<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">That's good to know. I just cribbed off
of the way the pam matching patterns did it. For example:<br>
<br>
<ind:pattern operation="pattern
match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so.*deny=([0-9]*).*$</ind:pattern><br>
<br>
On 5/19/14 3:53 PM, Andrew Gilmore wrote:<br>
</div>
<blockquote
cite="mid:CAD1s7uzOT=QLcCfZvVeaNFkGqDcQv08G+8y_Yw8PpGJU=q+wmA@mail.gmail.com"
type="cite">
<pre wrap="">NACK on nit-picky RE issues...
I believe it is sufficient to only make the surrounding subpattern
non-matchable...
(?:hard|-)
instead of
(?:(?:hard)|(?:-))
I actually had success with no subpattern at all:
hard|-
but I'm not clear why.
Good catch though, I was about to put my patch for this one up. :)
On Mon, May 19, 2014 at 1:44 PM, Paul Tittle <a class="moz-txt-link-rfc2396E" href="mailto:ptittle@cmf.nrl.navy.mil"><ptittle@cmf.nrl.navy.mil></a>wrote:
</pre>
<blockquote type="cite">
<pre wrap="">---
.../accounts_max_concurrent_login_sessions.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git
a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
index b08faa5..868c58e 100644
--- a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
+++ b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml
@@ -21,7 +21,7 @@
<ind:textfilecontent54_object
id="object_etc_security_limits_conf_maxlogins" version="1">
<ind:filepath>/etc/security/limits.conf</ind:filepath>
- <ind:pattern operation="pattern
match">^[\s]*\*[\s]+[hard|-][\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
+ <ind:pattern operation="pattern
match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
--
1.7.1
_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
scap-security-guide mailing list
<a class="moz-txt-link-abbreviated" href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>
<a class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
</pre>
</blockquote>
<br>
</body>
</html>