<div dir="ltr">still getting the same result.. <div><div>oscap xccdf eval --report /var/www/html/report.html --profile server /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml</div><div><br></div><div><div><Benchmark xmlns="<a href="http://checklists.nist.gov/xccdf/1.1">http://checklists.nist.gov/xccdf/1.1</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" id="RHEL-6" resolved="1" xml:lang="en-US"></div>
<div> <status date="2013-10-22">draft</status></div></div><div><br></div><div><br></div><div><div>Title Set Password Strength Minimum Uppercase Characters</div><div>Rule password_require_uppercases</div>
<div>Ident CCE-26601-5</div><div>Result fail</div><div><br></div><div>Title Set Password Strength Minimum Special Characters</div><div>Rule password_require_specials</div><div>Ident CCE-26409-3</div><div>Result fail</div>
<div><br></div><div>Title Set Password Strength Minimum Lowercase Characters</div><div>Rule password_require_lowercases</div><div>Ident CCE-26631-2</div><div>Result fail</div></div><div><br></div></div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Thu, Oct 24, 2013 at 1:51 PM, Shawn Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div><div class="h5">
<div>On 10/24/13, 1:29 PM, Jeff Bachtel
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">Will,
<div><br>
</div>
<div>I'm seeing the same failures using SCC 3.1 (which is DISA's
packaging of SSG). I suspect a profile problem (leading to
improper external variables possibly being set). What happens
when you run the test with profile <span style="font-size:13px;background-color:rgb(247,247,247)">stig-rhel6-server
?</span></div>
<div><span style="font-size:13px;background-color:rgb(247,247,247)"><br>
</span></div>
<div><span style="font-size:13px;background-color:rgb(247,247,247)">Actually,
checking </span><font color="#000000">/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml
the "server" profile specifies</font></div>
<div><font color="#000000"><refine-value
idref="var_password_min_age" selector="7"/> so that's the
minimum acceptable with the profile you're using.<br>
</font></div>
<div><font color="#000000"><br>
</font></div>
<div><font color="#000000">But thanks for the email, now I have
an idea what might be goobering up on SCC...</font></div>
<div><font color="#000000"><br>
</font></div>
<div><font color="#000000">Jeff</font></div>
<div><font color="#000000"><br>
</font></div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Thu, Oct 24, 2013 at 11:40 AM,
wm-lists <span dir="ltr"><<a href="mailto:wm-lists@nixpeeps.com" target="_blank">wm-lists@nixpeeps.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">
<div style="font-family:arial,sans-serif;font-size:13px">I'm
using scap-security-guide-0.1-12.el6.noarch as my source
from </div>
<div style="font-family:arial,sans-serif;font-size:13px"><br>
</div>
<div style="font-family:arial,sans-serif;font-size:13px">
<a href="http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/" target="_blank">http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/</a><br>
</div>
<div style="font-family:arial,sans-serif;font-size:13px">
<br>
</div>
<div style="font-family:arial,sans-serif;font-size:13px">Running oscap
xccdf eval --profile server
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml</div>
<div style="font-family:arial,sans-serif;font-size:13px">
Generates a failure for </div>
<div style="font-family:arial,sans-serif;font-size:13px">
<div>Title Set Password Minimum Age</div>
<div>Rule password_min_age</div>
<div>Ident CCE-27013-2</div>
<div>Result fail</div>
<div>
<br>
</div>
<div>Title Set Password Maximum Age</div>
<div>Rule password_max_age</div>
<div>Ident CCE-26985-2</div>
<div>Result fail</div>
</div>
<div style="font-family:arial,sans-serif;font-size:13px"><br>
</div>
<div style="font-family:arial,sans-serif;font-size:13px">
<div>Title Set Password Strength Minimum Uppercase
Characters</div>
<div>Rule password_require_uppercases</div>
<div>Ident CCE-26601-5</div>
<div>Result fail</div>
<div><br>
</div>
<div>Title Set Password Strength Minimum Special
Characters</div>
<div>Rule password_require_specials</div>
<div>Ident CCE-26409-3</div>
<div>Result fail</div>
<div><br>
</div>
<div>Title Set Password Strength Minimum Lowercase
Characters</div>
<div>Rule password_require_lowercases</div>
<div>Ident CCE-26631-2</div>
<div>Result fail</div>
</div>
<div style="font-family:arial,sans-serif;font-size:13px"><br>
</div>
<div style="font-family:arial,sans-serif;font-size:13px">Among
others. </div>
<div style="font-family:arial,sans-serif;font-size:13px">
I have cracklib configured what I believe is correct
(according to the CCE)</div>
<div style="font-family:arial,sans-serif;font-size:13px">
<div># grep cracklib /etc/pam.d/system-auth-ac</div>
<div>password requisite pam_cracklib.so
dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4
try_first_pass retry=3 minlen=14 type=</div>
</div>
<div style="font-family:arial,sans-serif;font-size:13px">
<div># grep PASS /etc/login.defs</div>
<div><br>
</div>
<div>PASS_MAX_DAYS 180</div>
<div>PASS_MIN_DAYS 1</div>
<div>PASS_MIN_LEN 14</div>
<div>PASS_WARN_AGE 7</div>
</div>
<div style="font-family:arial,sans-serif;font-size:13px"><br>
</div>
<div style="font-family:arial,sans-serif;font-size:13px">Any
help on what I might be missing here? </div>
<div style="font-family:arial,sans-serif;font-size:13px">
<br>
</div>
<div style="font-family:arial,sans-serif;font-size:13px">Thanks!</div>
<div style="font-family:arial,sans-serif;font-size:13px">Will</div>
</div>
</blockquote>
</div>
</div>
</blockquote>
<br>
<br></div></div>
Stuff off my <a href="http://people.redhat.com" target="_blank">people.redhat.com</a> page is just scratch space I use for
my own purposes -- demos, builds, etc. *Definitely* don't trust
content from there as it's usually a clone of my (often broke) local
git tree. And often outdated. Speaking of which, I need to drop in a
norobots file....<br>
<br>
As for this OVAL, it appears to have been fixed on 18-SEPT:<br>
<a href="https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/RHEL6/input/checks/accounts_minimum_age_login_defs.xml?id=8e56c6960f71c1fed1cfa7e1fafed382ce2c1d87" target="_blank">https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/RHEL6/input/checks/accounts_minimum_age_login_defs.xml?id=8e56c6960f71c1fed1cfa7e1fafed382ce2c1d87</a><br>
<br>
Should be reflected in next RPM update<br>
<br>
<br>
</div>
<br>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></blockquote></div><br></div>