<div dir="ltr"><div>If this is accepted syntax for our checks, then so be it. Do you have a preference? If you are comfortable with your patch as submitted, then consider it ack&#39;d.</div><div><br></div><div><br></div><div>

On a separate note, I&#39;m getting mail loop errors sending to the list, but then my emails seem to be getting through?<br></div><div><br></div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">

<div class="" style="font-family:arial,sans-serif;font-size:12.666666984558105px"><div class="im">This is the mail system at host <a href="http://lists.fedorahosted.org/" target="_blank">lists.fedorahosted.org</a>.<br><br>

I&#39;m sorry to have to inform you that your message could not<br>be delivered to one or more recipients. It&#39;s attached below.<br><br>For further assistance, please send mail to postmaster.<br><br>If you do so, please include this problem report. You can<br>

delete your own text from the attached returned message.<br><br>                   The mail system<br><br>&lt;<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>&gt;: mail forwarding loop for<br>

    <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br></div></div><div class="" style="font-family:arial,sans-serif;font-size:12.666666984558105px"><br></div><span style="font-family:arial,sans-serif;font-size:12.666666984558105px">Final-Recipient: rfc822; </span><a href="mailto:scap-security-guide@lists.fedorahosted.org" style="font-family:arial,sans-serif;font-size:12.666666984558105px">scap-security-guide@lists.fedorahosted.org</a><br style="font-family:arial,sans-serif;font-size:12.666666984558105px">

<span style="font-family:arial,sans-serif;font-size:12.666666984558105px">Action: failed</span><br style="font-family:arial,sans-serif;font-size:12.666666984558105px"><span style="font-family:arial,sans-serif;font-size:12.666666984558105px">Status: 5.4.6</span><br style="font-family:arial,sans-serif;font-size:12.666666984558105px">

<span style="font-family:arial,sans-serif;font-size:12.666666984558105px">Diagnostic-Code: X-Postfix; mail forwarding loop for</span><br style="font-family:arial,sans-serif;font-size:12.666666984558105px"><span style="font-family:arial,sans-serif;font-size:12.666666984558105px">    </span><a href="mailto:scap-security-guide@lists.fedorahosted.org" style="font-family:arial,sans-serif;font-size:12.666666984558105px">scap-security-guide@lists.fedorahosted.org</a><br style="font-family:arial,sans-serif;font-size:12.666666984558105px">

</blockquote><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, May 19, 2014 at 2:00 PM, Paul Tittle (Contractor) <span dir="ltr">&lt;<a href="mailto:ptittle@cmf.nrl.navy.mil" target="_blank">ptittle@cmf.nrl.navy.mil</a>&gt;</span> wrote:<br>

<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000">
    <div>That&#39;s good to know. I just cribbed off
      of the way the pam matching patterns did it. For example:<br>
      <br>
      &lt;ind:pattern operation=&quot;pattern
match&quot;&gt;^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so.*deny=([0-9]*).*$&lt;/ind:pattern&gt;<div><div class="h5"><br>
      <br>
      On 5/19/14 3:53 PM, Andrew Gilmore wrote:<br>
    </div></div></div><div><div class="h5">
    <blockquote type="cite">
      <pre>NACK on nit-picky RE issues...

I believe it is sufficient to only make the surrounding subpattern
non-matchable...
(?:hard|-)
instead of
(?:(?:hard)|(?:-))

I actually had success with no subpattern at all:
hard|-
but I&#39;m not clear why.

Good catch though, I was about to put my patch for this one up. :)

On Mon, May 19, 2014 at 1:44 PM, Paul Tittle <a href="mailto:ptittle@cmf.nrl.navy.mil" target="_blank">&lt;ptittle@cmf.nrl.navy.mil&gt;</a>wrote:

</pre>
      <blockquote type="cite">
        <pre>---
 .../accounts_max_concurrent_login_sessions.xml     |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git
a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
index b08faa5..868c58e 100644
--- a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
+++ b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
@@ -21,7 +21,7 @@

   &lt;ind:textfilecontent54_object
id=&quot;object_etc_security_limits_conf_maxlogins&quot; version=&quot;1&quot;&gt;
     &lt;ind:filepath&gt;/etc/security/limits.conf&lt;/ind:filepath&gt;
-    &lt;ind:pattern operation=&quot;pattern
match&quot;&gt;^[\s]*\*[\s]+[hard|-][\s]+maxlogins[\s]+(\d+)\s*$&lt;/ind:pattern&gt;
+    &lt;ind:pattern operation=&quot;pattern
match&quot;&gt;^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$&lt;/ind:pattern&gt;
     &lt;ind:instance datatype=&quot;int&quot;&gt;1&lt;/ind:instance&gt;
   &lt;/ind:textfilecontent54_object&gt;

--
1.7.1

_______________________________________________
scap-security-guide mailing list
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>

</pre>
      </blockquote>
      <pre></pre>
      <br>
      <fieldset></fieldset>
      <br>
      <pre>_______________________________________________
scap-security-guide mailing list
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
    </blockquote>
    <br>
  </div></div></div>

<br>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></blockquote></div><br></div>