[PATCH] Shared check was missing RHEL 7 platform line
Jan Lieskovsky
jlieskov at redhat.com
Tue Apr 1 16:40:55 UTC 2014
Hello Maura,
----- Original Message -----
> From: "Maura Dailey" <maura at eclipse.ncsc.mil>
> Subject: [PATCH] Shared check was missing RHEL 7 platform line
>
> Other pam_cracklib shared checks had the required platform field, but the
> check for difok appears to have been inadvertently skipped.
I would say instead of storing RHEL-7 as platform into shared pam_cracklib
oval checks, we should create a RHEL-7 specific / own pam_pwquality oriented ones.
In RHEL-7 pam_cracklib has been replaced with pam_pwquality (man pw_quality)
and while the checks still work, their names:
accounts_password_pam_cracklib_difok.xml
accounts_password_pam_cracklib_lcredit.xml
etc.
might be misleading. Under my opinion we have two options how to proceed:
* either rename the rules (remove the pam_cracklib string from them) and
make them universal (IOW able to handle both of pam_cracklib & pam_pwquality cases).
Particular rule names in shared/ would become:
accounts_password_pam_difok.xml
accounts_password_pam_lcredit.xml
etc.
and in the /etc/pam.d/system-auth pattern operation pattern match section
there would be just (pam_cracklib | pam_pwquality) options listed as to be allowed
after the required / requisite password section,
* or we can keep RHEL-6 pam_cracklib rules intact (as they are now), and create
new pam_pwquality RHEL-7 specific ones.
Leaving the wider mailing list opinion / thoughts to decide (make a decision)
which way (yet some other from the two ones proposed above?) we want to pursue.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> - Maura Dailey
>
> Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
> ---
> .../oval/accounts_password_pam_cracklib_difok.xml | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/shared/oval/accounts_password_pam_cracklib_difok.xml
> b/shared/oval/accounts_password_pam_cracklib_difok.xml
> index 80fd21e..62a535a 100644
> --- a/shared/oval/accounts_password_pam_cracklib_difok.xml
> +++ b/shared/oval/accounts_password_pam_cracklib_difok.xml
> @@ -4,6 +4,7 @@
> <title>Set Password difok Requirements</title>
> <affected family="unix">
> <platform>Red Hat Enterprise Linux 6</platform>
> + <platform>Red Hat Enterprise Linux 7</platform>
> </affected>
> <description>The password difok should meet minimum
> requirements using pam_cracklib</description>
> --
> 1.7.1
>
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
>
More information about the scap-security-guide
mailing list