<div dir="ltr">Okay, this is helpful, but two things: <div>- by convention the Defintion ID should be the same as the filename</div><div style>- the fix script isn&#39;t parameterized</div><div style><br></div><div style>There is support for parameters in fix scripts, per a recent patch:</div>
<div style><a href="https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-June/003429.html">https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-June/003429.html</a><br></div><div style><br></div>
<div style><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jun 28, 2013 at 9:15 AM, Brian Millett <span dir="ltr">&lt;<a href="mailto:bmillett@gmail.com" target="_blank">bmillett@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Signed-off-by: Brian Millett &lt;<a href="mailto:bmillett@gmail.com">bmillett@gmail.com</a>&gt;<br>
---<br>
 .../accounts_password_minclass_login_defs.xml      | 43 ++++++++++++++++++++++<br>
 .../fixes/bash/password_require_minimun_class.sh   |  6 +++<br>
 2 files changed, 49 insertions(+)<br>
 create mode 100644 RHEL6/input/checks/accounts_password_minclass_login_defs.xml<br>
 create mode 100644 RHEL6/input/fixes/bash/password_require_minimun_class.sh<br>
<br>
diff --git a/RHEL6/input/checks/accounts_password_minclass_login_defs.xml b/RHEL6/input/checks/accounts_password_minclass_login_defs.xml<br>
new file mode 100644<br>
index 0000000..539164b<br>
--- /dev/null<br>
+++ b/RHEL6/input/checks/accounts_password_minclass_login_defs.xml<br>
@@ -0,0 +1,43 @@<br>
+&lt;def-group&gt;<br>
+  &lt;definition class=&quot;compliance&quot; id=&quot;accounts_password_pam_cracklib_minclass&quot; version=&quot;1&quot;&gt;<br>
+    &lt;metadata&gt;<br>
+      &lt;title&gt;Set Password minclass Requirements&lt;/title&gt;<br>
+      &lt;affected family=&quot;unix&quot;&gt;<br>
+        &lt;platform&gt;Red Hat Enterprise Linux 6&lt;/platform&gt;<br>
+      &lt;/affected&gt;<br>
+      &lt;description&gt;The password minclass should meet minimum<br>
+      requirements using pam_cracklib&lt;/description&gt;<br>
+    &lt;/metadata&gt;<br>
+    &lt;criteria&gt;<br>
+      &lt;criterion comment=&quot;Conditions for minclass are satisfied&quot;<br>
+                 test_ref=&quot;test_password_pam_cracklib_minclass&quot; /&gt;<br>
+    &lt;/criteria&gt;<br>
+  &lt;/definition&gt;<br>
+<br>
+  &lt;ind:textfilecontent54_test check=&quot;all&quot;<br>
+                              comment=&quot;check the configuration of /etc/pam.d/system-auth&quot;<br>
+                              id=&quot;test_password_pam_cracklib_minclass&quot; version=&quot;1&quot;&gt;<br>
+    &lt;ind:object object_ref=&quot;obj_password_pam_cracklib_minclass&quot; /&gt;<br>
+    &lt;ind:state state_ref=&quot;state_password_pam_cracklib_minclass&quot; /&gt;<br>
+  &lt;/ind:textfilecontent54_test&gt;<br>
+<br>
+  &lt;ind:textfilecontent54_state id=&quot;state_password_pam_cracklib_minclass&quot;<br>
+                               version=&quot;1&quot;&gt;<br>
+    &lt;ind:instance datatype=&quot;int&quot;&gt;1&lt;/ind:instance&gt;<br>
+    &lt;ind:subexpression datatype=&quot;int&quot;<br>
+                       operation=&quot;less than or equal&quot;<br>
+                       var_ref=&quot;var_password_pam_cracklib_minclass&quot; /&gt;<br>
+  &lt;/ind:textfilecontent54_state&gt;<br>
+<br>
+  &lt;external_variable comment=&quot;External variable for pam_cracklib minclass&quot;<br>
+                     datatype=&quot;int&quot; id=&quot;var_password_pam_cracklib_minclass&quot;<br>
+                     version=&quot;1&quot; /&gt;<br>
+<br>
+  &lt;ind:textfilecontent54_object id=&quot;obj_password_pam_cracklib_minclass&quot;<br>
+                                version=&quot;1&quot;&gt;<br>
+    &lt;ind:path&gt;/etc/pam.d&lt;/ind:path&gt;<br>
+    &lt;ind:filename&gt;system-auth&lt;/ind:filename&gt;<br>
+    &lt;ind:pattern operation=&quot;pattern match&quot;&gt;^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minclass=(-?\d+)(?:[\s]|$)&lt;/ind:pattern&gt;<br>
+    &lt;ind:instance datatype=&quot;int&quot; operation=&quot;less than or equal&quot;&gt;1&lt;/ind:instance&gt;<br>
+  &lt;/ind:textfilecontent54_object&gt;<br>
+&lt;/def-group&gt;<br>
diff --git a/RHEL6/input/fixes/bash/password_require_minimun_class.sh b/RHEL6/input/fixes/bash/password_require_minimun_class.sh<br>
new file mode 100644<br>
index 0000000..127c004<br>
--- /dev/null<br>
+++ b/RHEL6/input/fixes/bash/password_require_minimun_class.sh<br>
@@ -0,0 +1,6 @@<br>
+grep -q minclass /etc/pam.d/system-auth<br>
+if [ $? = &quot;0&quot; ]; then<br>
+    sed --follow-symlinks -i &quot;/<a href="http://pam_cracklib.so/s/minclass=[0-4]/minclass=3/" target="_blank">pam_cracklib.so/s/minclass=[0-4]/minclass=3/</a>&quot; /etc/pam.d/system-auth<br>
+else<br>
+    sed --follow-symlinks -i &quot;/<a href="http://pam_cracklib.so/s/pam_cracklib.so" target="_blank">pam_cracklib.so/s/pam_cracklib.so</a> /pam_cracklib.so minclass=3 /&quot; /etc/pam.d/system-auth<br>
+fi<br>
<span class="HOEnZb"><font color="#888888">--<br>
1.8.2.1<br>
<br>
_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</font></span></blockquote></div><br></div>