<div dir="ltr">Okay, this is helpful, but two things: <div>- by convention the Defintion ID should be the same as the filename</div><div style>- the fix script isn't parameterized</div><div style><br></div><div style>There is support for parameters in fix scripts, per a recent patch:</div>
<div style><a href="https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-June/003429.html">https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-June/003429.html</a><br></div><div style><br></div>
<div style><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jun 28, 2013 at 9:15 AM, Brian Millett <span dir="ltr"><<a href="mailto:bmillett@gmail.com" target="_blank">bmillett@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Signed-off-by: Brian Millett <<a href="mailto:bmillett@gmail.com">bmillett@gmail.com</a>><br>
---<br>
.../accounts_password_minclass_login_defs.xml | 43 ++++++++++++++++++++++<br>
.../fixes/bash/password_require_minimun_class.sh | 6 +++<br>
2 files changed, 49 insertions(+)<br>
create mode 100644 RHEL6/input/checks/accounts_password_minclass_login_defs.xml<br>
create mode 100644 RHEL6/input/fixes/bash/password_require_minimun_class.sh<br>
<br>
diff --git a/RHEL6/input/checks/accounts_password_minclass_login_defs.xml b/RHEL6/input/checks/accounts_password_minclass_login_defs.xml<br>
new file mode 100644<br>
index 0000000..539164b<br>
--- /dev/null<br>
+++ b/RHEL6/input/checks/accounts_password_minclass_login_defs.xml<br>
@@ -0,0 +1,43 @@<br>
+<def-group><br>
+ <definition class="compliance" id="accounts_password_pam_cracklib_minclass" version="1"><br>
+ <metadata><br>
+ <title>Set Password minclass Requirements</title><br>
+ <affected family="unix"><br>
+ <platform>Red Hat Enterprise Linux 6</platform><br>
+ </affected><br>
+ <description>The password minclass should meet minimum<br>
+ requirements using pam_cracklib</description><br>
+ </metadata><br>
+ <criteria><br>
+ <criterion comment="Conditions for minclass are satisfied"<br>
+ test_ref="test_password_pam_cracklib_minclass" /><br>
+ </criteria><br>
+ </definition><br>
+<br>
+ <ind:textfilecontent54_test check="all"<br>
+ comment="check the configuration of /etc/pam.d/system-auth"<br>
+ id="test_password_pam_cracklib_minclass" version="1"><br>
+ <ind:object object_ref="obj_password_pam_cracklib_minclass" /><br>
+ <ind:state state_ref="state_password_pam_cracklib_minclass" /><br>
+ </ind:textfilecontent54_test><br>
+<br>
+ <ind:textfilecontent54_state id="state_password_pam_cracklib_minclass"<br>
+ version="1"><br>
+ <ind:instance datatype="int">1</ind:instance><br>
+ <ind:subexpression datatype="int"<br>
+ operation="less than or equal"<br>
+ var_ref="var_password_pam_cracklib_minclass" /><br>
+ </ind:textfilecontent54_state><br>
+<br>
+ <external_variable comment="External variable for pam_cracklib minclass"<br>
+ datatype="int" id="var_password_pam_cracklib_minclass"<br>
+ version="1" /><br>
+<br>
+ <ind:textfilecontent54_object id="obj_password_pam_cracklib_minclass"<br>
+ version="1"><br>
+ <ind:path>/etc/pam.d</ind:path><br>
+ <ind:filename>system-auth</ind:filename><br>
+ <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minclass=(-?\d+)(?:[\s]|$)</ind:pattern><br>
+ <ind:instance datatype="int" operation="less than or equal">1</ind:instance><br>
+ </ind:textfilecontent54_object><br>
+</def-group><br>
diff --git a/RHEL6/input/fixes/bash/password_require_minimun_class.sh b/RHEL6/input/fixes/bash/password_require_minimun_class.sh<br>
new file mode 100644<br>
index 0000000..127c004<br>
--- /dev/null<br>
+++ b/RHEL6/input/fixes/bash/password_require_minimun_class.sh<br>
@@ -0,0 +1,6 @@<br>
+grep -q minclass /etc/pam.d/system-auth<br>
+if [ $? = "0" ]; then<br>
+ sed --follow-symlinks -i "/<a href="http://pam_cracklib.so/s/minclass=[0-4]/minclass=3/" target="_blank">pam_cracklib.so/s/minclass=[0-4]/minclass=3/</a>" /etc/pam.d/system-auth<br>
+else<br>
+ sed --follow-symlinks -i "/<a href="http://pam_cracklib.so/s/pam_cracklib.so" target="_blank">pam_cracklib.so/s/pam_cracklib.so</a> /pam_cracklib.so minclass=3 /" /etc/pam.d/system-auth<br>
+fi<br>
<span class="HOEnZb"><font color="#888888">--<br>
1.8.2.1<br>
<br>
_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</font></span></blockquote></div><br></div>