<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/12/13, 10:38 PM, Frank Caviggia
wrote:<br>
</div>
<blockquote cite="mid:20131113033816.GA10244@mail.corp.redhat.com"
type="cite">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">Shawn,
This should be a little bit better of a match to what you wanted for the password use remediation.
-Frank
</pre>
</div>
<br>
<fieldset class="mimeAttachmentHeader"><legend
class="mimeAttachmentHeaderName">0001-accounts_password_reuse_limit.sh-remediation.patch</legend></fieldset>
<br>
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 12px;"
lang="x-western">
<pre wrap="">From c6bd643edc3f9504172225d6a0fce9771a6e1a77 Mon Sep 17 00:00:00 2001
From: Frank Caviggia <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:fcaviggi@redhat.com"><fcaviggi@redhat.com></a>
Date: Tue, 12 Nov 2013 22:35:19 -0500
Subject: [PATCH] accounts_password_reuse_limit.sh remediation
Signed-off-by: Frank Caviggia <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:fcaviggi@redhat.com"><fcaviggi@redhat.com></a>
---
RHEL6/input/fixes/bash/accounts_password_reuse_limit.sh | 8 ++++++++
1 file changed, 8 insertions(+)
create mode 100644 RHEL6/input/fixes/bash/accounts_password_reuse_limit.sh
diff --git a/RHEL6/input/fixes/bash/accounts_password_reuse_limit.sh b/RHEL6/input/fixes/bash/accounts_password_reuse_limit.sh
new file mode 100644
index 0000000..e278e54
--- /dev/null
+++ b/RHEL6/input/fixes/bash/accounts_password_reuse_limit.sh
@@ -0,0 +1,8 @@
+source ./templates/support.sh
+populate var_password_history_retain_limit
+
+if [ `grep -c 'remember=' /etc/pam.d/system-auth` -eq 0 ]; then
+        sed 's/^\s*password.*pam_unix\.so.*/& remember=$var_password_history_retain_limit/' /etc/pam.d/system-auth
+else
+        sed 's/remember=[0-9]*<i class="moz-txt-slash"><span class="moz-txt-tag">/</span>remember=$var_password_history_retain_limit<span class="moz-txt-tag">/</span></i>' /etc/pam.d/system-auth
+fi
<div class="moz-txt-sig">--
1.8.3.1
</div></pre>
</div>
</blockquote>
<br>
I quickly tested with system-auth containing, and not, remember=.
This is a great start!<br>
<br>
Three things remain:<br>
<br>
- sed -i ;)<br>
<br>
- The variable isn't being expanded when the script is ran, I get:<br>
<blockquote type="cite"># bash accounts_password_reuse_limit.sh <br>
.......<br>
password sufficient pam_unix.so sha512 shadow try_first_pass
use_authtok remember=$var_password_history_retain_limit<br>
password sufficient pam_sss.so use_authtok</blockquote>
<br>
- What if "password pam_unix.so" isn't present?<br>
</body>
</html>