<div dir="ltr"><div style="font-family:arial,sans-serif;font-size:13px">I&#39;m using scap-security-guide-0.1-12.el6.noarch as my source from </div><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">
<a href="http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/" target="_blank">http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/</a><br></div><div style="font-family:arial,sans-serif;font-size:13px">
<br></div><div style="font-family:arial,sans-serif;font-size:13px">Running oscap xccdf eval --profile server /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml</div><div style="font-family:arial,sans-serif;font-size:13px">
Generates a failure for </div><div style="font-family:arial,sans-serif;font-size:13px"><div>Title   Set Password Minimum Age</div><div>Rule    password_min_age</div><div>Ident   CCE-27013-2</div><div>Result  fail</div><div>
<br></div><div>Title   Set Password Maximum Age</div><div>Rule    password_max_age</div><div>Ident   CCE-26985-2</div><div>Result  fail</div></div><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">
<div>Title   Set Password Strength Minimum Uppercase Characters</div><div>Rule    password_require_uppercases</div><div>Ident   CCE-26601-5</div><div>Result  fail</div><div><br></div><div>Title   Set Password Strength Minimum Special Characters</div>
<div>Rule    password_require_specials</div><div>Ident   CCE-26409-3</div><div>Result  fail</div><div><br></div><div>Title   Set Password Strength Minimum Lowercase Characters</div><div>Rule    password_require_lowercases</div>
<div>Ident   CCE-26631-2</div><div>Result  fail</div></div><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">Among others.  </div><div style="font-family:arial,sans-serif;font-size:13px">
I have cracklib configured what I believe is correct (according to the CCE)</div><div style="font-family:arial,sans-serif;font-size:13px"><div># grep cracklib /etc/pam.d/system-auth-ac</div><div>password    requisite     pam_cracklib.so dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4 try_first_pass retry=3 minlen=14 type=</div>
</div><div style="font-family:arial,sans-serif;font-size:13px"><div># grep PASS /etc/login.defs</div><div><br></div><div>PASS_MAX_DAYS   180</div><div>PASS_MIN_DAYS   1</div><div>PASS_MIN_LEN    14</div><div>PASS_WARN_AGE   7</div>
</div><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">Any help on what I might be missing here? </div><div style="font-family:arial,sans-serif;font-size:13px">
<br></div><div style="font-family:arial,sans-serif;font-size:13px">Thanks!</div><div style="font-family:arial,sans-serif;font-size:13px">Will</div></div>