<div dir="ltr">NACK on nit-picky RE issues...<div><br></div><div>I believe it is sufficient to only make the surrounding subpattern non-matchable...</div><div><span style="font-family:arial,sans-serif;font-size:12.666666984558105px">(?:</span><span style="font-family:arial,sans-serif;font-size:12.666666984558105px">hard|-)</span><br>

</div><div><span style="font-family:arial,sans-serif;font-size:12.666666984558105px">instead of</span></div><div><span style="font-family:arial,sans-serif;font-size:12.666666984558105px">(?:(?:</span><span style="font-family:arial,sans-serif;font-size:12.666666984558105px">hard)|(?:-))</span><br>

</div><div><br></div><div class="gmail_extra">I actually had success with no subpattern at all:</div><div class="gmail_extra">hard|-</div><div class="gmail_extra">but I&#39;m not clear why.</div><div class="gmail_extra">
<br>
</div><div class="gmail_extra">Good catch though, I was about to put my patch for this one up. :)<br><br><div class="gmail_quote">On Mon, May 19, 2014 at 1:44 PM, Paul Tittle <span dir="ltr">&lt;<a href="mailto:ptittle@cmf.nrl.navy.mil" target="_blank">ptittle@cmf.nrl.navy.mil</a>&gt;</span> wrote:<br>

<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">---<br>
 .../accounts_max_concurrent_login_sessions.xml     |    2 +-<br>
 1 files changed, 1 insertions(+), 1 deletions(-)<br>
<br>
diff --git a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml<br>
index b08faa5..868c58e 100644<br>
--- a/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml<br>
+++ b/RHEL/6/input/checks/accounts_max_concurrent_login_sessions.xml<br>
@@ -21,7 +21,7 @@<br>
<br>
   &lt;ind:textfilecontent54_object id=&quot;object_etc_security_limits_conf_maxlogins&quot; version=&quot;1&quot;&gt;<br>
     &lt;ind:filepath&gt;/etc/security/limits.conf&lt;/ind:filepath&gt;<br>
-    &lt;ind:pattern operation=&quot;pattern match&quot;&gt;^[\s]*\*[\s]+[hard|-][\s]+maxlogins[\s]+(\d+)\s*$&lt;/ind:pattern&gt;<br>
+    &lt;ind:pattern operation=&quot;pattern match&quot;&gt;^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$&lt;/ind:pattern&gt;<br>
     &lt;ind:instance datatype=&quot;int&quot;&gt;1&lt;/ind:instance&gt;<br>
   &lt;/ind:textfilecontent54_object&gt;<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
1.7.1<br>
<br>
_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
</font></span></blockquote></div><br></div></div>