<div dir="ltr"><div>I've always thought that the week long lockouts were also silly.<br><br></div><div>15 minutes will deter pretty much anyone.<br><br></div><div>Trevor</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jul 27, 2015 at 8:10 AM, Shaw, Ray V CTR USARMY ARL (US) <span dir="ltr"><<a href="mailto:ray.v.shaw.ctr@mail.mil" target="_blank">ray.v.shaw.ctr@mail.mil</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">With the other password complexity requirements, week-long lockouts after 3 failed attempts, and changes every 60 days, the requirement is rather excessive (and asking for people to not be able to remember their password, and we know what that means).<br>
<br>
Fortunately, we can use PKI for most things these days...except, ahem, Red Hat Satellite Server.<br>
<br>
--Ray<br>
<div><div class="h5"><br>
-----Original Message-----<br>
From: <a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a> [mailto:<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a>] On Behalf Of Leam Hall<br>
Sent: Saturday, July 25, 2015 8:00 PM<br>
To: SCAP Security Guide <<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>><br>
Subject: Re: difok value in stig-rhel7-server-upstream profile<br>
<br>
No kidding. I know there are smart people at DISA, but the general output seems to be from people who don't actually use computers or follow their own rules.<br>
<br>
Leam<br>
<br>
On 07/25/15 19:56, Trevor Vaughan wrote:<br>
> Interesting. Not looking forward to the backlash on implementing that one.<br>
><br>
> Trevor<br>
><br>
> On Fri, Jul 24, 2015 at 2:56 PM, Shawn Wells <<a href="mailto:shawn@redhat.com">shawn@redhat.com</a><br>
> <mailto:<a href="mailto:shawn@redhat.com">shawn@redhat.com</a>>> wrote:<br>
><br>
> Unfortunately, DISA now requires that 15 of the characters differ<br>
> between passwords.<br>
><br>
> Ref: <a href="https://github.com/OpenSCAP/scap-security-guide/issues/91" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/issues/91</a><br>
><br>
> Awkwardly citing the same requirement (SRG-OS-000072), of which the<br>
> full text is:<br>
><br>
> The operating system must require the change of at least 15 of<br>
> the total number of characters when passwords are changed.<br>
><br>
> If the operating system allows the user to consecutively reuse<br>
> extensive portions of passwords, this increases the chances of<br>
> password compromise by increasing the window of opportunity for<br>
> attempts at guessing and brute-force attacks.<br>
><br>
> The number of changed characters refers to the number of changes<br>
> required with respect to the total number of positions in the<br>
> current password. In other words, characters may be the same<br>
> within the two passwords; however, the positions of the like<br>
> characters must be different.<br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
> On 7/24/15 2:44 PM, Arnold, Paul C CTR USARMY PEO STRI (US) wrote:<br>
><br>
> The DoD states 50% of the minimum password length, which rounds<br>
> up to 8 and coincides with OS-SRG v1r2 (SRG-OS-000072). The SSG<br>
> also applies to systems outside the DoD, which may dictate some<br>
> initial/default rules.<br>
><br>
> However, 15 seems to be too high for a default parameter.<br>
><br>
> Regards,<br>
> --<br>
> Paul C. Arnold<br>
> IT Systems Engineer<br>
> Cole Engineering Services, Inc.<br>
><br>
> ________________________________________<br>
> From: <a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a><br>
> <mailto:<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a>><br>
> [<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a><br>
> <mailto:<a href="mailto:scap-security-guide-bounces@lists.fedorahosted.org">scap-security-guide-bounces@lists.fedorahosted.org</a>>] on<br>
> behalf of Shaw, Ray V CTR USARMY ARL (US)<br>
> [<a href="mailto:ray.v.shaw.ctr@mail.mil">ray.v.shaw.ctr@mail.mil</a> <mailto:<a href="mailto:ray.v.shaw.ctr@mail.mil">ray.v.shaw.ctr@mail.mil</a>>]<br>
> Sent: Friday, July 24, 2015 02:30 PM<br>
> To: scap-security-guide<br>
> [<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
> <mailto:<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>>]<br>
> Subject: difok value in stig-rhel7-server-upstream profile<br>
><br>
> RHEL/7/input/profiles/stig-rhel7-server-upstream.xml has the<br>
> following:<br>
><br>
> <refine-value idref="var_password_pam_difok" selector="15" /><br>
><br>
> Should this be changed from 15 to 4? The help text indicates<br>
> that the DoD requirement is 4, and other documentation seems to<br>
> support this.<br>
><br>
> --<br>
> Ray Shaw (Contractor, STG)<br>
> Army Research Laboratory<br>
> CISD, Unix Support<br>
> --<br>
> SCAP Security Guide mailing list<br>
> <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
> <mailto:<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>><br>
> <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
> <a href="https://github.com/OpenSCAP/scap-security-guide/" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
><br>
><br>
> --<br>
> Shawn Wells<br>
> Director, Innovation Programs<br>
</div></div>> <a href="mailto:shawn@redhat.com">shawn@redhat.com</a> <mailto:<a href="mailto:shawn@redhat.com">shawn@redhat.com</a>> | <a href="tel:443.534.0130" value="+14435340130">443.534.0130</a><br>
> <tel:<a href="tel:443.534.0130" value="+14435340130">443.534.0130</a>><br>
<span class="im HOEnZb">> @shawndwells<br>
><br>
> --<br>
> SCAP Security Guide mailing list<br>
> <a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
> <mailto:<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a>><br>
> <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
> <a href="https://github.com/OpenSCAP/scap-security-guide/" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
><br>
><br>
><br>
><br>
> --<br>
> Trevor Vaughan<br>
> Vice President, Onyx Point, Inc<br>
</span><div class="HOEnZb"><div class="h5">> <a href="tel:%28410%29%20541-6699" value="+14105416699">(410) 541-6699</a><br>
><br>
> -- This account not approved for unencrypted proprietary information<br>
> --<br>
><br>
><br>
<br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br>
--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" rel="noreferrer" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" rel="noreferrer" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr"><div>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><br>-- This account not approved for unencrypted proprietary information --</div></div></div>
</div>