<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/10/13 12:45 PM, Jan Lieskovsky
      wrote:<br>
    </div>
    <blockquote
      cite="mid:1159151115.4113855.1381423532271.JavaMail.root@redhat.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">This patch converts (and includes) four existing rules from RHEL6
'Set Password Expiration Parameters' section to (into) Fedora.

Testing:
* all tests of make fedora-tarball, fedora-srpm, fedora-rpm have passed,
* all tests within Fedora of 'make / make validate / make validate-xml /
  make checks / make guide / make content / make eval-common' have passed
  with the proposal.

Please review.

Thank you &amp;&amp; Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team</pre>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"><legend
          class="mimeAttachmentHeaderName">0001-Fedora-Convert-four-RHEL6-rules-from-Set-Password-Ex.patch</legend></fieldset>
      <br>
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-western">
        <pre wrap="">From 5e5dbb929fe8376f72d71f526f5e02e4ed4a841d Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
Date: Thu, 10 Oct 2013 18:39:11 +0200
Subject: [PATCH] [Fedora] Convert four RHEL6 rules from 'Set Password
 Expiration Parameters' section to Fedora


Signed-off-by: Jan Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
---
 .../checks/accounts_maximum_age_login_defs.xml     |  32 ++++
 .../checks/accounts_minimum_age_login_defs.xml     |  34 ++++
 .../checks/accounts_password_minlen_login_defs.xml |  33 ++++
 .../accounts_password_warn_age_login_defs.xml      |  35 ++++
 Fedora/input/guide.xml                             |   2 +-
 Fedora/input/guide.xslt                            |   1 +
 Fedora/input/profiles/common.xml                   |   4 +
 .../accounts/restrictions/password_expiration.xml  | 177 +++++++++++++++++++++
 Fedora/scap-security-guide.spec                    |   5 +-
 9 files changed, 321 insertions(+), 2 deletions(-)
 create mode 100644 Fedora/input/checks/accounts_maximum_age_login_defs.xml
 create mode 100644 Fedora/input/checks/accounts_minimum_age_login_defs.xml
 create mode 100644 Fedora/input/checks/accounts_password_minlen_login_defs.xml
 create mode 100644 Fedora/input/checks/accounts_password_warn_age_login_defs.xml
 create mode 100644 Fedora/input/system/accounts/restrictions/password_expiration.xml

diff --git a/Fedora/input/checks/accounts_maximum_age_login_defs.xml b/Fedora/input/checks/accounts_maximum_age_login_defs.xml
new file mode 100644
index 0000000..5e96118
--- /dev/null
+++ b/Fedora/input/checks/accounts_maximum_age_login_defs.xml
@@ -0,0 +1,32 @@
+&lt;def-group&gt;
+  &lt;definition class="compliance" id="accounts_maximum_age_login_defs" version="1"&gt;
+    &lt;metadata&gt;
+      &lt;title&gt;Set Password Expiration Parameters&lt;/title&gt;
+      &lt;affected family="unix"&gt;
+        &lt;platform&gt;Fedora 19&lt;/platform&gt;
+      &lt;/affected&gt;
+      &lt;description&gt;The maximum password age policy should meet minimum requirements.&lt;/description&gt;
+    &lt;/metadata&gt;
+    &lt;criteria comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs"&gt;
+      &lt;criterion test_ref="test_pass_max_days" /&gt;
+    &lt;/criteria&gt;
+  &lt;/definition&gt;
+
+  &lt;ind:textfilecontent54_test check="all" comment="the value PASS_MAX_DAYS should be set appropriately in /etc/login.defs" id="test_pass_max_days" version="1"&gt;
+    &lt;ind:object object_ref="object_etc_login_defs_pass_max" /&gt;
+    &lt;ind:state state_ref="state_accounts_maximum_age_login_defs" /&gt;
+  &lt;/ind:textfilecontent54_test&gt;
+
+  &lt;ind:textfilecontent54_object id="object_etc_login_defs_pass_max" version="1"&gt;
+    &lt;ind:filepath&gt;/etc/login.defs&lt;/ind:filepath&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^[\s]<b class="moz-txt-star"><span class="moz-txt-tag">*</span>PASS_MAX_DAYS[\s]+(\d+)\s<span class="moz-txt-tag">*</span></b>$&lt;/ind:pattern&gt;
+    &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
+  &lt;/ind:textfilecontent54_object&gt;
+
+  &lt;ind:textfilecontent54_state id="state_accounts_maximum_age_login_defs" version="1"&gt;
+    &lt;ind:subexpression operation="less than or equal" var_ref="var_accounts_maximum_age_login_defs" datatype="int" /&gt;
+  &lt;/ind:textfilecontent54_state&gt;
+
+  &lt;external_variable comment="maximum password age" datatype="int" id="var_accounts_maximum_age_login_defs" version="1" /&gt;
+
+&lt;/def-group&gt;
diff --git a/Fedora/input/checks/accounts_minimum_age_login_defs.xml b/Fedora/input/checks/accounts_minimum_age_login_defs.xml
new file mode 100644
index 0000000..87917e0
--- /dev/null
+++ b/Fedora/input/checks/accounts_minimum_age_login_defs.xml
@@ -0,0 +1,34 @@
+&lt;def-group&gt;
+  &lt;definition class="compliance" id="accounts_minimum_age_login_defs" version="1"&gt;
+    &lt;metadata&gt;
+      &lt;title&gt;Set Password Expiration Parameters&lt;/title&gt;
+      &lt;affected family="unix"&gt;
+        &lt;platform&gt;Fedora 19&lt;/platform&gt;
+      &lt;/affected&gt;
+      &lt;description&gt;The minimum password age policy should be set appropriately.&lt;/description&gt;
+    &lt;/metadata&gt;
+    &lt;criteria comment="the value PASS_MIN_DAYS should be set appropriately in /etc/login.defs"&gt;
+      &lt;criterion test_ref="test_pass_min_days" /&gt;
+    &lt;/criteria&gt;
+  &lt;/definition&gt;
+
+  &lt;ind:textfilecontent54_test check="all"
+  comment="Tests the value of PASS_MIN_DAYS in /etc/login.defs"
+  id="test_pass_min_days" version="1"&gt;
+    &lt;ind:object object_ref="object_etc_login_defs_pass_min_age" /&gt;
+    &lt;ind:state state_ref="state_etc_login_defs_pass_min_age" /&gt;
+  &lt;/ind:textfilecontent54_test&gt;
+
+  &lt;ind:textfilecontent54_object id="object_etc_login_defs_pass_min_age" version="1"&gt;
+    &lt;ind:filepath&gt;/etc/login.defs&lt;/ind:filepath&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^[\s]<b class="moz-txt-star"><span class="moz-txt-tag">*</span>PASS_MIN_DAYS[\s]+(\d+)\s<span class="moz-txt-tag">*</span></b>$&lt;/ind:pattern&gt;
+    &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
+  &lt;/ind:textfilecontent54_object&gt;
+
+  &lt;ind:textfilecontent54_state id="state_etc_login_defs_pass_min_age" version="1"&gt;
+    &lt;ind:subexpression operation="greater than or equal" var_ref="var_accounts_minimum_age_login_defs" datatype="int" /&gt;
+  &lt;/ind:textfilecontent54_state&gt;
+
+  &lt;external_variable comment="minimum password age in days" datatype="int" id="var_accounts_minimum_age_login_defs" version="1" /&gt;
+
+&lt;/def-group&gt;
diff --git a/Fedora/input/checks/accounts_password_minlen_login_defs.xml b/Fedora/input/checks/accounts_password_minlen_login_defs.xml
new file mode 100644
index 0000000..e3ce130
--- /dev/null
+++ b/Fedora/input/checks/accounts_password_minlen_login_defs.xml
@@ -0,0 +1,33 @@
+&lt;def-group&gt;
+
+  &lt;definition class="compliance" id="accounts_password_minlen_login_defs" version="1"&gt;
+    &lt;metadata&gt;
+      &lt;title&gt;Set Password Expiration Parameters&lt;/title&gt;
+      &lt;affected family="unix"&gt;
+        &lt;platform&gt;Fedora 19&lt;/platform&gt;
+      &lt;/affected&gt;
+      &lt;description&gt;The password minimum length should be set appropriately.&lt;/description&gt;
+    &lt;/metadata&gt;
+    &lt;criteria operator="AND"&gt;
+      &lt;criterion test_ref="test_etc_login_defs" /&gt;
+    &lt;/criteria&gt;
+  &lt;/definition&gt;
+
+  &lt;ind:textfilecontent54_test check="all" comment="check PASS_MIN_LEN in /etc/login.defs" id="test_etc_login_defs" version="1"&gt;
+    &lt;ind:object object_ref="object_etc_login_defs" /&gt;
+    &lt;ind:state state_ref="state_accounts_password_minlen_login_defs" /&gt;
+  &lt;/ind:textfilecontent54_test&gt;
+
+  &lt;ind:textfilecontent54_object id="object_etc_login_defs" version="1"&gt;
+    &lt;ind:filepath&gt;/etc/login.defs&lt;/ind:filepath&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^PASS_MIN_LEN\s+(\d+)\s*$&lt;/ind:pattern&gt;
+    &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
+  &lt;/ind:textfilecontent54_object&gt;
+
+  &lt;ind:textfilecontent54_state id="state_accounts_password_minlen_login_defs" version="1"&gt;
+    &lt;ind:subexpression operation="greater than or equal" var_ref="var_accounts_password_minlen_login_defs" datatype="int" /&gt;
+  &lt;/ind:textfilecontent54_state&gt;
+
+  &lt;external_variable comment="password minimum length" datatype="int" id="var_accounts_password_minlen_login_defs" version="1" /&gt;
+
+&lt;/def-group&gt;
diff --git a/Fedora/input/checks/accounts_password_warn_age_login_defs.xml b/Fedora/input/checks/accounts_password_warn_age_login_defs.xml
new file mode 100644
index 0000000..5230af1
--- /dev/null
+++ b/Fedora/input/checks/accounts_password_warn_age_login_defs.xml
@@ -0,0 +1,35 @@
+&lt;def-group&gt;
+  &lt;definition class="compliance" id="accounts_password_warn_age_login_defs" version="1"&gt;
+    &lt;metadata&gt;
+      &lt;title&gt;Set Password Expiration Parameters&lt;/title&gt;
+      &lt;affected family="unix"&gt;
+        &lt;platform&gt;Fedora 19&lt;/platform&gt;
+      &lt;/affected&gt;
+      &lt;description&gt;The password expiration warning age should be set appropriately.&lt;/description&gt;
+    &lt;/metadata&gt;
+    &lt;criteria&gt;
+      &lt;criterion test_ref="test_pass_warn_age" /&gt;
+    &lt;/criteria&gt;
+  &lt;/definition&gt;
+
+  &lt;ind:textfilecontent54_test check="all"
+  comment="Tests the value of PASS_WARN_AGE in /etc/login.defs"
+  id="test_pass_warn_age" version="1"&gt;
+    &lt;ind:object object_ref="object_etc_login_defs_pass_warn_age" /&gt;
+    &lt;ind:state state_ref="state_etc_login_defs_pass_warn_age" /&gt;
+  &lt;/ind:textfilecontent54_test&gt;
+
+  &lt;ind:textfilecontent54_object id="object_etc_login_defs_pass_warn_age"
+  version="1"&gt;
+    &lt;ind:filepath&gt;/etc/login.defs&lt;/ind:filepath&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^[\s]<b class="moz-txt-star"><span class="moz-txt-tag">*</span>PASS_WARN_AGE[\s]*(\d+)\s<span class="moz-txt-tag">*</span></b>$&lt;/ind:pattern&gt;
+    &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
+  &lt;/ind:textfilecontent54_object&gt;
+
+  &lt;ind:textfilecontent54_state id="state_etc_login_defs_pass_warn_age" version="1"&gt;
+    &lt;ind:subexpression operation="greater than or equal" var_ref="var_accounts_password_warn_age_login_defs" datatype="int" /&gt;
+  &lt;/ind:textfilecontent54_state&gt;
+
+  &lt;external_variable comment="password expiration warning age in days" datatype="int" id="var_accounts_password_warn_age_login_defs" version="1" /&gt;
+
+&lt;/def-group&gt;
diff --git a/Fedora/input/guide.xml b/Fedora/input/guide.xml
index c76b795..6e276b1 100644
--- a/Fedora/input/guide.xml
+++ b/Fedora/input/guide.xml
@@ -36,5 +36,5 @@ trademarks or trademarks of Red Hat, Inc. in the United States and other
 countries. All other names are registered trademarks or trademarks of their
 respective companies.&lt;/rear-matter&gt;
 &lt;platform idref="cpe:/o:fedoraproject:fedora:19" /&gt;
-&lt;version&gt;0.0.1&lt;/version&gt;
+&lt;version&gt;0.0.2&lt;/version&gt;
 &lt;/Benchmark&gt;
diff --git a/Fedora/input/guide.xslt b/Fedora/input/guide.xslt
index 8bdf86e..559042e 100644
--- a/Fedora/input/guide.xslt
+++ b/Fedora/input/guide.xslt
@@ -46,6 +46,7 @@
     &lt;xsl:copy&gt;
       &lt;xsl:copy-of select="@*|node()" /&gt;
       &lt;xsl:apply-templates select="document('system/accounts/restrictions/password_storage.xml')" /&gt;
+      &lt;xsl:apply-templates select="document('system/accounts/restrictions/password_expiration.xml')" /&gt;
     &lt;/xsl:copy&gt;
   &lt;/xsl:template&gt;
 
diff --git a/Fedora/input/profiles/common.xml b/Fedora/input/profiles/common.xml
index 2739a33..83e3478 100644
--- a/Fedora/input/profiles/common.xml
+++ b/Fedora/input/profiles/common.xml
@@ -8,5 +8,9 @@
 &lt;select idref="no_hashes_outside_shadow" selected="true"/&gt;
 &lt;select idref="gid_passwd_group_same" selected="true"/&gt;
 &lt;select idref="no_netrc_files" selected="true"/&gt;
+&lt;select idref="accounts_password_minlen_login_defs" selected="true"/&gt;
+&lt;select idref="accounts_minimum_age_login_defs" selected="true"/&gt;
+&lt;select idref="accounts_maximum_age_login_defs" selected="true"/&gt;
+&lt;select idref="accounts_password_warn_age_login_defs" selected="true"/&gt;
 
 &lt;/Profile&gt;
diff --git a/Fedora/input/system/accounts/restrictions/password_expiration.xml b/Fedora/input/system/accounts/restrictions/password_expiration.xml
new file mode 100644
index 0000000..73d48c6
--- /dev/null
+++ b/Fedora/input/system/accounts/restrictions/password_expiration.xml
@@ -0,0 +1,177 @@
+&lt;Group id="password_expiration"&gt;
+&lt;title&gt;Set Password Expiration Parameters&lt;/title&gt;
+&lt;description&gt;The file &lt;tt&gt;/etc/login.defs&lt;/tt&gt; controls several
+password-related settings. Programs such as &lt;tt&gt;passwd&lt;/tt&gt;,
+&lt;tt&gt;su&lt;/tt&gt;, and &lt;tt&gt;login&lt;/tt&gt; consult &lt;tt&gt;/etc/login.defs&lt;/tt&gt; to determine
+behavior with regard to password aging, expiration warnings,
+and length. See the man page &lt;tt&gt;login.defs(5)&lt;/tt&gt; for more information.
+&lt;br/&gt;&lt;br/&gt;
+Users should be forced to change their passwords, in order to
+decrease the utility of compromised passwords. However, the need to
+change passwords often should be balanced against the risk that
+users will reuse or write down passwords if forced to change them
+too often. Forcing password changes every 90-360 days, depending on
+the environment, is recommended. Set the appropriate value as
+&lt;tt&gt;PASS_MAX_DAYS&lt;/tt&gt; and apply it to existing accounts with the
+&lt;tt&gt;-M&lt;/tt&gt; flag.
+&lt;br /&gt;&lt;br /&gt;
+The &lt;tt&gt;PASS_MIN_DAYS&lt;/tt&gt; (&lt;tt&gt;-m&lt;/tt&gt;) setting prevents password
+changes for 7 days after the first change, to discourage password
+cycling. If you use this setting, train users to contact an administrator
+for an emergency password change in case a new password becomes
+compromised. The &lt;tt&gt;PASS_WARN_AGE&lt;/tt&gt; (&lt;tt&gt;-W&lt;/tt&gt;) setting gives
+users 7 days of warnings at login time that their passwords are about to expire.
+&lt;br /&gt;&lt;br /&gt;
+For example, for each existing human user &lt;i&gt;USER&lt;/i&gt;, expiration parameters
+could be adjusted to a 180 day maximum password age, 7 day minimum password
+age, and 7 day warning period with the following command:
+&lt;pre&gt;# chage -M 180 -m 7 -W 7 USER&lt;/pre&gt;
+&lt;/description&gt;
+
+&lt;Value id="var_accounts_password_minlen_login_defs" type="number" &gt;
+&lt;title&gt;minimum password length&lt;/title&gt;
+&lt;description&gt;Minimum number of characters in password&lt;/description&gt;
+&lt;warning category="general"&gt;This will only check new passwords&lt;/warning&gt;
+&lt;value selector=""&gt;12&lt;/value&gt;
+&lt;value selector="6"&gt;6&lt;/value&gt;
+&lt;!-- NIST 800-53 requires 1 in a million using brute force which translates to six numbers --&gt;
+&lt;value selector="8"&gt;8&lt;/value&gt;
+&lt;value selector="10"&gt;10&lt;/value&gt;
+&lt;value selector="12"&gt;12&lt;/value&gt;
+&lt;value selector="14"&gt;14&lt;/value&gt;
+&lt;/Value&gt;
+
+&lt;Value id="var_accounts_maximum_age_login_defs" type="number" &gt;
+&lt;title&gt;maximum password age&lt;/title&gt;
+&lt;description&gt;Maximum age of password in days&lt;/description&gt;
+&lt;warning category="general"&gt;This will only apply to newly created accounts&lt;/warning&gt;
+&lt;value selector=""&gt;60&lt;/value&gt;
+&lt;value selector="60"&gt;60&lt;/value&gt;
+&lt;value selector="90"&gt;90&lt;/value&gt;
+&lt;value selector="120"&gt;120&lt;/value&gt;
+&lt;value selector="180"&gt;180&lt;/value&gt;
+&lt;/Value&gt;
+
+&lt;Value id="var_accounts_minimum_age_login_defs" type="number" &gt;
+&lt;title&gt;minimum password age&lt;/title&gt;
+&lt;description&gt;Minimum age of password in days&lt;/description&gt;
+&lt;warning category="general"&gt;This will only apply to newly created accounts&lt;/warning&gt;
+&lt;value selector=""&gt;7&lt;/value&gt;
+&lt;value selector="7"&gt;7&lt;/value&gt;
+&lt;value selector="5"&gt;5&lt;/value&gt;
+&lt;value selector="1"&gt;1&lt;/value&gt;
+&lt;value selector="2"&gt;2&lt;/value&gt;
+&lt;value selector="0"&gt;0&lt;/value&gt;
+&lt;/Value&gt;
+
+&lt;Value id="var_accounts_password_warn_age_login_defs" type="number" &gt;
+&lt;title&gt;warning days before password expires&lt;/title&gt;
+&lt;description&gt;The number of days' warning given before a password expires.&lt;/description&gt;
+&lt;warning category="general"&gt;This will only apply to newly created accounts&lt;/warning&gt;
+&lt;value selector=""&gt;7&lt;/value&gt;
+&lt;value selector="0"&gt;0&lt;/value&gt;
+&lt;value selector="7"&gt;7&lt;/value&gt;
+&lt;value selector="14"&gt;14&lt;/value&gt;
+&lt;/Value&gt;
+
+&lt;Rule id="accounts_password_minlen_login_defs" severity="medium"&gt;
+&lt;title&gt;Set Password Minimum Length in login.defs&lt;/title&gt;
+&lt;description&gt;To specify password length requirements for new accounts,
+edit the file &lt;tt&gt;/etc/login.defs&lt;/tt&gt; and add or correct the following
+lines:
+&lt;pre&gt;PASS_MIN_LEN 12&lt;!-- &lt;sub idref="var_accounts_password_minlen_login_defs"&gt; --&gt;&lt;/pre&gt;
+&lt;br/&gt;&lt;br/&gt;
+Nowadays recommended values, considered as secure by various organizations
+focused on topic of computer security, range from &lt;tt&gt;12 (FISMA)&lt;/tt&gt; up to
+&lt;tt&gt;14 (DoD)&lt;/tt&gt; characters for password length requirements.
+If a program consults &lt;tt&gt;/etc/login.defs&lt;/tt&gt; and also another PAM module
+(such as &lt;tt&gt;pam_cracklib&lt;/tt&gt;) during a password change operation,
+then the most restrictive must be satisfied. See PAM section
+for more information about enforcing password quality requirements.
+&lt;/description&gt;
+&lt;ocil clause="it is not set to the required value"&gt;
+To check the minimum password length, run the command:
+&lt;pre&gt;$ grep PASS_MIN_LEN /etc/login.defs&lt;/pre&gt;
+Passwords of length &lt;tt&gt;12&lt;/tt&gt; characters and more are nowadays
+considered to be a standard requirement.
+&lt;/ocil&gt;
+&lt;rationale&gt;
+Requiring a minimum password length makes password
+cracking attacks more difficult by ensuring a larger
+search space. However, any security benefit from an onerous requirement
+must be carefully weighed against usability problems, support costs, or
+counterproductive behavior that may result.
+&lt;/rationale&gt;
+&lt;oval id="accounts_password_minlen_login_defs" value="var_accounts_password_minlen_login_defs"/&gt;
+&lt;ref nist="IA-5(f),IA-5(1)(a)" disa="205"/&gt;
+&lt;/Rule&gt;
+
+&lt;Rule id="accounts_minimum_age_login_defs" severity="medium"&gt;
+&lt;title&gt;Set Password Minimum Age&lt;/title&gt;
+&lt;description&gt;To specify password minimum age for new accounts,
+edit the file &lt;tt&gt;/etc/login.defs&lt;/tt&gt; and add or correct the
+following line, replacing the &lt;i&gt;DAYS&lt;/i&gt; item as appropriate: 
+&lt;pre&gt;PASS_MIN_DAYS &lt;i&gt;DAYS&lt;/i&gt;&lt;/pre&gt;
+A value of 1 day is considered to be sufficient for many environments.
+&lt;/description&gt;
+&lt;ocil clause="it is not set to the required value"&gt;
+To check the minimum password age, run the command:
+&lt;pre&gt;$ grep PASS_MIN_DAYS /etc/login.defs&lt;/pre&gt;
+A value of 1 day is considered to be sufficient for many environments.
+&lt;/ocil&gt;
+&lt;rationale&gt;
+Setting the minimum password age protects against users cycling
+back to a favorite password after satisfying the password reuse
+requirement.
+&lt;/rationale&gt;
+&lt;oval id="accounts_minimum_age_login_defs" value="var_accounts_minimum_age_login_defs"/&gt;
+&lt;ref nist="IA-5(f),IA-5(1)(d)" disa="198"/&gt;
+&lt;/Rule&gt;
+
+&lt;Rule id="accounts_maximum_age_login_defs" severity="medium"&gt;
+&lt;title&gt;Set Password Maximum Age&lt;/title&gt;
+&lt;description&gt;To specify password maximum age for new accounts,
+edit the file &lt;tt&gt;/etc/login.defs&lt;/tt&gt; and add or correct the
+following line, replacing the &lt;i&gt;DAYS&lt;/i&gt; item appropriately:
+&lt;pre&gt;PASS_MAX_DAYS &lt;i&gt;DAYS&lt;/i&gt;&lt;/pre&gt;
+A value of 180 days is sufficient for many environments. 
+&lt;/description&gt;
+&lt;ocil clause="it is not set to the required value"&gt;
+To check the maximum password age, run the command:
+&lt;pre&gt;$ grep PASS_MAX_DAYS /etc/login.defs&lt;/pre&gt;
+A value of 180 days is sufficient for many environments. 
+&lt;/ocil&gt;
+&lt;rationale&gt;
+Setting the password maximum age ensures users are required to
+periodically change their passwords. This could possibly decrease
+the utility of a stolen password. Requiring shorter password lifetimes
+increases the risk of users writing down the password in a convenient
+location subject to physical compromise.&lt;/rationale&gt;
+&lt;oval id="accounts_maximum_age_login_defs" value="var_accounts_maximum_age_login_defs"/&gt;
+&lt;ref nist="IA-5(f),IA-5(g),IA-5(1)(d)" disa="180,199" /&gt;
+&lt;/Rule&gt;
+
+&lt;Rule id="accounts_password_warn_age_login_defs"&gt;
+&lt;title&gt;Set Password Warning Age&lt;/title&gt;
+&lt;description&gt;To specify how many days prior to password
+expiration that a warning will be issued to users,
+edit the file &lt;tt&gt;/etc/login.defs&lt;/tt&gt; and add or correct
+ the following line, replacing the &lt;i&gt;DAYS&lt;/i&gt; item as appropriate:
+&lt;pre&gt;PASS_WARN_AGE &lt;i&gt;DAYS&lt;/i&gt;&lt;/pre&gt;
+A value of 7 days would be nowadays considered to be a standard.
+&lt;!-- &lt;sub idref="accounts_password_warn_age_login_defs_login_defs_value" /&gt; --&gt;
+&lt;/description&gt;
+&lt;ocil clause="it is not set to the required value"&gt;
+To check the password warning age, run the command:
+&lt;pre&gt;$ grep PASS_WARN_AGE /etc/login.defs&lt;/pre&gt;
+A value of 7 days would be nowadays considered to be a standard.
+&lt;/ocil&gt;
+&lt;rationale&gt;
+Setting the password warning age enables users to make the change
+at a practical time.
+&lt;/rationale&gt;
+&lt;oval id="accounts_password_warn_age_login_defs" value="var_accounts_password_warn_age_login_defs" /&gt;
+&lt;ref nist="IA-5(f)" /&gt;
+&lt;/Rule&gt;
+
+&lt;/Group&gt;
diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
index 73eab57..1abe666 100644
--- a/Fedora/scap-security-guide.spec
+++ b/Fedora/scap-security-guide.spec
@@ -5,7 +5,7 @@
 # file one level up - in the main scap-security-guide directory (instead of
 # this one).
 
-%global        fedorassgrelease        2.rc2
+%global        fedorassgrelease        2.rc3
 
 Name:                scap-security-guide
 Version:        0.1
@@ -50,6 +50,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/xml/scap/ssg/fedora/19/*
 
 %changelog
+* Thu Oct 10 2013 Jan iankko Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a> 0.1-2.rc3
+- Convert four RHEL6 'Set Password Expiration Parameter' rules to Fedora
+
 * Thu Oct 10 2013 Jan iankko Lieskovsky <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a> 0.1-2.rc2
 - Introduce 'Account and Access Control' section
 - Convert following "Verify Proper Storage and Existence of Password Hashes" section
<div class="moz-txt-sig">-- 
1.7.11.7

</div></pre>
      </div>
    </blockquote>
    <br>
    ack<br>
  </body>
</html>