<div dir="ltr">Thanks Shawn<div>I&#39;ll grab the RPM when you get it done and diff it against my xml (I have my own custom rpm for deploying a PCI-DSS standard based on the server profile)  </div><div>Thanks for all the work on this too.  this goes a long way towards helping me get compliancy reports!</div>
<div><br></div><div>Will</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Oct 24, 2013 at 1:54 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000"><div><div class="h5">
    <div>On 10/24/13, 1:51 PM, Shawn Wells
      wrote:<br>
    </div>
    <blockquote type="cite">
      <div>On 10/24/13, 1:29 PM, Jeff Bachtel
        wrote:<br>
      </div>
      <blockquote type="cite">
        <div dir="ltr">Will,
          <div><br>
          </div>
          <div>I&#39;m seeing the same failures using SCC 3.1 (which is
            DISA&#39;s packaging of SSG). I suspect a profile problem
            (leading to improper external variables possibly being set).
            What happens when you run the test with profile <span style="font-size:13px;background-color:rgb(247,247,247)">stig-rhel6-server

              ?</span></div>
          <div><span style="font-size:13px;background-color:rgb(247,247,247)"><br>
            </span></div>
          <div><span style="font-size:13px;background-color:rgb(247,247,247)">Actually,

              checking </span><font color="#000000">/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

              the &quot;server&quot; profile specifies</font></div>
          <div><font color="#000000">&lt;refine-value
              idref=&quot;var_password_min_age&quot; selector=&quot;7&quot;/&gt; so that&#39;s
              the minimum acceptable with the profile you&#39;re using.<br>
            </font></div>
          <div><font color="#000000"><br>
            </font></div>
          <div><font color="#000000">But thanks for the email, now I
              have an idea what might be goobering up on SCC...</font></div>
          <div><font color="#000000"><br>
            </font></div>
          <div><font color="#000000">Jeff</font></div>
          <div><font color="#000000"><br>
            </font></div>
        </div>
        <div class="gmail_extra"><br>
          <br>
          <div class="gmail_quote">On Thu, Oct 24, 2013 at 11:40 AM,
            wm-lists <span dir="ltr">&lt;<a href="mailto:wm-lists@nixpeeps.com" target="_blank">wm-lists@nixpeeps.com</a>&gt;</span>
            wrote:<br>
            <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
              <div dir="ltr">
                <div style="font-family:arial,sans-serif;font-size:13px">I&#39;m

                  using scap-security-guide-0.1-12.el6.noarch as my
                  source from </div>
                <div style="font-family:arial,sans-serif;font-size:13px"><br>
                </div>
                <div style="font-family:arial,sans-serif;font-size:13px">
                  <a href="http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/" target="_blank">http://people.redhat.com/swells/scap-security-guide/rpmbuild/src/redhat/RPMS/noarch/</a><br>

                </div>
                <div style="font-family:arial,sans-serif;font-size:13px">
                  <br>
                </div>
                <div style="font-family:arial,sans-serif;font-size:13px">Running oscap

                  xccdf eval --profile server
                  /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml</div>
                <div style="font-family:arial,sans-serif;font-size:13px">
                  Generates a failure for </div>
                <div style="font-family:arial,sans-serif;font-size:13px">
                  <div>Title   Set Password Minimum Age</div>
                  <div>Rule    password_min_age</div>
                  <div>Ident   CCE-27013-2</div>
                  <div>Result  fail</div>
                  <div> <br>
                  </div>
                  <div>Title   Set Password Maximum Age</div>
                  <div>Rule    password_max_age</div>
                  <div>Ident   CCE-26985-2</div>
                  <div>Result  fail</div>
                </div>
                <div style="font-family:arial,sans-serif;font-size:13px"><br>
                </div>
                <div style="font-family:arial,sans-serif;font-size:13px">
                  <div>Title   Set Password Strength Minimum Uppercase
                    Characters</div>
                  <div>Rule    password_require_uppercases</div>
                  <div>Ident   CCE-26601-5</div>
                  <div>Result  fail</div>
                  <div><br>
                  </div>
                  <div>Title   Set Password Strength Minimum Special
                    Characters</div>
                  <div>Rule    password_require_specials</div>
                  <div>Ident   CCE-26409-3</div>
                  <div>Result  fail</div>
                  <div><br>
                  </div>
                  <div>Title   Set Password Strength Minimum Lowercase
                    Characters</div>
                  <div>Rule    password_require_lowercases</div>
                  <div>Ident   CCE-26631-2</div>
                  <div>Result  fail</div>
                </div>
                <div style="font-family:arial,sans-serif;font-size:13px"><br>
                </div>
                <div style="font-family:arial,sans-serif;font-size:13px">Among

                  others.  </div>
                <div style="font-family:arial,sans-serif;font-size:13px">
                  I have cracklib configured what I believe is correct
                  (according to the CCE)</div>
                <div style="font-family:arial,sans-serif;font-size:13px">
                  <div># grep cracklib /etc/pam.d/system-auth-ac</div>
                  <div>password    requisite     pam_cracklib.so
                    dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4
                    try_first_pass retry=3 minlen=14 type=</div>
                </div>
                <div style="font-family:arial,sans-serif;font-size:13px">
                  <div># grep PASS /etc/login.defs</div>
                  <div><br>
                  </div>
                  <div>PASS_MAX_DAYS   180</div>
                  <div>PASS_MIN_DAYS   1</div>
                  <div>PASS_MIN_LEN    14</div>
                  <div>PASS_WARN_AGE   7</div>
                </div>
                <div style="font-family:arial,sans-serif;font-size:13px"><br>
                </div>
                <div style="font-family:arial,sans-serif;font-size:13px">Any

                  help on what I might be missing here? </div>
                <div style="font-family:arial,sans-serif;font-size:13px">
                  <br>
                </div>
                <div style="font-family:arial,sans-serif;font-size:13px">Thanks!</div>
                <div style="font-family:arial,sans-serif;font-size:13px">Will</div>
              </div>
            </blockquote>
          </div>
        </div>
      </blockquote>
      <br>
      <br>
      Stuff off my <a href="http://people.redhat.com" target="_blank">people.redhat.com</a> page is just scratch space I use
      for my own purposes -- demos, builds, etc. *Definitely* don&#39;t
      trust content from there as it&#39;s usually a clone of my (often
      broke) local git tree. And often outdated. Speaking of which, I
      need to drop in a norobots file....<br>
      <br>
      As for this OVAL, it appears to have been fixed on 18-SEPT:<br>
      <a href="https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/RHEL6/input/checks/accounts_minimum_age_login_defs.xml?id=8e56c6960f71c1fed1cfa7e1fafed382ce2c1d87" target="_blank">https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/RHEL6/input/checks/accounts_minimum_age_login_defs.xml?id=8e56c6960f71c1fed1cfa7e1fafed382ce2c1d87</a><br>

      <br>
      Should be reflected in next RPM update<br>
      <br>
    </blockquote>
    <br></div></div>
    Cutting an updated RPM now. Give me a few minutes to generate the
    RPM and put some release notes together. If you need to test *now*,
    clone from source:<br>
    <a href="https://fedorahosted.org/scap-security-guide/wiki/downloads" target="_blank">https://fedorahosted.org/scap-security-guide/wiki/downloads</a><br>
  </div>

<br>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></blockquote></div><br></div>