<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/15/13 4:28 PM, Maura Dailey
      wrote:<br>
    </div>
    <blockquote cite="mid:525DA569.3080400@eclipse.ncsc.mil" type="cite">
      <div class="moz-text-flowed" style="font-family: -moz-fixed;
        font-size: 12px;" lang="x-unicode">The alternative, by the way,
        is to delete the check entirely, if no profiles reference it.
        <br>
        <br>
        On 10/15/2013 04:05 PM, Maura Dailey wrote:
        <br>
        <blockquote type="cite" style="color: #000000;">Somewhat
          confusingly, the name of the check for pam_cracklib's minclass
          option was accounts_password_minclass_login_defs.xml. I
          corrected it and the id of the check inside the file.
          <br>
          <br>
          - Maura Dailey
          <br>
          <br>
          Signed-off-by: Maura Dailey <a moz-do-not-send="true"
            class="moz-txt-link-rfc2396E"
            href="mailto:maura@eclipse.ncsc.mil">&lt;maura@eclipse.ncsc.mil&gt;</a>
          <br>
          ---
          <br>
            .../accounts_password_pam_cracklib_minclass.xml    |   43
          ++++++++++++++++++++
          <br>
            1 files changed, 43 insertions(+), 0 deletions(-)
          <br>
            create mode 100644
          RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
          <br>
          <br>
          diff --git
          a/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
          <br>
          new file mode 100644
          <br>
          index 0000000..539164b
          <br>
          --- /dev/null
          <br>
          +++
          b/RHEL6/input/checks/accounts_password_pam_cracklib_minclass.xml
          <br>
          @@ -0,0 +1,43 @@
          <br>
          +&lt;def-group&gt;
          <br>
          +  &lt;definition class="compliance"
          id="accounts_password_pam_cracklib_minclass" version="1"&gt;
          <br>
          +    &lt;metadata&gt;
          <br>
          +      &lt;title&gt;Set Password minclass
          Requirements&lt;/title&gt;
          <br>
          +      &lt;affected family="unix"&gt;
          <br>
          +        &lt;platform&gt;Red Hat Enterprise Linux
          6&lt;/platform&gt;
          <br>
          +      &lt;/affected&gt;
          <br>
          +      &lt;description&gt;The password minclass should meet
          minimum
          <br>
          +      requirements using pam_cracklib&lt;/description&gt;
          <br>
          +    &lt;/metadata&gt;
          <br>
          +    &lt;criteria&gt;
          <br>
          +      &lt;criterion comment="Conditions for minclass are
          satisfied"
          <br>
          +                
          test_ref="test_password_pam_cracklib_minclass" /&gt;
          <br>
          +    &lt;/criteria&gt;
          <br>
          +  &lt;/definition&gt;
          <br>
          +
          <br>
          +  &lt;ind:textfilecontent54_test check="all"
          <br>
          +                              comment="check the
          configuration of /etc/pam.d/system-auth"
          <br>
          +                             
          id="test_password_pam_cracklib_minclass" version="1"&gt;
          <br>
          +    &lt;ind:object
          object_ref="obj_password_pam_cracklib_minclass" /&gt;
          <br>
          +    &lt;ind:state
          state_ref="state_password_pam_cracklib_minclass" /&gt;
          <br>
          +  &lt;/ind:textfilecontent54_test&gt;
          <br>
          +
          <br>
          +  &lt;ind:textfilecontent54_state
          id="state_password_pam_cracklib_minclass"
          <br>
          +                               version="1"&gt;
          <br>
          +    &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
          <br>
          +    &lt;ind:subexpression datatype="int"
          <br>
          +                       operation="less than or equal"
          <br>
          +                      
          var_ref="var_password_pam_cracklib_minclass" /&gt;
          <br>
          +  &lt;/ind:textfilecontent54_state&gt;
          <br>
          +
          <br>
          +  &lt;external_variable comment="External variable for
          pam_cracklib minclass"
          <br>
          +                     datatype="int"
          id="var_password_pam_cracklib_minclass"
          <br>
          +                     version="1" /&gt;
          <br>
          +
          <br>
          +  &lt;ind:textfilecontent54_object
          id="obj_password_pam_cracklib_minclass"
          <br>
          +                                version="1"&gt;
          <br>
          +    &lt;ind:path&gt;/etc/pam.d&lt;/ind:path&gt;
          <br>
          +    &lt;ind:filename&gt;system-auth&lt;/ind:filename&gt;
          <br>
          +    &lt;ind:pattern operation="pattern
match"&gt;^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]minclass=(-?\d+)(?:[\s]|$)&lt;/ind:pattern&gt;<br>
          +    &lt;ind:instance datatype="int" operation="less than or
          equal"&gt;1&lt;/ind:instance&gt;
          <br>
          +  &lt;/ind:textfilecontent54_object&gt;
          <br>
          +&lt;/def-group&gt;
          <br>
        </blockquote>
      </div>
    </blockquote>
    <br>
    Between the accounts_password_pam_cracklib_{dcredit ucredit ocredit
    lcredit} checks I'm unsure if this is even needed (as further
    evident by no profile calling the check)...<br>
    <br>
    ack to the rename, though<br>
  </body>
</html>