<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">That's good to know. I just cribbed off
      of the way the pam matching patterns did it. For example:<br>
      <br>
      &lt;ind:pattern operation="pattern
match"&gt;^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so.*deny=([0-9]*).*$&lt;/ind:pattern&gt;<br>
      <br>
      On 5/19/14 3:53 PM, Andrew Gilmore wrote:<br>
    </div>
    <blockquote
cite="mid:CAD1s7uzOT=QLcCfZvVeaNFkGqDcQv08G+8y_Yw8PpGJU=q+wmA@mail.gmail.com"
      type="cite">
      <pre wrap="">NACK on nit-picky RE issues...

I believe it is sufficient to only make the surrounding subpattern
non-matchable...
(?:hard|-)
instead of
(?:(?:hard)|(?:-))

I actually had success with no subpattern at all:
hard|-
but I'm not clear why.

Good catch though, I was about to put my patch for this one up. :)

On Mon, May 19, 2014 at 1:44 PM, Paul Tittle <a class="moz-txt-link-rfc2396E" href="mailto:ptittle@cmf.nrl.navy.mil">&lt;ptittle@cmf.nrl.navy.mil&gt;</a>wrote:

</pre>
      <blockquote type="cite">
        <pre wrap="">---
 .../accounts_max_concurrent_login_sessions.xml     |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git
a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
index b08faa5..868c58e 100644
--- a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
+++ b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
@@ -21,7 +21,7 @@

   &lt;ind:textfilecontent54_object
id="object_etc_security_limits_conf_maxlogins" version="1"&gt;
     &lt;ind:filepath&gt;/etc/security/limits.conf&lt;/ind:filepath&gt;
-    &lt;ind:pattern operation="pattern
match"&gt;^[\s]*\*[\s]+[hard|-][\s]+maxlogins[\s]+(\d+)\s*$&lt;/ind:pattern&gt;
+    &lt;ind:pattern operation="pattern
match"&gt;^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$&lt;/ind:pattern&gt;
     &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
   &lt;/ind:textfilecontent54_object&gt;

--
1.7.1

_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>

</pre>
      </blockquote>
      <pre wrap="">
</pre>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
    </blockquote>
    <br>
  </body>
</html>