[PATCH 22/22] Updated XCCDF/OVAL namings

Shawn Wells shawn.d.wells at gmail.com
Mon Sep 16 01:34:33 UTC 2013


-------------- next part --------------
>From bf44c490e81aba7221acb2804b715a61b067b3e8 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sun, 15 Sep 2013 21:19:04 -0400
Subject: [PATCH 22/22] Updated XCCDF/OVAL namings

---
 RHEL6/input/auxiliary/stig_overlay.xml             |    4 ++--
 RHEL6/input/auxiliary/transition_notes.xml         |    6 +++---
 .../checks/accounts_maximum_age_login_defs.xml     |    8 ++++----
 .../checks/accounts_minimum_age_login_defs.xml     |    4 ++--
 .../accounts_password_warn_age_login_defs.xml      |    4 ++--
 .../fixes/bash/accounts_maximum_age_login_defs.sh  |    6 +++---
 .../fixes/bash/accounts_minimum_age_login_defs.sh  |    8 ++++----
 .../bash/accounts_password_minlen_login_defs.sh    |    6 +++---
 .../bash/accounts_password_warn_age_login_defs.sh  |    6 +++---
 RHEL6/input/profiles/CS2.xml                       |   10 +++++-----
 RHEL6/input/profiles/common.xml                    |   12 ++++++------
 RHEL6/input/profiles/fisma-medium-rhel6-server.xml |    6 +++---
 RHEL6/input/profiles/stig-rhel6-server.xml         |    4 ++--
 RHEL6/input/profiles/test.xml                      |   12 ++++++------
 RHEL6/input/profiles/usgcb-rhel6-server.xml        |    8 ++++----
 .../accounts/restrictions/password_expiration.xml  |   20 ++++++++++----------
 16 files changed, 62 insertions(+), 62 deletions(-)

diff --git a/RHEL6/input/auxiliary/stig_overlay.xml b/RHEL6/input/auxiliary/stig_overlay.xml
index 10fd0c5..fa3ee05 100644
--- a/RHEL6/input/auxiliary/stig_overlay.xml
+++ b/RHEL6/input/auxiliary/stig_overlay.xml
@@ -120,10 +120,10 @@
 	<overlay owner="disastig" ruleid="accounts_password_minlen_login_defs" ownerid="RHEL-06-000050" disa="205" severity="medium">
 		<title>The system must require passwords to contain a minimum of 14 characters.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="password_min_age" ownerid="RHEL-06-000051" disa="198" severity="medium">
+	<overlay owner="disastig" ruleid="accounts_minimum_age_login_defs" ownerid="RHEL-06-000051" disa="198" severity="medium">
 		<title>Users must not be able to change passwords more than once every 24 hours.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="password_max_age" ownerid="RHEL-06-000053" disa="199" severity="medium">
+	<overlay owner="disastig" ruleid="accounts_maximum_age_login_defs" ownerid="RHEL-06-000053" disa="199" severity="medium">
 		<title>User passwords must be changed at least every 60 days.</title>
 	</overlay>
 	<overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-06-000054" disa="366" severity="low">
diff --git a/RHEL6/input/auxiliary/transition_notes.xml b/RHEL6/input/auxiliary/transition_notes.xml
index f2e18dd..811d0e8 100644
--- a/RHEL6/input/auxiliary/transition_notes.xml
+++ b/RHEL6/input/auxiliary/transition_notes.xml
@@ -1273,13 +1273,13 @@ rule=smb_restrict_file_sharing manual=no
 <note ref="1030" auth="KS">
 Check exists in the RHEL6 prose, it can be automated and the OVAL for it
 does not appear to exist.
-rule=password_min_age manual=no
+rule=accounts_minimum_age_login_defs manual=no
 </note>
 
 <note ref="1032" auth="KS">
 Check exists in the RHEL6 prose, it can be automated and the OVAL for it
 partially exists.
-rule=password_min_age manual=no
+rule=accounts_minimum_age_login_defs manual=no
 Guide and oval address changing the defaults but don't address the current
 values
 </note>
@@ -1468,7 +1468,7 @@ No automated means to determine presence in DMZ. We should not be allowing FTP.
 <note ref="11976" auth="KS">
 Check does exist in the RHEL6 prose, it can be automated and the OVAL for it 
 does exist.
-rule=password_max_age manual=yes
+rule=accounts_maximum_age_login_defs manual=yes
 </note>
 
 <note ref="11980" auth="KS">
diff --git a/RHEL6/input/checks/accounts_maximum_age_login_defs.xml b/RHEL6/input/checks/accounts_maximum_age_login_defs.xml
index 8b989c5..5360e66 100644
--- a/RHEL6/input/checks/accounts_maximum_age_login_defs.xml
+++ b/RHEL6/input/checks/accounts_maximum_age_login_defs.xml
@@ -16,7 +16,7 @@
 
   <ind:textfilecontent54_test check="all" comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs" id="test_pass_max_days" version="1">
     <ind:object object_ref="object_etc_login_defs_pass_max" />
-    <ind:state state_ref="state_password_max_age" />
+    <ind:state state_ref="state_accounts_maximum_age_login_defs" />
   </ind:textfilecontent54_test>
 
   <ind:textfilecontent54_object id="object_etc_login_defs_pass_max" version="1">
@@ -25,10 +25,10 @@
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
 
-  <ind:textfilecontent54_state id="state_password_max_age" version="1">
-    <ind:subexpression operation="less than or equal" var_ref="var_password_max_age" datatype="int" />
+  <ind:textfilecontent54_state id="state_accounts_maximum_age_login_defs" version="1">
+    <ind:subexpression operation="less than or equal" var_ref="var_accounts_maximum_age_login_defs" datatype="int" />
   </ind:textfilecontent54_state>
 
-  <external_variable comment="maximum password age" datatype="int" id="var_password_max_age" version="1" />
+  <external_variable comment="maximum password age" datatype="int" id="var_accounts_maximum_age_login_defs" version="1" />
 
 </def-group>
diff --git a/RHEL6/input/checks/accounts_minimum_age_login_defs.xml b/RHEL6/input/checks/accounts_minimum_age_login_defs.xml
index 423cd60..a0cc5c3 100644
--- a/RHEL6/input/checks/accounts_minimum_age_login_defs.xml
+++ b/RHEL6/input/checks/accounts_minimum_age_login_defs.xml
@@ -27,9 +27,9 @@
   </ind:textfilecontent54_object>
 
   <ind:textfilecontent54_state id="state_etc_login_defs_pass_min_age" version="1">
-    <ind:subexpression operation="greater than or equal" var_ref="var_password_min_age" datatype="int" />
+    <ind:subexpression operation="greater than or equal" var_ref="var_accounts_minimum_age_login_defs" datatype="int" />
   </ind:textfilecontent54_state>
 
-  <external_variable comment="minimum password age in days" datatype="int" id="var_password_min_age" version="1" />
+  <external_variable comment="minimum password age in days" datatype="int" id="var_accounts_minimum_age_login_defs" version="1" />
 
 </def-group>
diff --git a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml
index 40a6449..9dce3e9 100644
--- a/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml
+++ b/RHEL6/input/checks/accounts_password_warn_age_login_defs.xml
@@ -28,9 +28,9 @@
   </ind:textfilecontent54_object>
 
   <ind:textfilecontent54_state id="state_etc_login_defs_pass_warn_age" version="1">
-    <ind:subexpression operation="greater than or equal" var_ref="var_password_warn_age" datatype="int" />
+    <ind:subexpression operation="greater than or equal" var_ref="var_accounts_password_warn_age_login_defs" datatype="int" />
   </ind:textfilecontent54_state>
 
-  <external_variable comment="password expiration warning age in days" datatype="int" id="var_password_warn_age" version="1" />
+  <external_variable comment="password expiration warning age in days" datatype="int" id="var_accounts_password_warn_age_login_defs" version="1" />
 
 </def-group>
diff --git a/RHEL6/input/fixes/bash/accounts_maximum_age_login_defs.sh b/RHEL6/input/fixes/bash/accounts_maximum_age_login_defs.sh
index 7daa487..0ae18b1 100644
--- a/RHEL6/input/fixes/bash/accounts_maximum_age_login_defs.sh
+++ b/RHEL6/input/fixes/bash/accounts_maximum_age_login_defs.sh
@@ -1,8 +1,8 @@
 source ./templates/support.sh
-populate var_password_max_age
+populate var_accounts_maximum_age_login_defs
 
 grep -q ^PASS_MAX_DAYS /etc/login.defs && \
-  sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS     $var_password_max_age/g" /etc/login.defs
+  sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS     $var_accounts_maximum_age_login_defs/g" /etc/login.defs
 if ! [ $? -eq 0 ]; then
-    echo "PASS_MAX_DAYS      $var_password_max_age" >> /etc/login.defs
+    echo "PASS_MAX_DAYS      $var_accounts_maximum_age_login_defs" >> /etc/login.defs
 fi
diff --git a/RHEL6/input/fixes/bash/accounts_minimum_age_login_defs.sh b/RHEL6/input/fixes/bash/accounts_minimum_age_login_defs.sh
index 1c4a136..e363db6 100644
--- a/RHEL6/input/fixes/bash/accounts_minimum_age_login_defs.sh
+++ b/RHEL6/input/fixes/bash/accounts_minimum_age_login_defs.sh
@@ -1,8 +1,8 @@
 source ./templates/support.sh
-populate var_password_min_age
+populate var_accounts_minimum_age_login_defs
 
-grep -q ^PASS_MIN_AGE /etc/login.defs && \
-  sed -i "s/PASS_MIN_AGE.*/PASS_MIN_AGE     $var_password_min_age/g" /etc/login.defs
+grep -q ^PASS_MIN_DAYS /etc/login.defs && \
+  sed -i "s/PASS_MIN_DAYS.*/PASS_MIN_DAYS     $var_accounts_minimum_age_login_defs/g" /etc/login.defs
 if ! [ $? -eq 0 ]; then
-    echo "PASS_MIN_AGE      $var_password_min_age" >> /etc/login.defs
+    echo "PASS_MIN_DAYS      $var_accounts_minimum_age_login_defs" >> /etc/login.defs
 fi
diff --git a/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh b/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh
index 69b50e5..1d4ed31 100644
--- a/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh
+++ b/RHEL6/input/fixes/bash/accounts_password_minlen_login_defs.sh
@@ -1,8 +1,8 @@
 source ./templates/support.sh
-populate var_password_min_len
+populate var_accounts_password_minlen_login_defs
 
 grep -q ^PASS_MIN_LEN /etc/login.defs && \
-  sed -i "s/PASS_MIN_LEN.*/PASS_MIN_LEN     $var_password_min_len/g" /etc/login.defs
+  sed -i "s/PASS_MIN_LEN.*/PASS_MIN_LEN     $var_accounts_password_minlen_login_defs/g" /etc/login.defs
 if ! [ $? -eq 0 ]; then
-    echo "PASS_MIN_LEN      $var_password_min_len" >> /etc/login.defs
+    echo "PASS_MIN_LEN      $var_accounts_password_minlen_login_defs" >> /etc/login.defs
 fi
diff --git a/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh b/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh
index 6377bcc..250b141 100644
--- a/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh
+++ b/RHEL6/input/fixes/bash/accounts_password_warn_age_login_defs.sh
@@ -1,8 +1,8 @@
 source ./templates/support.sh
-populate var_password_warn_age
+populate var_accounts_password_warn_age_login_defs
 
 grep -q ^PASS_WARN_DAYS /etc/login.defs && \
-  sed -i "s/PASS_WARN_DAYS.*/PASS_WARN_DAYS     $var_password_warn_age/g" /etc/login.defs
+  sed -i "s/PASS_WARN_DAYS.*/PASS_WARN_DAYS     $var_accounts_password_warn_age_login_defs/g" /etc/login.defs
 if ! [ $? -eq 0 ]; then
-    echo "PASS_WARN_DAYS      $var_password_warn_age" >> /etc/login.defs
+    echo "PASS_WARN_DAYS      $var_accounts_password_warn_age_login_defs" >> /etc/login.defs
 fi
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index 01d74c1..af71984 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -4,10 +4,10 @@
 
 <select idref="accounts_password_minlen_login_defs" selected="true"/>
 <refine-value idref="var_accounts_password_minlen_login_defs" selector="14"/>
-<select idref="password_min_age" selected="true"/>
-<refine-value idref="var_password_min_age" selector="1"/>
-<select idref="password_max_age" selected="true"/>
-<refine-value idref="var_password_max_age" selector="180"/>
+<select idref="accounts_minimum_age_login_defs" selected="true"/>
+<refine-value idref="var_accounts_minimum_age_login_defs" selector="1"/>
+<select idref="accounts_maximum_age_login_defs" selected="true"/>
+<refine-value idref="var_accounts_maximum_age_login_defs" selector="180"/>
 <select idref="password_require_digits" selected="true"/>
 <select idref="password_require_uppercases" selected="true"/>
 <select idref="password_require_specials" selected="true"/>
@@ -15,7 +15,7 @@
 <select idref="password_require_diffchars" selected="true"/>
 <select idref="limiting_password_reuse" selected="true"/>
 <refine-value idref="password_history_retain_number" selector="10"/>
-<select idref="password_warn_age" selected="true"/>
+<select idref="accounts_password_warn_age_login_defs" selected="true"/>
 <select idref="account_disable_post_pw_expiration" selected="true" />
 <select idref="deny_password_attempts" selected="true" />
 <select idref="password_retry" selected="true"/>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index 5acf312..e6e345f 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -48,9 +48,9 @@
 <select idref="audit_logs_permissions" selected="true"/>
 
 <select idref="accounts_password_minlen_login_defs" selected="true"/>
-<select idref="password_min_age" selected="true"/>
-<select idref="password_max_age" selected="true"/>
-<select idref="password_warn_age" selected="true"/>
+<select idref="accounts_minimum_age_login_defs" selected="true"/>
+<select idref="accounts_maximum_age_login_defs" selected="true"/>
+<select idref="accounts_password_warn_age_login_defs" selected="true"/>
 <select idref="password_retry" selected="true"/>
 <select idref="password_require_digits" selected="true"/>
 <select idref="password_require_uppercases" selected="true"/>
@@ -230,11 +230,11 @@ these should likely be moved out of common.
 <!-- daemon umask -->
 <refine-value idref="var_accounts_password_minlen_login_defs" selector="14"/>
 <!-- password minimum length -->
-<refine-value idref="var_password_max_age" selector="90"/>
+<refine-value idref="var_accounts_maximum_age_login_defs" selector="90"/>
 <!-- maximum password age -->
-<refine-value idref="var_password_min_age" selector="7"/>
+<refine-value idref="var_accounts_minimum_age_login_defs" selector="7"/>
 <!-- minimum password age -->
-<refine-value idref="var_password_warn_age" selector="7"/>
+<refine-value idref="var_accounts_password_warn_age_login_defs" selector="7"/>
 <!-- password warn age -->
 <refine-value idref="var_password_pam_cracklib_retry" selector="3"/>
 <!-- Number of retry attempts before erroring out -->
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index 1f8f664..80a69e0 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -292,9 +292,9 @@
 <select idref="no_netrc_files" selected="true" />
 <refine-value idref="var_accounts_password_minlen_login_defs" selector="12" />
 <select idref="accounts_password_minlen_login_defs" selected="true" />
-<select idref="password_min_age" selected="true" />
-<select idref="password_max_age" selected="true" />
-<select idref="password_warn_age" selected="true" />
+<select idref="accounts_minimum_age_login_defs" selected="true" />
+<select idref="accounts_maximum_age_login_defs" selected="true" />
+<select idref="accounts_password_warn_age_login_defs" selected="true" />
 <select idref="require_singleuser_auth" selected="true" />
 <refine-value idref="var_password_pam_cracklib_difok" selector="1" />
 <select idref="password_require_diffchars" selected="true" />
diff --git a/RHEL6/input/profiles/stig-rhel6-server.xml b/RHEL6/input/profiles/stig-rhel6-server.xml
index 62aafe6..6c7783a 100644
--- a/RHEL6/input/profiles/stig-rhel6-server.xml
+++ b/RHEL6/input/profiles/stig-rhel6-server.xml
@@ -90,8 +90,8 @@
 <!-- from inherited Rule, limiting_password_reuse -->
 <refine-value idref="password_history_retain_number" selector="24"/>
 
-<refine-value idref="var_password_max_age" selector="60"/>
-<refine-value idref="var_password_min_age" selector="1"/>
+<refine-value idref="var_accounts_maximum_age_login_defs" selector="60"/>
+<refine-value idref="var_accounts_minimum_age_login_defs" selector="1"/>
 <!-- from inherited Rule, deny_password_attempts -->
 <refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="3"/>
 
diff --git a/RHEL6/input/profiles/test.xml b/RHEL6/input/profiles/test.xml
index 36f6ed2..e44fdac 100644
--- a/RHEL6/input/profiles/test.xml
+++ b/RHEL6/input/profiles/test.xml
@@ -3,9 +3,9 @@
 <description>This profile is for testing.</description>
 <!--
 <select idref="accounts_password_minlen_login_defs" selected="true"/>
-<select idref="password_min_age" selected="true"/>
-<select idref="password_max_age" selected="true"/>
-<select idref="password_warn_age" selected="true"/>
+<select idref="accounts_minimum_age_login_defs" selected="true"/>
+<select idref="accounts_maximum_age_login_defs" selected="true"/>
+<select idref="accounts_password_warn_age_login_defs" selected="true"/>
 <select idref="package_rsyslog_installed" selected="true"/>
 <select idref="service_rsyslog_enabled" selected="true"/>
 <select idref="disable_vsftpd" selected="true"/>
@@ -56,11 +56,11 @@
 
 <refine-value idref="var_accounts_password_minlen_login_defs" selector="12"/>
 <!-- password minimum length -->
-<refine-value idref="var_password_max_age" selector="90"/>
+<refine-value idref="var_accounts_maximum_age_login_defs" selector="90"/>
 <!-- maximum password age -->
-<refine-value idref="var_password_min_age" selector="7"/>
+<refine-value idref="var_accounts_minimum_age_login_defs" selector="7"/>
 <!-- minimum password age -->
-<refine-value idref="var_password_warn_age" selector="7"/>
+<refine-value idref="var_accounts_password_warn_age_login_defs" selector="7"/>
 <!-- password warn age -->
 
 
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 322789b..88eeca3 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -66,10 +66,10 @@
 <select idref="no_empty_passwords" selected="true" />
 <select idref="no_hashes_outside_shadow" selected="true" />
 <select idref="no_uidzero_except_root" selected="true" />
-<refine-value idref="var_password_warn_age" selector="14"/>
-<select idref="password_warn_age" selected="true" />
-<refine-value idref="var_password_max_age" selector="60" />
-<select idref="password_max_age" selected="true" />
+<refine-value idref="var_accounts_password_warn_age_login_defs" selector="14"/>
+<select idref="accounts_password_warn_age_login_defs" selected="true" />
+<refine-value idref="var_accounts_maximum_age_login_defs" selector="60" />
+<select idref="accounts_maximum_age_login_defs" selected="true" />
 <refine-value idref="var_accounts_password_minlen_login_defs" selector="12" />
 <select idref="accounts_password_minlen_login_defs" selected="true" />
 <refine-value idref="password_retry" selector="3" />
diff --git a/RHEL6/input/system/accounts/restrictions/password_expiration.xml b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
index a09b1d2..ce8a082 100644
--- a/RHEL6/input/system/accounts/restrictions/password_expiration.xml
+++ b/RHEL6/input/system/accounts/restrictions/password_expiration.xml
@@ -42,7 +42,7 @@ age, and 7 day warning period with the following command:
 <value selector="14">14</value>
 </Value>
 
-<Value id="var_password_max_age" type="number" >
+<Value id="var_accounts_maximum_age_login_defs" type="number" >
 <title>maximum password age</title>
 <description>Maximum age of password in days</description>
 <warning category="general">This will only apply to newly created accounts</warning>
@@ -53,7 +53,7 @@ age, and 7 day warning period with the following command:
 <value selector="180">180</value>
 </Value>
 
-<Value id="var_password_min_age" type="number" >
+<Value id="var_accounts_minimum_age_login_defs" type="number" >
 <title>minimum password age</title>
 <description>Minimum age of password in days</description>
 <warning category="general">This will only apply to newly created accounts</warning>
@@ -66,7 +66,7 @@ age, and 7 day warning period with the following command:
 </Value>
 
 
-<Value id="var_password_warn_age" type="number" >
+<Value id="var_accounts_password_warn_age_login_defs" type="number" >
 <title>warning days before password expires</title>
 <description>The number of days' warning given before a password expires.</description>
 <warning category="general">This will only apply to newly created accounts</warning>
@@ -109,7 +109,7 @@ behavior that may result.
 </Rule>
 
 
-<Rule id="password_min_age" severity="medium">
+<Rule id="accounts_minimum_age_login_defs" severity="medium">
 <title>Set Password Minimum Age</title>
 <description>To specify password minimum age for new accounts,
 edit the file <tt>/etc/login.defs</tt>
@@ -130,13 +130,13 @@ users cycling back to a favorite password
 after satisfying the password reuse requirement.
 </rationale>
 <ident cce="27013-2" />
-<oval id="accounts_minimum_age_login_defs" value="var_password_min_age"/>
+<oval id="accounts_minimum_age_login_defs" value="var_accounts_minimum_age_login_defs"/>
 <ref nist="IA-5(f),IA-5(1)(d)" disa="198"/>
 <tested by="DS" on="20121026"/>
 </Rule>
 
 
-<Rule id="password_max_age" severity="medium">
+<Rule id="accounts_maximum_age_login_defs" severity="medium">
 <title>Set Password Maximum Age</title>
 <description>To specify password maximum age for new accounts,
 edit the file <tt>/etc/login.defs</tt>
@@ -158,12 +158,12 @@ the utility of a stolen password. Requiring shorter password lifetimes
 increases the risk of users writing down the password in a convenient
 location subject to physical compromise.</rationale>
 <ident cce="26985-2" />
-<oval id="accounts_maximum_age_login_defs" value="var_password_max_age"/>
+<oval id="accounts_maximum_age_login_defs" value="var_accounts_maximum_age_login_defs"/>
 <ref nist="IA-5(f),IA-5(g),IA-5(1)(d)" disa="180,199" />
 <tested by="DS" on="20121026"/>
 </Rule>
 
-<Rule id="password_warn_age">
+<Rule id="accounts_password_warn_age_login_defs">
 <title>Set Password Warning Age</title>
 <description>To specify how many days prior to password
 expiration that a warning will be issued to users,
@@ -171,7 +171,7 @@ edit the file <tt>/etc/login.defs</tt> and add or correct
  the following line, replacing <i>DAYS</i> appropriately:
 <pre>PASS_WARN_AGE <i>DAYS</i></pre>
 The DoD requirement is 7.
-<!-- <sub idref="password_warn_age_login_defs_value" /> -->
+<!-- <sub idref="accounts_password_warn_age_login_defs_login_defs_value" /> -->
 </description>
 <ocil clause="it is not set to the required value">
 To check the password warning age, run the command:
@@ -183,7 +183,7 @@ Setting the password warning age enables users to
 make the change at a practical time.
 </rationale>
 <ident cce="26988-6" />
-<oval id="accounts_password_warn_age_login_defs" value="var_password_warn_age" />
+<oval id="accounts_password_warn_age_login_defs" value="var_accounts_password_warn_age_login_defs" />
 <ref nist="IA-5(f)" />
 <tested by="DS" on="20121026"/>
 </Rule>
-- 
1.7.1



More information about the scap-security-guide mailing list