Minimum Password Length ...

Shawn Wells shawn at redhat.com
Fri Mar 21 22:29:45 UTC 2014


On 3/21/14, 12:40 PM, Jan Lieskovsky wrote:
> Hello Trey,
>
>    thank you for checking with us.
>
> ----- Original Message -----
>> >From: "Trey Henefield"<trey.henefield at ultra-ats.com>
>> >To: "Steve Grubb"<sgrubb at redhat.com>,scap-security-guide at lists.fedorahosted.org
>> >Sent: Thursday, March 20, 2014 2:09:35 PM
>> >Subject: RE: Minimum Password Length ...
>> >
>> >
>> >
>> >Thanks for the response Steve. That is what I had figured.
>> >
>> >But because both the RHEL6 SSG and RHEL6 STIG require this functionality to
>> >be configured only in /etc/login.defs as opposed to /etc/pam.d/system-auth,
>> >it was questionable.
>> >
>> >While system certifications simply require checking that a system is
>> >configured in accordance with a published STIG, DSS will actually check to
>> >see that the intended requirements are actually enforced (i.e. actually
>> >attempt a non-compliant password as opposed to checking for applied
>> >settings).
>> >
>> >So if we are all in agreement, could the SSG check and fix for this please be
>> >changed to include the setting that gets enforced (minlen=14 in
>> >/etc/pam.d/system-auth)?
> You are truly right that on Red Hat Enterprise Linux 5 the rule checks both
> conditions:
>    http://ovaldb.altx-soft.ru/Definition.aspx?id=oval:gov.nist.usgcb.rhel:def:20071
>
> while in SSG content for Red Hat Enterprise Linux 6 just /etc/login.defs condition:
>    https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/shared/oval/accounts_password_minlen_login_defs.xml
>
> But (slight) uncertainty comes from the following:
> * in RHEL-5 the rule is titled "CCE-4541-1: Set password minimum length" (thus somehow implying this
>    should be system-wide check). While
> * on RHEL-6 it is titled "2.4.1.3.a. Set Password Minimum Length in login.defs (CCE-27002-5)"
>    (thus somehow implying it should be checking just login.defs file due the login.defs being
>     emphasized in the title).
>
> This makes me believe the original intention when creating RHEL-6 content was to have just
> login.defs specific rule, and then add a pam_cracklib specific rule into / under:
>    "Set Password Quality Requirements" subsection of "Protect Accounts by Configuring PAM" section
> (maybe to have login.defs and PAM rules separated into sections?) But looks the second part
> (adding "minlen" check for PAM case) wasn't realized later.
>
> The summary being -- you are correct, the PAM minlen check should be added to the current
> form of RHEL-6 SSG content. The question is where we want to have this check being added --
> if into minimum password length login.defs rule (like it's done on RHEL-5) or under the
> PAM section (where it might seem to be more logical to belong to).
>
> I can come with a patch proposal, just first need someone on the list to clarify the expected
> rule location. Shawn, can you possibly hint on this?


The intent is to ensure minimum password length (akin to the RHEL5 USGCB 
title). I don't recall why it was defined specifically against 
login.defs (other than to imagine we inherited this in RHEL5 STIG, and 
did not get close enough review during the DoD Consensus meetings).

PAM minlen should be added.


More information about the scap-security-guide mailing list