29 +7,18 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The password minimum length should be set appropriately.</description>
+      <reference source="swells" ref_id="20130914" ref_url="test_attestation" />
     </metadata>
     <criteria operator="AND">
-      <criterion test_ref="test_pam_minlen_set" />
       <criterion test_ref="test_etc_login_defs" />
     </criteria>
   </definition>
 
-  <ind:textfilecontent54_test check="all" comment="minlen set in /etc/pam.d/system-auth" id="test_pam_minlen_set" version="1">
-    <ind:object object_ref="object_pam_minlen_set" />
-    <ind:state state_ref="state_password_min_len" />
-  </ind:textfilecontent54_test>
-
   <ind:textfilecontent54_test check="all" comment="check PASS_MIN_LEN in /etc/login.defs" id="test_etc_login_defs" version="1">
     <ind:object object_ref="object_etc_login_defs" />
     <ind:state state_ref="state_password_min_len" />
   </ind:textfilecontent54_test>
 
-  <ind:textfilecontent54_object id="object_pam_minlen_set" version="1">
-    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
-    <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*minlen=(\d+).*$</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
   <ind:textfilecontent54_object id="object_etc_login_defs" version="1">
     <ind:filepath>/etc/login.defs</ind:filepath>
     <ind:pattern operation="pattern match">^PASS_MIN_LEN\s+(\d+)\s*$</ind:pattern>
diff --git a/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh b/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh
new file mode 100644
index 0000000..8ea789f
--- /dev/null
+++ b/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh
@@ -0,0 +1,8 @@
+source ./templates/support.sh
+populate var_password_min_len
+
+grep -q ^PASS_MIN_LEN /etc/login.defs && \
+  sed -i "s/PASS_MIN_LEN.*/PASS_MIN_LEN     $var_password_min_len/g" /etc/ssh/sshd_config
+if ! [ $? -eq 0 ]; then
+    echo "PASS_MIN_LEN      $var_password_min_len"
+fi
-- 
1.7.1



More information about the scap-security-guide mailing list