<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/15/2013 08:01 PM, Shawn Wells
      wrote:<br>
    </div>
    <blockquote cite="mid:525DD764.9020105@redhat.com" type="cite">
      <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
      <div class="moz-cite-prefix">On 10/15/13 4:28 PM, Maura Dailey
        wrote:<br>
      </div>
      <blockquote cite="mid:525DA569.3080400@eclipse.ncsc.mil"
        type="cite">
        <div class="moz-text-flowed" style="font-family: -moz-fixed;
          font-size: 12px;" lang="x-unicode">The alternative, by the
          way, is to delete the check entirely, if no profiles reference
          it. <br>
          <br>
          On 10/15/2013 04:05 PM, Maura Dailey wrote: <br>
          <blockquote type="cite" style="color: #000000;">Somewhat
            confusingly, the name of the check for pam_cracklib's
            minclass option was
            accounts_password_minclass_login_defs.xml. I corrected it
            and the id of the check inside the file. <br>
            <br>
            - Maura Dailey <br>
            <br>
            Signed-off-by: Maura Dailey <a moz-do-not-send="true"
              class="moz-txt-link-rfc2396E"
              href="mailto:maura@eclipse.ncsc.mil">&lt;maura@eclipse.ncsc.mil&gt;</a>
            <br>
            --- <br>
              .../accounts_password_pam_cracklib_minclass.xml    |   43
            ++++++++++++++++++++ <br>
              1 files changed, 43 insertions(+), 0 deletions(-) <br>
              create mode 100644
            RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
            <br>
            <br>
            diff --git
            a/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
            b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml

            <br>
            new file mode 100644 <br>
            index 0000000..539164b <br>
            --- /dev/null <br>
            +++
            b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
            <br>
            @@ -0,0 +1,43 @@ <br>
            +&lt;def-group&gt; <br>
            +  &lt;definition class="compliance"
            id="accounts_password_pam_cracklib_minclass" version="1"&gt;
            <br>
            +    &lt;metadata&gt; <br>
            +      &lt;title&gt;Set Password minclass
            Requirements&lt;/title&gt; <br>
            +      &lt;affected family="unix"&gt; <br>
            +        &lt;platform&gt;Red Hat Enterprise Linux
            6&lt;/platform&gt; <br>
            +      &lt;/affected&gt; <br>
            +      &lt;description&gt;The password minclass should meet
            minimum <br>
            +      requirements using pam_cracklib&lt;/description&gt; <br>
            +    &lt;/metadata&gt; <br>
            +    &lt;criteria&gt; <br>
            +      &lt;criterion comment="Conditions for minclass are
            satisfied" <br>
            +                
            test_ref="test_password_pam_cracklib_minclass" /&gt; <br>
            +    &lt;/criteria&gt; <br>
            +  &lt;/definition&gt; <br>
            + <br>
            +  &lt;ind:textfilecontent54_test check="all" <br>
            +                              comment="check the
            configuration of /etc/pam.d/system-auth" <br>
            +                             
            id="test_password_pam_cracklib_minclass" version="1"&gt; <br>
            +    &lt;ind:object
            object_ref="obj_password_pam_cracklib_minclass" /&gt; <br>
            +    &lt;ind:state
            state_ref="state_password_pam_cracklib_minclass" /&gt; <br>
            +  &lt;/ind:textfilecontent54_test&gt; <br>
            + <br>
            +  &lt;ind:textfilecontent54_state
            id="state_password_pam_cracklib_minclass" <br>
            +                               version="1"&gt; <br>
            +    &lt;ind:instance
            datatype="int"&gt;1&lt;/ind:instance&gt; <br>
            +    &lt;ind:subexpression datatype="int" <br>
            +                       operation="less than or equal" <br>
            +                      
            var_ref="var_password_pam_cracklib_minclass" /&gt; <br>
            +  &lt;/ind:textfilecontent54_state&gt; <br>
            + <br>
            +  &lt;external_variable comment="External variable for
            pam_cracklib minclass" <br>
            +                     datatype="int"
            id="var_password_pam_cracklib_minclass" <br>
            +                     version="1" /&gt; <br>
            + <br>
            +  &lt;ind:textfilecontent54_object
            id="obj_password_pam_cracklib_minclass" <br>
            +                                version="1"&gt; <br>
            +    &lt;ind:path&gt;/etc/pam.d&lt;/ind:path&gt; <br>
            +    &lt;ind:filename&gt;system-auth&lt;/ind:filename&gt; <br>
            +    &lt;ind:pattern operation="pattern
match"&gt;^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minclass=(-?\d+)(?:[\s]|$)&lt;/ind:pattern&gt;<br>
            +    &lt;ind:instance datatype="int" operation="less than or
            equal"&gt;1&lt;/ind:instance&gt; <br>
            +  &lt;/ind:textfilecontent54_object&gt; <br>
            +&lt;/def-group&gt; <br>
          </blockquote>
        </div>
      </blockquote>
      <br>
      Between the accounts_password_pam_cracklib_{dcredit ucredit
      ocredit lcredit} checks I'm unsure if this is even needed (as
      further evident by no profile calling the check)...<br>
      <br>
      ack to the rename, though<br>
      <br>
    </blockquote>
    <br>
    I guess I'll push the rename for now. I found it because make
    validate complains about it (since it's not referenced anywhere in
    the XCCDF).<br>
    <br>
    <blockquote cite="mid:525DD764.9020105@redhat.com" type="cite">
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
    </blockquote>
    <br>
  </body>
</html>