[PATCH 06/22] OVAL signoff + remediation

Shawn Wells shawn.d.wells at gmail.com
Mon Sep 16 01:31:12 UTC 2013


-------------- next part --------------
>From 387b0cdadaa9a6c0d54f5cfaa28538d2e4d05392 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Wed, 11 Sep 2013 19:26:21 -0400
Subject: [PATCH 06/22] OVAL signoff + remediation: accounts_password_warn_age_login_defs
 - OVAL signoff
 - Added remediation

TESTING:
[root at SSG-RHEL6 checks]# var_password_warn_age=7 ; export var_password_warn_age
[root at SSG-RHEL6 checks]# sed  -i 's/^PASS_WARN_AGE.*/PASS_WARN_AGE   4/' /etc/login.defs
[root at SSG-RHEL6 checks]# ./testcheck.py accounts_password_warn_age_login_defs.xml
external_variable with id : var_password_warn_age
Evaluating with OVAL tempfile : /tmp/accounts_password_warn_age_login_defsIn0GFd.xml
Writing results to : /tmp/accounts_password_warn_age_login_defsIn0GFd.xml-results
Definition oval:scap-security-guide.testing:def:138: false
Evaluation done.
[root at SSG-RHEL6 checks]# sed  -i 's/^PASS_WARN_AGE.*/PASS_WARN_AGE   10/' /etc/login.defs
[root at SSG-RHEL6 checks]# ./testcheck.py accounts_password_warn_age_login_defs.xml
external_variable with id : var_password_warn_age
Evaluating with OVAL tempfile : /tmp/accounts_password_warn_age_login_defsxC78D6.xml
Writing results to : /tmp/accounts_password_warn_age_login_defsxC78D6.xml-results
Definition oval:scap-security-guide.testing:def:138: true
Evaluation done.
---
 .../accounts_password_warn_age_login_defs.xml      |    1 +
 .../bash/accounts_password_warn_age_login_defs.sh  |    8 ++++++++
 2 files changed, 9 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh

diff --git a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml
index 7c153e7..40a6449 100644
--- a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml
+++ b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml
@@ -6,6 +6,7 @@
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
       <description>The password expiration warning age should be set appropriately.</description>
+      <reference source="swells" ref_id="20130914" ref_url="test_attestation" />
     </metadata>
     <criteria>
       <criterion test_ref="test_pass_warn_age" />
diff --git a/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh b/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh
new file mode 100644
index 0000000..0437705
--- /dev/null
+++ b/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh
@@ -0,0 +1,8 @@
+source ./templates/support.sh
+populate var_password_warn_age
+
+grep -q ^PASS_WARN_DAYS /etc/login.defs && \
+  sed -i "s/PASS_WARN_DAYS.*/PASS_WARN_DAYS     $var_password_warn_age/g" /etc/login.defs
+if ! [ $? -eq 0 ]; then
+    echo "PASS_WARN_DAYS      $var_password_warn_age"
+fi
-- 
1.7.1



More information about the scap-security-guide mailing list