difok value in stig-rhel7-server-upstream profile

Trevor Vaughan tvaughan at onyxpoint.com
Mon Jul 27 13:46:26 UTC 2015


I've always thought that the week long lockouts were also silly.

15 minutes will deter pretty much anyone.

Trevor

On Mon, Jul 27, 2015 at 8:10 AM, Shaw, Ray V CTR USARMY ARL (US) <
ray.v.shaw.ctr at mail.mil> wrote:

> With the other password complexity requirements, week-long lockouts after
> 3 failed attempts, and changes every 60 days, the requirement is rather
> excessive (and asking for people to not be able to remember their password,
> and we know what that means).
>
> Fortunately, we can use PKI for most things these days...except, ahem, Red
> Hat Satellite Server.
>
> --Ray
>
> -----Original Message-----
> From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:
> scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Leam Hall
> Sent: Saturday, July 25, 2015 8:00 PM
> To: SCAP Security Guide <scap-security-guide at lists.fedorahosted.org>
> Subject: Re: difok value in stig-rhel7-server-upstream profile
>
> No kidding. I know there are smart people at DISA, but the general output
> seems to be from people who don't actually use computers or follow their
> own rules.
>
> Leam
>
> On 07/25/15 19:56, Trevor Vaughan wrote:
> > Interesting. Not looking forward to the backlash on implementing that
> one.
> >
> > Trevor
> >
> > On Fri, Jul 24, 2015 at 2:56 PM, Shawn Wells <shawn at redhat.com
> > <mailto:shawn at redhat.com>> wrote:
> >
> >     Unfortunately, DISA now requires that 15 of the characters differ
> >     between passwords.
> >
> >     Ref: https://github.com/OpenSCAP/scap-security-guide/issues/91
> >
> >     Awkwardly citing the same requirement (SRG-OS-000072), of which the
> >     full text is:
> >
> >         The operating system must require the change of at least 15 of
> >         the total number of characters when passwords are changed.
> >
> >         If the operating system allows the user to consecutively reuse
> >         extensive portions of passwords, this increases the chances of
> >         password compromise by increasing the window of opportunity for
> >         attempts at guessing and brute-force attacks.
> >
> >         The number of changed characters refers to the number of changes
> >         required with respect to the total number of positions in the
> >         current password. In other words, characters may be the same
> >         within the two passwords; however, the positions of the like
> >         characters must be different.
> >
> >
> >
> >
> >
> >
> >
> >     On 7/24/15 2:44 PM, Arnold, Paul C CTR USARMY PEO STRI (US) wrote:
> >
> >         The DoD states 50% of the minimum password length, which rounds
> >         up to 8 and coincides with OS-SRG v1r2 (SRG-OS-000072). The SSG
> >         also applies to systems outside the DoD, which may dictate some
> >         initial/default rules.
> >
> >         However, 15 seems to be too high for a default parameter.
> >
> >         Regards,
> >         --
> >         Paul C. Arnold
> >         IT Systems Engineer
> >         Cole Engineering Services, Inc.
> >
> >         ________________________________________
> >         From: scap-security-guide-bounces at lists.fedorahosted.org
> >         <mailto:scap-security-guide-bounces at lists.fedorahosted.org>
> >         [scap-security-guide-bounces at lists.fedorahosted.org
> >         <mailto:scap-security-guide-bounces at lists.fedorahosted.org>] on
> >         behalf of Shaw, Ray V CTR USARMY ARL (US)
> >         [ray.v.shaw.ctr at mail.mil <mailto:ray.v.shaw.ctr at mail.mil>]
> >         Sent: Friday, July 24, 2015 02:30 PM
> >         To: scap-security-guide
> >         ‎[scap-security-guide at lists.fedorahosted.org
> >         <mailto:scap-security-guide at lists.fedorahosted.org>]‎
> >         Subject: difok value in stig-rhel7-server-upstream profile
> >
> >         RHEL/7/input/profiles/stig-rhel7-server-upstream.xml has the
> >         following:
> >
> >         <refine-value idref="var_password_pam_difok" selector="15" />
> >
> >         Should this be changed from 15 to 4?  The help text indicates
> >         that the DoD requirement is 4, and other documentation seems to
> >         support this.
> >
> >         --
> >         Ray Shaw (Contractor, STG)
> >         Army Research Laboratory
> >         CISD, Unix Support
> >         --
> >         SCAP Security Guide mailing list
> >         scap-security-guide at lists.fedorahosted.org
> >         <mailto:scap-security-guide at lists.fedorahosted.org>
> >
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> >         https://github.com/OpenSCAP/scap-security-guide/
> >
> >
> >     --
> >     Shawn Wells
> >     Director, Innovation Programs
> >     shawn at redhat.com <mailto:shawn at redhat.com> | 443.534.0130
> >     <tel:443.534.0130>
> >     @shawndwells
> >
> >     --
> >     SCAP Security Guide mailing list
> >     scap-security-guide at lists.fedorahosted.org
> >     <mailto:scap-security-guide at lists.fedorahosted.org>
> >     https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> >     https://github.com/OpenSCAP/scap-security-guide/
> >
> >
> >
> >
> > --
> > Trevor Vaughan
> > Vice President, Onyx Point, Inc
> > (410) 541-6699
> >
> > -- This account not approved for unencrypted proprietary information
> > --
> >
> >
>
> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
> --
> SCAP Security Guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> https://github.com/OpenSCAP/scap-security-guide/
>



-- 
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699

-- This account not approved for unencrypted proprietary information --
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20150727/29a52575/attachment-0001.html>


More information about the scap-security-guide mailing list