[PATCH 6/8] OVAL signoff accounts_password_pam_cracklib_retry

Shawn Wells shawn.d.wells at gmail.com
Sun Sep 29 00:16:34 UTC 2013


-------------- next part --------------
>From 122b80eb706eab502c80b2d675618c845d4e2348 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 28 Sep 2013 16:41:37 -0400
Subject: [PATCH 6/8] OVAL signoff: accounts_password_pam_cracklib_retry
 - filepath update
 - XCCDF naming update
 - Fixed variable name in USGCB profile

Testing:
[shawn at SSG-RHEL6 checks]$ grep retry /etc/pam.d/system-auth
password    requisite     pam_cracklib.so try_first_pass retry=2 type=
[shawn at SSG-RHEL6 checks]$ ./testcheck.py accounts_password_pam_cracklib_retry.xml
external_variable with id : var_password_pam_cracklib_retry
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_retrycWn8LP.xml
Writing results to : /tmp/accounts_password_pam_cracklib_retrycWn8LP.xml-results
Definition oval:scap-security-guide.testing:def:275: true
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo sed -i 's/retry=2/retry=3/g' /etc/pam.d/system-auth ; \
> ./testcheck.py accounts_password_pam_cracklib_retry.xml
external_variable with id : var_password_pam_cracklib_retry
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_retry27xCkF.xml
Writing results to : /tmp/accounts_password_pam_cracklib_retry27xCkF.xml-results
Definition oval:scap-security-guide.testing:def:275: true
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo sed -i 's/retry=3/retry=5/g' /etc/pam.d/system-auth ; ./testcheck.py accounts_password_pam_cracklib_retry.xml
external_variable with id : var_password_pam_cracklib_retry
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_retryq5rSPT.xml
Writing results to : /tmp/accounts_password_pam_cracklib_retryq5rSPT.xml-results
Definition oval:scap-security-guide.testing:def:275: false
Evaluation done.
---
 .../accounts_password_pam_cracklib_retry.xml       |    4 ++--
 RHEL6/input/profiles/CS2.xml                       |    2 +-
 RHEL6/input/profiles/common.xml                    |    2 +-
 RHEL6/input/profiles/fisma-medium-rhel6-server.xml |    2 +-
 RHEL6/input/profiles/usgcb-rhel6-server.xml        |    4 ++--
 RHEL6/input/system/accounts/pam.xml                |    2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml b/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml
index 5f51a27..175b55c 100644
--- a/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml
+++ b/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml
@@ -7,6 +7,7 @@
       </affected>
       <description>The password retry should meet minimum
       requirements using pam_cracklib</description>
+      <reference source="swells" ref_id="20130928" ref_url="test_attestation"/>
     </metadata>
     <criteria>
       <criterion comment="Conditions for retry are satisfied"
@@ -20,8 +21,7 @@
   </ind:textfilecontent54_test>
 
   <ind:textfilecontent54_object id="obj_password_pam_cracklib_retry" version="1">
-    <ind:path>/etc/pam.d</ind:path>
-    <ind:filename>system-auth</ind:filename>
+    <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
     <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*retry=([0-9]*).*$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index dfcdf53..0099b0a 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -18,7 +18,7 @@
 <select idref="accounts_password_warn_age_login_defs" selected="true"/>
 <select idref="account_disable_post_pw_expiration" selected="true" />
 <select idref="deny_password_attempts" selected="true" />
-<select idref="password_retry" selected="true"/>
+<select idref="accounts_password_pam_cracklib_retry" selected="true"/>
 <select idref="max_concurrent_login_sessions" selected="true"/>
 <refine-value idref="max_concurrent_login_sessions_value" selector="3"/>
 
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index e6e345f..19cd181 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -51,7 +51,7 @@
 <select idref="accounts_minimum_age_login_defs" selected="true"/>
 <select idref="accounts_maximum_age_login_defs" selected="true"/>
 <select idref="accounts_password_warn_age_login_defs" selected="true"/>
-<select idref="password_retry" selected="true"/>
+<select idref="accounts_password_pam_cracklib_retry" selected="true"/>
 <select idref="password_require_digits" selected="true"/>
 <select idref="password_require_uppercases" selected="true"/>
 <select idref="password_require_specials" selected="true"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index 80a69e0..6e6d7bd 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -276,7 +276,7 @@
 <select idref="bootloader_password" selected="true" />
 
 <!--	IA-5 -->
-<select idref="password_retry" selected="true" />
+<select idref="accounts_password_pam_cracklib_retry" selected="true" />
 <select idref="password_require_consecrepeat" selected="true" />
 <select idref="password_require_uppercases" selected="true" />
 <select idref="password_require_specials" selected="true" />
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 88eeca3..d96e4f2 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -72,8 +72,8 @@
 <select idref="accounts_maximum_age_login_defs" selected="true" />
 <refine-value idref="var_accounts_password_minlen_login_defs" selector="12" />
 <select idref="accounts_password_minlen_login_defs" selected="true" />
-<refine-value idref="password_retry" selector="3" />
-<select idref="password_retry" selected="true" />
+<refine-value idref="var_password_pam_cracklib_retry" selector="3" />
+<select idref="accounts_password_pam_cracklib_retry" selected="true" />
 <refine-value idref="var_password_pam_cracklib_dcredit" selector="1" />
 <select idref="password_require_digits" selected="true" />
 <refine-value idref="var_password_pam_cracklib_ucredit" selector="1" />
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index f754743..4bfb0c2 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -220,7 +220,7 @@ operator="equals" interactive="0">
 <value selector="100000000">100000000</value> <!-- 3.16 years -->
 </Value>
 
-<Rule id="password_retry">
+<Rule id="accounts_password_pam_cracklib_retry">
 <title>Set Password Retry Prompts Permitted Per-Session</title>
 <description>To configure the number of retry prompts that are permitted per-session:
 <br /><br />
-- 
1.7.1



More information about the scap-security-guide mailing list