<div dir="ltr">yes mine is different since we use sssd for authentication, the placement of the cracklib is the same though.  Switching to your cracklib values, actually caused me to fail more of the categories<div><div>auth        required      pam_env.so</div>
<div>auth        sufficient    pam_unix.so try_first_pass</div><div>auth        requisite     pam_succeed_if.so uid &gt;= 500 quiet</div><div>auth        sufficient    pam_sss.so use_first_pass</div><div>auth        [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900</div>
<div>auth        required      pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900</div><div>auth        required      pam_deny.so</div><div><br></div><div>account     required      pam_unix.so</div><div>
account     sufficient    pam_localuser.so</div><div>account     sufficient    pam_succeed_if.so uid &lt; 500 quiet</div><div>account     [default=bad success=ok user_unknown=ignore] pam_sss.so</div><div>account     required      pam_permit.so</div>
<div><br></div><div>password    requisite     pam_cracklib.so try_first_pass retry=3 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4</div><div>password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok remember=5</div>
<div>password    sufficient    pam_sss.so use_authtok</div><div>password    required      pam_deny.so</div><div><br></div><div>session     optional      pam_keyinit.so revoke</div><div>session     required      pam_limits.so</div>
<div>session     optional      pam_oddjob_mkhomedir.so</div><div>session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid</div><div>session     required      pam_unix.so</div><div>session     optional      pam_sss.so</div>
</div><div><br></div><div>I grabbed the zipfile this morning and used it </div><div><div>&lt;Benchmark xmlns=&quot;<a href="http://checklists.nist.gov/xccdf/1.1">http://checklists.nist.gov/xccdf/1.1</a>&quot; xmlns:xsi=&quot;<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>&quot; id=&quot;RHEL-6&quot; resolved=&quot;1&quot; xml:lang=&quot;en-US&quot;&gt;</div>
<div>  &lt;status date=&quot;2013-10-24&quot;&gt;draft&lt;/status&gt;</div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Oct 24, 2013 at 8:22 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 10/24/13, 2:40 PM, wm-lists wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
still getting the same result..<br>
oscap xccdf eval --report /var/www/html/report.html  --profile server /usr/share/xml/scap/ssg/<u></u>content/ssg-rhel6-xccdf.xml<br>
<br>
&lt;Benchmark xmlns=&quot;<a href="http://checklists.nist.gov/xccdf/1.1" target="_blank">http://checklists.nist.<u></u>gov/xccdf/1.1</a>&quot; xmlns:xsi=&quot;<a href="http://www.w3.org/2001/XMLSchema-instance" target="_blank">http://www.w3.org/<u></u>2001/XMLSchema-instance</a>&quot; id=&quot;RHEL-6&quot; resolved=&quot;1&quot; xml:lang=&quot;en-US&quot;&gt;<br>

  &lt;status date=&quot;2013-10-22&quot;&gt;draft&lt;/<u></u>status&gt;<br>
<br>
<br>
Title   Set Password Strength Minimum Uppercase Characters<br>
Rule    password_require_uppercases<br>
Ident   CCE-26601-5<br>
Result  fail<br>
<br>
Title   Set Password Strength Minimum Special Characters<br>
Rule    password_require_specials<br>
Ident   CCE-26409-3<br>
Result  fail<br>
<br>
Title   Set Password Strength Minimum Lowercase Characters<br>
Rule    password_require_lowercases<br>
Ident   CCE-26631-2<br>
Result  fail<br>
</blockquote>
<br></div>
These XCCDF names reflect nomenclature from prior releases ;)  Try rebasing via yum update or &#39;git pull&#39; the latest source -- is it still happening?<br>
<br>
In case you&#39;re still failing here&#39;s my /etc/pam.d/system-auth (which passes the checks).... is something different in yours?<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
auth        required      pam_env.so<br>
auth        sufficient    pam_fprintd.so<br>
auth        sufficient    pam_unix.so  try_first_pass<br>
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900<br>
auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900<br>
auth        requisite     pam_succeed_if.so uid &gt;= 500 quiet<br>
auth        required      pam_deny.so<br>
<br>
account     required      pam_unix.so<br>
account     sufficient    pam_localuser.so<br>
account     sufficient    pam_succeed_if.so uid &lt; 500 quiet<br>
account     required      pam_permit.so<br>
<br>
password    requisite     pam_cracklib.so try_first_pass retry=5 type= ucredit=-1 lcredit=-1 ocredit=-1<br>
password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok<br>
password    required      pam_deny.so<br>
<br>
session     optional      pam_keyinit.so revoke<br>
session     required      pam_limits.so<br>
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid<br>
session     required      pam_unix.so<br>
</blockquote><div class="HOEnZb"><div class="h5">
<br>
______________________________<u></u>_________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.<u></u>fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/scap-<u></u>security-guide</a><br>
</div></div></blockquote></div><br></div>