<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/24/13, 1:29 PM, Jeff Bachtel
      wrote:<br>
    </div>
    <blockquote
cite="mid:CAHahqg36TaWVwv+SUbX=D0FryfHwVduWpxoUN1=8CMcrwpghqQ@mail.gmail.com"
      type="cite">
      <div dir="ltr">Will,
        <div><br>
        </div>
        <div>I'm seeing the same failures using SCC 3.1 (which is DISA's
          packaging of SSG). I suspect a profile problem (leading to
          improper external variables possibly being set). What happens
          when you run the test with profile <span
style="background-color:rgb(247,247,247);color:rgb(0,0,0);font-size:13px">stig-rhel6-server
            ?</span></div>
        <div><span
style="background-color:rgb(247,247,247);color:rgb(0,0,0);font-size:13px"><br>
          </span></div>
        <div><span
style="background-color:rgb(247,247,247);color:rgb(0,0,0);font-size:13px">Actually,
            checking </span><font color="#000000">/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
            the "server" profile specifies</font></div>
        <div><font color="#000000">&lt;refine-value
            idref="var_password_min_age" selector="7"/&gt; so that's the
            minimum acceptable with the profile you're using.<br>
          </font></div>
        <div><font color="#000000"><br>
          </font></div>
        <div><font color="#000000">But thanks for the email, now I have
            an idea what might be goobering up on SCC...</font></div>
        <div><font color="#000000"><br>
          </font></div>
        <div><font color="#000000">Jeff</font></div>
        <div><font color="#000000"><br>
          </font></div>
      </div>
      <div class="gmail_extra"><br>
        <br>
        <div class="gmail_quote">On Thu, Oct 24, 2013 at 11:40 AM,
          wm-lists <span dir="ltr">&lt;<a moz-do-not-send="true"
              href="mailto:wm-lists@nixpeeps.com" target="_blank">wm-lists@nixpeeps.com</a>&gt;</span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div dir="ltr">
              <div style="font-family:arial,sans-serif;font-size:13px">I'm
                using scap-security-guide-0.1-12.el6.noarch as my source
                from </div>
              <div style="font-family:arial,sans-serif;font-size:13px"><br>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px">
                <a moz-do-not-send="true"
href="http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/"
                  target="_blank">http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/</a><br>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px">
                <br>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px">Running oscap
                xccdf eval --profile server
                /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml</div>
              <div style="font-family:arial,sans-serif;font-size:13px">
                Generates a failure for </div>
              <div style="font-family:arial,sans-serif;font-size:13px">
                <div>Title   Set Password Minimum Age</div>
                <div>Rule    password_min_age</div>
                <div>Ident   CCE-27013-2</div>
                <div>Result  fail</div>
                <div>
                  <br>
                </div>
                <div>Title   Set Password Maximum Age</div>
                <div>Rule    password_max_age</div>
                <div>Ident   CCE-26985-2</div>
                <div>Result  fail</div>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px"><br>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px">
                <div>Title   Set Password Strength Minimum Uppercase
                  Characters</div>
                <div>Rule    password_require_uppercases</div>
                <div>Ident   CCE-26601-5</div>
                <div>Result  fail</div>
                <div><br>
                </div>
                <div>Title   Set Password Strength Minimum Special
                  Characters</div>
                <div>Rule    password_require_specials</div>
                <div>Ident   CCE-26409-3</div>
                <div>Result  fail</div>
                <div><br>
                </div>
                <div>Title   Set Password Strength Minimum Lowercase
                  Characters</div>
                <div>Rule    password_require_lowercases</div>
                <div>Ident   CCE-26631-2</div>
                <div>Result  fail</div>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px"><br>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px">Among
                others.  </div>
              <div style="font-family:arial,sans-serif;font-size:13px">
                I have cracklib configured what I believe is correct
                (according to the CCE)</div>
              <div style="font-family:arial,sans-serif;font-size:13px">
                <div># grep cracklib /etc/pam.d/system-auth-ac</div>
                <div>password    requisite     pam_cracklib.so
                  dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4
                  try_first_pass retry=3 minlen=14 type=</div>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px">
                <div># grep PASS /etc/login.defs</div>
                <div><br>
                </div>
                <div>PASS_MAX_DAYS   180</div>
                <div>PASS_MIN_DAYS   1</div>
                <div>PASS_MIN_LEN    14</div>
                <div>PASS_WARN_AGE   7</div>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px"><br>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px">Any
                help on what I might be missing here? </div>
              <div style="font-family:arial,sans-serif;font-size:13px">
                <br>
              </div>
              <div style="font-family:arial,sans-serif;font-size:13px">Thanks!</div>
              <div style="font-family:arial,sans-serif;font-size:13px">Will</div>
            </div>
          </blockquote>
        </div>
      </div>
    </blockquote>
    <br>
    <br>
    Stuff off my people.redhat.com page is just scratch space I use for
    my own purposes -- demos, builds, etc. *Definitely* don't trust
    content from there as it's usually a clone of my (often broke) local
    git tree. And often outdated. Speaking of which, I need to drop in a
    norobots file....<br>
    <br>
    As for this OVAL, it appears to have been fixed on 18-SEPT:<br>
<a class="moz-txt-link-freetext" href="https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/RHEL6/input/checks/accounts_minimum_age_login_defs.xml?id=8e56c6960f71c1fed1cfa7e1fafed382ce2c1d87">https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/RHEL6/input/checks/accounts_minimum_age_login_defs.xml?id=8e56c6960f71c1fed1cfa7e1fafed382ce2c1d87</a><br>
    <br>
    Should be reflected in next RPM update<br>
    <br>
    <br>
  </body>
</html>