[PATCH] [RHEL/6] accounts_password_pam_cracklib_minclass XCCDF rule: * rename the remediation script to proper name * start using value of particular variable instead of hardcoded value of '3'

Jan Lieskovsky jlieskov at redhat.com
Mon Jul 7 09:54:42 UTC 2014


----- Original Message -----
> From: "Shawn Wells" <shawn at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Thursday, July 3, 2014 6:29:55 PM
> Subject: Re: [PATCH] [RHEL/6] accounts_password_pam_cracklib_minclass XCCDF	rule: * rename the remediation script to
> proper name * start using	value of particular variable instead of hardcoded value of '3'
> 
> 
> On 7/3/14, 11:15 AM, Jan Lieskovsky wrote:
> 
> 
> 
> Rename original remediation script (password_require_minimum_class.sh)
> from:
> https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=a38ece26a85f210b7edc6db2d91c438ef78f5add
> to it's proper name (so remediation would actually perform the fix).
> 
> Besides that replace the hardcoded value of '3' with evaluated value of
> $var_password_pam_cracklib_minclass variable (which can be actually set
> up to something different according to custom preferences). Also make
> the remediation fix implementation to complain / align more with actual
> requirements for the remediation fixes (include templates/support.sh etc.)
> 
> Testing report:
> ---------------
> Change has been tested on RHEL-6 for both cases:
> * minclass already present in /etc/pam.d/system-auth, but having different
>   value than expected / required,
> * minclass not present in /etc/pam.d/system-auth file
> 
> and works properly.
> 
> Please review.
> 
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
> 
> 0001-RHEL-6-accounts_password_pam_cracklib_minclass-XCCDF.patch
> From 2728223b695f7901c8b58b5696100273ccfa5993 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky <jlieskov at redhat.com> Date: Thu, 3 Jul 2014 16:51:42
> +0200
> Subject: [PATCH] [RHEL/6] accounts_password_pam_cracklib_minclass XCCDF rule:
>  * rename remediation fix to proper name, * update its implementation not to
>  use the hardcoded value of '3',   but rather actual evaluated value of
>  var_password_pam_cracklib_minclass   variable.
> 
> Signed-off-by: Jan Lieskovsky <jlieskov at redhat.com> ---
>  .../input/fixes/bash/accounts_password_pam_cracklib_minclass.sh  | 9
>  +++++++++
>  RHEL/6/input/fixes/bash/password_require_minimum_class.sh        | 6 ------
>  2 files changed, 9 insertions(+), 6 deletions(-)
>  create mode 100644
>  RHEL/6/input/fixes/bash/accounts_password_pam_cracklib_minclass.sh
>  delete mode 100644 RHEL/6/input/fixes/bash/password_require_minimum_class.sh
> 
> diff --git
> a/RHEL/6/input/fixes/bash/accounts_password_pam_cracklib_minclass.sh
> b/RHEL/6/input/fixes/bash/accounts_password_pam_cracklib_minclass.sh
> new file mode 100644
> index 0000000..c710009
> --- /dev/null
> +++ b/RHEL/6/input/fixes/bash/accounts_password_pam_cracklib_minclass.sh
> @@ -0,0 +1,9 @@
> +source ./templates/support.sh
> +populate var_password_pam_cracklib_minclass
> +
> +grep -q minclass /etc/pam.d/system-auth
> +if [ $? = "0" ]; then
> +    sed -i " /
> pam_cracklib.so/s/minclass=[0-$var_password_pam_cracklib_minclass]/minclass=$var_password_pam_cracklib_minclass
> / " /etc/pam.d/system-auth
> +else
> +    sed -i "/pam_cracklib.so/s/pam_cracklib.so /pam_cracklib.so
> minclass=$var_password_pam_cracklib_minclass /" /etc/pam.d/system-auth
> +fi
> diff --git a/RHEL/6/input/fixes/bash/password_require_minimum_class.sh
> b/RHEL/6/input/fixes/bash/password_require_minimum_class.sh
> deleted file mode 100644
> index 127c004..0000000
> 
> needs a slightl change: since /etc/pam.d/system-auth is (generally) a symlink
> to system-auth-ac, `sed --follow-symlinks should be used`

Thanks, Shawn. Right, good catch (was wondering why the --folow-symlinks bit was
necessary in the previous version.. It's clear now).

> 
> once change is made, ack

Applied the patch, added --follow-symlinks option, squashed into previous commit,
retested & pushed:
  https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=41973eabf428467f12a6389244e11bda36f4acac

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> 
> 
> 
> 
> 
> --- a/RHEL/6/input/fixes/bash/password_require_minimum_class.sh
> +++ /dev/null
> @@ -1,6 +0,0 @@
> -grep -q minclass /etc/pam.d/system-auth
> -if [ $? = "0" ]; then
> -    sed --follow-symlinks -i "/pam_cracklib.so/s/minclass=[0-4]/minclass=3/"
> /etc/pam.d/system-auth
> -else
> -    sed --follow-symlinks -i "/pam_cracklib.so/s/pam_cracklib.so
> /pam_cracklib.so minclass=3 /" /etc/pam.d/system-auth
> -fi
> --
> 1.8.3.1
> 
> 
> --
> SCAP Security Guide mailing list scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
> 
> --
> Shawn Wells
> Director, Innovation Programs shawn at redhat.com | 443.534.0130
> @shawndwells
> 
> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/


More information about the scap-security-guide mailing list