<div dir="ltr"><div>I&#39;ve always thought that the week long lockouts were also silly.<br><br></div><div>15 minutes will deter pretty much anyone.<br><br></div><div>Trevor</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jul 27, 2015 at 8:10 AM, Shaw, Ray V CTR USARMY ARL (US) <span dir="ltr">&lt;<a href="mailto:ray.v.shaw.ctr@mail.mil" target="_blank">ray.v.shaw.ctr@mail.mil</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">With the other password complexity requirements, week-long lockouts after 3 failed attempts, and changes every 60 days, the requirement is rather excessive (and asking for people to not be able to remember their password, and we know what that means).<br>
<br>
Fortunately, we can use PKI for most things these days...except, ahem, Red Hat Satellite Server.<br>
<br>
--Ray<br>
<div><div class="h5"><br>
-----Original Message-----<br>
From: <a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a> [mailto:<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a>] On Behalf Of Leam Hall<br>
Sent: Saturday, July 25, 2015 8:00 PM<br>
To: SCAP Security Guide &lt;<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>&gt;<br>
Subject: Re: difok value in stig-rhel7-server-upstream profile<br>
<br>
No kidding. I know there are smart people at DISA, but the general output seems to be from people who don&#39;t actually use computers or follow their own rules.<br>
<br>
Leam<br>
<br>
On 07/25/15 19:56, Trevor Vaughan wrote:<br>
&gt; Interesting. Not looking forward to the backlash on implementing that one.<br>
&gt;<br>
&gt; Trevor<br>
&gt;<br>
&gt; On Fri, Jul 24, 2015 at 2:56 PM, Shawn Wells &lt;<a href="mailto:shawn@redhat.com">shawn@redhat.com</a><br>
&gt; &lt;mailto:<a href="mailto:shawn@redhat.com">shawn@redhat.com</a>&gt;&gt; wrote:<br>
&gt;<br>
&gt;     Unfortunately, DISA now requires that 15 of the characters differ<br>
&gt;     between passwords.<br>
&gt;<br>
&gt;     Ref: <a href="https://github.com/OpenSCAP/scap-security-guide/issues/91" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/issues/91</a><br>
&gt;<br>
&gt;     Awkwardly citing the same requirement (SRG-OS-000072), of which the<br>
&gt;     full text is:<br>
&gt;<br>
&gt;         The operating system must require the change of at least 15 of<br>
&gt;         the total number of characters when passwords are changed.<br>
&gt;<br>
&gt;         If the operating system allows the user to consecutively reuse<br>
&gt;         extensive portions of passwords, this increases the chances of<br>
&gt;         password compromise by increasing the window of opportunity for<br>
&gt;         attempts at guessing and brute-force attacks.<br>
&gt;<br>
&gt;         The number of changed characters refers to the number of changes<br>
&gt;         required with respect to the total number of positions in the<br>
&gt;         current password. In other words, characters may be the same<br>
&gt;         within the two passwords; however, the positions of the like<br>
&gt;         characters must be different.<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;     On 7/24/15 2:44 PM, Arnold, Paul C CTR USARMY PEO STRI (US) wrote:<br>
&gt;<br>
&gt;         The DoD states 50% of the minimum password length, which rounds<br>
&gt;         up to 8 and coincides with OS-SRG v1r2 (SRG-OS-000072). The SSG<br>
&gt;         also applies to systems outside the DoD, which may dictate some<br>
&gt;         initial/default rules.<br>
&gt;<br>
&gt;         However, 15 seems to be too high for a default parameter.<br>
&gt;<br>
&gt;         Regards,<br>
&gt;         --<br>
&gt;         Paul C. Arnold<br>
&gt;         IT Systems Engineer<br>
&gt;         Cole Engineering Services, Inc.<br>
&gt;<br>
&gt;         ________________________________________<br>
&gt;         From: <a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a><br>
&gt;         &lt;mailto:<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a>&gt;<br>
&gt;         [<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a><br>
&gt;         &lt;mailto:<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a>&gt;] on<br>
&gt;         behalf of Shaw, Ray V CTR USARMY ARL (US)<br>
&gt;         [<a href="mailto:ray.v.shaw.ctr@mail.mil">ray.v.shaw.ctr@mail.mil</a> &lt;mailto:<a href="mailto:ray.v.shaw.ctr@mail.mil">ray.v.shaw.ctr@mail.mil</a>&gt;]<br>
&gt;         Sent: Friday, July 24, 2015 02:30 PM<br>
&gt;         To: scap-security-guide<br>
&gt;         ‎[<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
&gt;         &lt;mailto:<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>&gt;]‎<br>
&gt;         Subject: difok value in stig-rhel7-server-upstream profile<br>
&gt;<br>
&gt;         RHEL/7/input/profiles/stig-rhel7-server-upstream.xml has the<br>
&gt;         following:<br>
&gt;<br>
&gt;         &lt;refine-value idref=&quot;var_password_pam_difok&quot; selector=&quot;15&quot; /&gt;<br>
&gt;<br>
&gt;         Should this be changed from 15 to 4?  The help text indicates<br>
&gt;         that the DoD requirement is 4, and other documentation seems to<br>
&gt;         support this.<br>
&gt;<br>
&gt;         --<br>
&gt;         Ray Shaw (Contractor, STG)<br>
&gt;         Army Research Laboratory<br>
&gt;         CISD, Unix Support<br>
&gt;         --<br>
&gt;         SCAP Security Guide mailing list<br>
&gt;         <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
&gt;         &lt;mailto:<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>&gt;<br>
&gt;         <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
&gt;         <a href="https://github.com/OpenSCAP/scap-security-guide/" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
&gt;<br>
&gt;<br>
&gt;     --<br>
&gt;     Shawn Wells<br>
&gt;     Director, Innovation Programs<br>
</div></div>&gt;     <a href="mailto:shawn@redhat.com">shawn@redhat.com</a> &lt;mailto:<a href="mailto:shawn@redhat.com">shawn@redhat.com</a>&gt; | <a href="tel:443.534.0130" value="+14435340130">443.534.0130</a><br>
&gt;     &lt;tel:<a href="tel:443.534.0130" value="+14435340130">443.534.0130</a>&gt;<br>
<span class="im HOEnZb">&gt;     @shawndwells<br>
&gt;<br>
&gt;     --<br>
&gt;     SCAP Security Guide mailing list<br>
&gt;     <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
&gt;     &lt;mailto:<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>&gt;<br>
&gt;     <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
&gt;     <a href="https://github.com/OpenSCAP/scap-security-guide/" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; --<br>
&gt; Trevor Vaughan<br>
&gt; Vice President, Onyx Point, Inc<br>
</span><div class="HOEnZb"><div class="h5">&gt; <a href="tel:%28410%29%20541-6699" value="+14105416699">(410) 541-6699</a><br>
&gt;<br>
&gt; -- This account not approved for unencrypted proprietary information<br>
&gt; --<br>
&gt;<br>
&gt;<br>
<br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr"><div>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><br>-- This account not approved for unencrypted proprietary information --</div></div></div>
</div>