<div dir="ltr">yes mine is different since we use sssd for authentication, the placement of the cracklib is the same though. Switching to your cracklib values, actually caused me to fail more of the categories<div><div>auth required pam_env.so</div>
<div>auth sufficient pam_unix.so try_first_pass</div><div>auth requisite pam_succeed_if.so uid >= 500 quiet</div><div>auth sufficient pam_sss.so use_first_pass</div><div>auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</div>
<div>auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</div><div>auth required pam_deny.so</div><div><br></div><div>account required pam_unix.so</div><div>
account sufficient pam_localuser.so</div><div>account sufficient pam_succeed_if.so uid < 500 quiet</div><div>account [default=bad success=ok user_unknown=ignore] pam_sss.so</div><div>account required pam_permit.so</div>
<div><br></div><div>password requisite pam_cracklib.so try_first_pass retry=3 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4</div><div>password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember=5</div>
<div>password sufficient pam_sss.so use_authtok</div><div>password required pam_deny.so</div><div><br></div><div>session optional pam_keyinit.so revoke</div><div>session required pam_limits.so</div>
<div>session optional pam_oddjob_mkhomedir.so</div><div>session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid</div><div>session required pam_unix.so</div><div>session optional pam_sss.so</div>
</div><div><br></div><div>I grabbed the zipfile this morning and used it </div><div><div><Benchmark xmlns="<a href="http://checklists.nist.gov/xccdf/1.1">http://checklists.nist.gov/xccdf/1.1</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" id="RHEL-6" resolved="1" xml:lang="en-US"></div>
<div> <status date="2013-10-24">draft</status></div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Oct 24, 2013 at 8:22 PM, Shawn Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 10/24/13, 2:40 PM, wm-lists wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
still getting the same result..<br>
oscap xccdf eval --report /var/www/html/report.html --profile server /usr/share/xml/scap/ssg/<u></u>content/ssg-rhel6-xccdf.xml<br>
<br>
<Benchmark xmlns="<a href="http://checklists.nist.gov/xccdf/1.1" target="_blank">http://checklists.nist.<u></u>gov/xccdf/1.1</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/<u></u>2001/XMLSchema-instance</a>" id="RHEL-6" resolved="1" xml:lang="en-US"><br>
<status date="2013-10-22">draft</<u></u>status><br>
<br>
<br>
Title Set Password Strength Minimum Uppercase Characters<br>
Rule password_require_uppercases<br>
Ident CCE-26601-5<br>
Result fail<br>
<br>
Title Set Password Strength Minimum Special Characters<br>
Rule password_require_specials<br>
Ident CCE-26409-3<br>
Result fail<br>
<br>
Title Set Password Strength Minimum Lowercase Characters<br>
Rule password_require_lowercases<br>
Ident CCE-26631-2<br>
Result fail<br>
</blockquote>
<br></div>
These XCCDF names reflect nomenclature from prior releases ;) Try rebasing via yum update or 'git pull' the latest source -- is it still happening?<br>
<br>
In case you're still failing here's my /etc/pam.d/system-auth (which passes the checks).... is something different in yours?<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
auth required pam_env.so<br>
auth sufficient pam_fprintd.so<br>
auth sufficient pam_unix.so try_first_pass<br>
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900<br>
auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900<br>
auth requisite pam_succeed_if.so uid >= 500 quiet<br>
auth required pam_deny.so<br>
<br>
account required pam_unix.so<br>
account sufficient pam_localuser.so<br>
account sufficient pam_succeed_if.so uid < 500 quiet<br>
account required pam_permit.so<br>
<br>
password requisite pam_cracklib.so try_first_pass retry=5 type= ucredit=-1 lcredit=-1 ocredit=-1<br>
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok<br>
password required pam_deny.so<br>
<br>
session optional pam_keyinit.so revoke<br>
session required pam_limits.so<br>
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid<br>
session required pam_unix.so<br>
</blockquote><div class="HOEnZb"><div class="h5">
<br>
______________________________<u></u>_________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.<u></u>fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/scap-<u></u>security-guide</a><br>
</div></div></blockquote></div><br></div>