[PATCH 6/8] OVAL signoff accounts_password_pam_cracklib_retry
Shawn Wells
shawn.d.wells at gmail.com
Sun Sep 29 00:16:34 UTC 2013
-------------- next part --------------
>From 122b80eb706eab502c80b2d675618c845d4e2348 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn at redhat.com>
Date: Sat, 28 Sep 2013 16:41:37 -0400
Subject: [PATCH 6/8] OVAL signoff: accounts_password_pam_cracklib_retry
- filepath update
- XCCDF naming update
- Fixed variable name in USGCB profile
Testing:
[shawn at SSG-RHEL6 checks]$ grep retry /etc/pam.d/system-auth
password requisite pam_cracklib.so try_first_pass retry=2 type=
[shawn at SSG-RHEL6 checks]$ ./testcheck.py accounts_password_pam_cracklib_retry.xml
external_variable with id : var_password_pam_cracklib_retry
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_retrycWn8LP.xml
Writing results to : /tmp/accounts_password_pam_cracklib_retrycWn8LP.xml-results
Definition oval:scap-security-guide.testing:def:275: true
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo sed -i 's/retry=2/retry=3/g' /etc/pam.d/system-auth ; \
> ./testcheck.py accounts_password_pam_cracklib_retry.xml
external_variable with id : var_password_pam_cracklib_retry
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_retry27xCkF.xml
Writing results to : /tmp/accounts_password_pam_cracklib_retry27xCkF.xml-results
Definition oval:scap-security-guide.testing:def:275: true
Evaluation done.
[shawn at SSG-RHEL6 checks]$ sudo sed -i 's/retry=3/retry=5/g' /etc/pam.d/system-auth ; ./testcheck.py accounts_password_pam_cracklib_retry.xml
external_variable with id : var_password_pam_cracklib_retry
Evaluating with OVAL tempfile : /tmp/accounts_password_pam_cracklib_retryq5rSPT.xml
Writing results to : /tmp/accounts_password_pam_cracklib_retryq5rSPT.xml-results
Definition oval:scap-security-guide.testing:def:275: false
Evaluation done.
---
.../accounts_password_pam_cracklib_retry.xml | 4 ++--
RHEL6/input/profiles/CS2.xml | 2 +-
RHEL6/input/profiles/common.xml | 2 +-
RHEL6/input/profiles/fisma-medium-rhel6-server.xml | 2 +-
RHEL6/input/profiles/usgcb-rhel6-server.xml | 4 ++--
RHEL6/input/system/accounts/pam.xml | 2 +-
6 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml b/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml
index 5f51a27..175b55c 100644
--- a/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml
+++ b/RHEL6/input/checks/accounts_password_pam_cracklib_retry.xml
@@ -7,6 +7,7 @@
</affected>
<description>The password retry should meet minimum
requirements using pam_cracklib</description>
+ <reference source="swells" ref_id="20130928" ref_url="test_attestation"/>
</metadata>
<criteria>
<criterion comment="Conditions for retry are satisfied"
@@ -20,8 +21,7 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_password_pam_cracklib_retry" version="1">
- <ind:path>/etc/pam.d</ind:path>
- <ind:filename>system-auth</ind:filename>
+ <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
<ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*retry=([0-9]*).*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
diff --git a/RHEL6/input/profiles/CS2.xml b/RHEL6/input/profiles/CS2.xml
index dfcdf53..0099b0a 100644
--- a/RHEL6/input/profiles/CS2.xml
+++ b/RHEL6/input/profiles/CS2.xml
@@ -18,7 +18,7 @@
<select idref="accounts_password_warn_age_login_defs" selected="true"/>
<select idref="account_disable_post_pw_expiration" selected="true" />
<select idref="deny_password_attempts" selected="true" />
-<select idref="password_retry" selected="true"/>
+<select idref="accounts_password_pam_cracklib_retry" selected="true"/>
<select idref="max_concurrent_login_sessions" selected="true"/>
<refine-value idref="max_concurrent_login_sessions_value" selector="3"/>
diff --git a/RHEL6/input/profiles/common.xml b/RHEL6/input/profiles/common.xml
index e6e345f..19cd181 100644
--- a/RHEL6/input/profiles/common.xml
+++ b/RHEL6/input/profiles/common.xml
@@ -51,7 +51,7 @@
<select idref="accounts_minimum_age_login_defs" selected="true"/>
<select idref="accounts_maximum_age_login_defs" selected="true"/>
<select idref="accounts_password_warn_age_login_defs" selected="true"/>
-<select idref="password_retry" selected="true"/>
+<select idref="accounts_password_pam_cracklib_retry" selected="true"/>
<select idref="password_require_digits" selected="true"/>
<select idref="password_require_uppercases" selected="true"/>
<select idref="password_require_specials" selected="true"/>
diff --git a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
index 80a69e0..6e6d7bd 100644
--- a/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL6/input/profiles/fisma-medium-rhel6-server.xml
@@ -276,7 +276,7 @@
<select idref="bootloader_password" selected="true" />
<!-- IA-5 -->
-<select idref="password_retry" selected="true" />
+<select idref="accounts_password_pam_cracklib_retry" selected="true" />
<select idref="password_require_consecrepeat" selected="true" />
<select idref="password_require_uppercases" selected="true" />
<select idref="password_require_specials" selected="true" />
diff --git a/RHEL6/input/profiles/usgcb-rhel6-server.xml b/RHEL6/input/profiles/usgcb-rhel6-server.xml
index 88eeca3..d96e4f2 100644
--- a/RHEL6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL6/input/profiles/usgcb-rhel6-server.xml
@@ -72,8 +72,8 @@
<select idref="accounts_maximum_age_login_defs" selected="true" />
<refine-value idref="var_accounts_password_minlen_login_defs" selector="12" />
<select idref="accounts_password_minlen_login_defs" selected="true" />
-<refine-value idref="password_retry" selector="3" />
-<select idref="password_retry" selected="true" />
+<refine-value idref="var_password_pam_cracklib_retry" selector="3" />
+<select idref="accounts_password_pam_cracklib_retry" selected="true" />
<refine-value idref="var_password_pam_cracklib_dcredit" selector="1" />
<select idref="password_require_digits" selected="true" />
<refine-value idref="var_password_pam_cracklib_ucredit" selector="1" />
diff --git a/RHEL6/input/system/accounts/pam.xml b/RHEL6/input/system/accounts/pam.xml
index f754743..4bfb0c2 100644
--- a/RHEL6/input/system/accounts/pam.xml
+++ b/RHEL6/input/system/accounts/pam.xml
@@ -220,7 +220,7 @@ operator="equals" interactive="0">
<value selector="100000000">100000000</value> <!-- 3.16 years -->
</Value>
-<Rule id="password_retry">
+<Rule id="accounts_password_pam_cracklib_retry">
<title>Set Password Retry Prompts Permitted Per-Session</title>
<description>To configure the number of retry prompts that are permitted per-session:
<br /><br />
--
1.7.1
More information about the scap-security-guide
mailing list