<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 9/5/13 2:26 PM, Paul Tittle
(Contractor) wrote:<br>
</div>
<blockquote cite="mid:5228CCD2.9050307@cmf.nrl.navy.mil" type="cite">
Using deny_password_attempts as an example, it says:<br>
<br>
<meta charset="utf-8">
<p style="text-align: justify; color: rgb(0, 0, 0); font-family:
sans-serif; font-size: medium; font-style: normal; font-variant:
normal; font-weight: normal; letter-spacing: normal;
line-height: normal; orphans: auto; text-indent: 0px;
text-transform: none; white-space: normal; widows: auto;
word-spacing: 0px; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255);">Add the following lines
immediately below the<span class="Apple-converted-space"> </span><code>pam_unix.so</code><span
class="Apple-converted-space"> </span>statement in<span
class="Apple-converted-space"> </span><code>AUTH</code><span
class="Apple-converted-space"> </span>section of<span
class="Apple-converted-space"> </span><code>/etc/pam.d/system-auth</code>:</p>
<pre class="code" style="background-color: rgb(204, 204, 204); padding: 0.2em; overflow: auto; color: rgb(0, 0, 0); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-position: initial initial; background-repeat: initial initial;"><code>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</code></pre>
<pre class="code" style="background-color: rgb(204, 204, 204); padding: 0.2em; overflow: auto; color: rgb(0, 0, 0); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-position: initial initial; background-repeat: initial initial;"><code>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</code></pre>
<br>
-----------<br>
<br>
Looking at input/checks/accounts_passwords_pam_faillock_deny.xml ,
accounts_passwords_pam_faillock_deny seems to test for the bottom
line in /etc/pam.d/system-auth and the top line in
/etc/pam.d/password-auth, but password-auth is not mentioned in
the deny_password_attempts description.<br>
<br>
For the other two deny_password_attempts tests, it's a similar
situation. Is the test wrong or the description wrong? <br>
</blockquote>
<br>
Thanks for reporting this -- and even more so for providing the
actual XCCDF and OVAL names!<br>
<br>
These lines should likely be in both system-auth and password-auth.
For example, on a stock RHEL6 image, SSH will use password-auth (not
system-auth) as defined in /etc/pam.d/sshd:<br>
<blockquote type="cite">#%PAM-1.0<br>
auth required pam_sepermit.so<br>
auth include password-auth<br>
account required pam_nologin.so<br>
account include password-auth<br>
password include password-auth<br>
# pam_selinux.so close should be the first session rule<br>
session required pam_selinux.so close<br>
session required pam_loginuid.so<br>
# pam_selinux.so open should only be followed by sessions to be
executed in the user context<br>
session required pam_selinux.so open env_params<br>
session optional pam_keyinit.so force revoke<br>
session include password-auth</blockquote>
<br>
Looks like we might have to update both prose and OVAL for this...<br>
</body>
</html>