4:26 p.m.
Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
.../checks/accounts_maximum_age_login_defs.xml | 26 ++++++++++-----
.../checks/accounts_minimum_age_login_defs.xml | 31 ++++++++++++-------
.../checks/accounts_password_minlen_login_defs.xml | 17 ++++------
.../accounts_password_warn_age_login_defs.xml | 32 ++++++++++++--------
4 files changed, 63 insertions(+), 43 deletions(-)
diff --git a/rhel6/src/input/checks/accounts_maximum_age_login_defs.xml
b/rhel6/src/input/checks/accounts_maximum_age_login_defs.xml
index c6333d1..10bc279 100644
--- a/rhel6/src/input/checks/accounts_maximum_age_login_defs.xml
+++ b/rhel6/src/input/checks/accounts_maximum_age_login_defs.xml
@@ -6,21 +6,29 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4092-3" source="CCE" />
- <description>The "maximum password age" policy should meet
- minimum requirements. This particular check looks for a
- maximum password age of 60 days.</description>
+ <description>The maximum password age policy should meet
+ minimum requirements.</description>
</metadata>
- <criteria comment="the value PASS_MAX_DAYS should be set to 60 in
/etc/login.defs">
- <criterion test_ref="test_pass_max_days_sixty" />
+ <criteria comment="the value PASS_MAX_DAYS should be set appropriately in
/etc/login.defs">
+ <criterion test_ref="test_pass_max_days" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" comment="the value
PASS_MAX_DAYS should be set to 60 in /etc/login.defs"
id="test_pass_max_days_sixty" version="1">
+
+ <ind:textfilecontent54_test check="all" comment="the value
PASS_MAX_DAYS should be set appropriately in /etc/login.defs"
id="test_pass_max_days" version="1">
<ind:object object_ref="object_etc_login_defs_pass_max" />
+ <ind:state state_ref="state_password_max_age" />
</ind:textfilecontent54_test>
+
<ind:textfilecontent54_object id="object_etc_login_defs_pass_max"
version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>login.defs</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*PASS_MAX_DAYS[\s]+60$</ind:pattern>
+ <ind:filepath>/etc/login.defs</ind:filepath>
+ <ind:pattern operation="pattern
match">^[\s]*PASS_MAX_DAYS[\s]+(\d+)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_password_max_age"
version="1">
+ <ind:subexpression operation="less than or equal"
var_ref="var_password_max_age" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="maximum password age" datatype="int"
id="var_password_max_age" version="1" />
+
</def-group>
diff --git a/rhel6/src/input/checks/accounts_minimum_age_login_defs.xml
b/rhel6/src/input/checks/accounts_minimum_age_login_defs.xml
index f5a89ce..0afa38b 100644
--- a/rhel6/src/input/checks/accounts_minimum_age_login_defs.xml
+++ b/rhel6/src/input/checks/accounts_minimum_age_login_defs.xml
@@ -6,21 +6,30 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4180-6" source="CCE" />
- <description>The "minimum password age" policy should meet
- minimum requirements. This particular check looks for a
- minimum password age of 7 days.</description>
+ <description>The minimum password age policy should be set
appropriately.</description>
</metadata>
- <criteria comment="the value PASS_MIN_DAYS should be set to 7 in
/etc/login.defs">
- <criterion test_ref="test_pass_min_days_seven" />
+ <criteria comment="the value PASS_MIN_DAYS should be set appropriately in
/etc/login.defs">
+ <criterion test_ref="test_pass_min_days" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" comment="the value
PASS_MIN_DAYS should be set to 7 in /etc/login.defs"
id="test_pass_min_days_seven" version="1">
- <ind:object object_ref="object_etc_login_defs_pass_min" />
+
+ <ind:textfilecontent54_test check="all"
+ comment="Tests the value of PASS_MIN_DAYS in /etc/login.defs"
+ id="test_pass_min_days" version="1">
+ <ind:object object_ref="object_etc_login_defs_pass_min_age" />
+ <ind:state state_ref="state_etc_login_defs_pass_min_age" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="object_etc_login_defs_pass_min"
version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>login.defs</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*PASS_MIN_DAYS[\s]+7$</ind:pattern>
+
+ <ind:textfilecontent54_object id="object_etc_login_defs_pass_min_age"
version="1">
+ <ind:filepath>/etc/login.defs</ind:filepath>
+ <ind:pattern operation="pattern
match">^[\s]*PASS_MIN_DAYS[\s]+(\d+)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_etc_login_defs_pass_min_age"
version="1">
+ <ind:subexpression operation="greater than or equal"
var_ref="var_password_min_age" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="minimum password age in days"
datatype="int" id="var_password_min_age" version="1" />
+
</def-group>
diff --git a/rhel6/src/input/checks/accounts_password_minlen_login_defs.xml
b/rhel6/src/input/checks/accounts_password_minlen_login_defs.xml
index 4f8ccdc..e8cd30b 100644
--- a/rhel6/src/input/checks/accounts_password_minlen_login_defs.xml
+++ b/rhel6/src/input/checks/accounts_password_minlen_login_defs.xml
@@ -7,8 +7,7 @@
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4154-1" source="CCE" />
- <description>The password minimum length should be set
- appropriately</description>
+ <description>The password minimum length should be set
appropriately.</description>
</metadata>
<criteria operator="AND">
<criterion test_ref="test_pam_minlen_set" />
@@ -27,23 +26,21 @@
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="object_pam_minlen_set"
version="1">
- <ind:path>/etc/pam.d</ind:path>
- <ind:filename>system-auth</ind:filename>
- <ind:pattern operation="pattern
match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*minlen=([0-9]*).*$</ind:pattern>
+ <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
+ <ind:pattern operation="pattern
match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_cracklib\.so.*minlen=(\d+).*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="object_etc_login_defs"
version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>login.defs</ind:filename>
- <ind:pattern operation="pattern
match">^PASS_MIN_LEN\s+([0-9]*)$</ind:pattern>
+ <ind:filepath>/etc/login.defs</ind:filepath>
+ <ind:pattern operation="pattern
match">^PASS_MIN_LEN\s+(\d+)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_state id="state_password_min_len"
version="1">
- <ind:subexpression operation="equals" var_check="all"
var_ref="var_password_min_len" />
+ <ind:subexpression operation="greater than or equal"
var_ref="var_password_min_len" />
</ind:textfilecontent54_state>
- <external_variable comment="password minimum length"
datatype="string" id="var_password_min_len" version="1"
/>
+ <external_variable comment="password minimum length"
datatype="int" id="var_password_min_len" version="1" />
</def-group>
diff --git a/rhel6/src/input/checks/accounts_password_warn_age_login_defs.xml
b/rhel6/src/input/checks/accounts_password_warn_age_login_defs.xml
index bea68d2..1c6a24d 100644
--- a/rhel6/src/input/checks/accounts_password_warn_age_login_defs.xml
+++ b/rhel6/src/input/checks/accounts_password_warn_age_login_defs.xml
@@ -1,30 +1,36 @@
<def-group>
- <definition class="compliance"
- id="accounts_password_warn_age_login_defs" version="1">
+ <definition class="compliance"
id="accounts_password_warn_age_login_defs" version="1">
<metadata>
<title>Set Password Expiration Parameters</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<reference ref_id="CCE-4097-2" source="CCE" />
- <description>The password warn age should be set
- appropriately</description>
+ <description>The password expiration warning age should be set
appropriately.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20074" />
+ <criterion test_ref="test_pass_warn_age" />
</criteria>
</definition>
+
<ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the PASS_WARN_AGE[\s]*=[\s]*(.*) expression in the
/etc/login.defs file"
- id="test_20074" version="1">
- <ind:object object_ref="obj_20074" />
+ comment="Tests the value of PASS_WARN_AGE in /etc/login.defs"
+ id="test_pass_warn_age" version="1">
+ <ind:object object_ref="object_etc_login_defs_pass_warn_age" />
+ <ind:state state_ref="state_etc_login_defs_pass_warn_age" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20074"
+
+ <ind:textfilecontent54_object id="object_etc_login_defs_pass_warn_age"
version="1">
- <ind:path>/etc</ind:path>
- <ind:filename>login.defs</ind:filename>
- <ind:pattern operation="pattern
match">^[\s]*PASS_WARN_AGE[\s]*14$</ind:pattern>
+ <ind:filepath>/etc/login.defs</ind:filepath>
+ <ind:pattern operation="pattern
match">^[\s]*PASS_WARN_AGE[\s]*(\d+)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_state id="state_etc_login_defs_pass_warn_age"
version="1">
+ <ind:subexpression operation="greater than or equal"
var_ref="var_password_warn_age" />
+ </ind:textfilecontent54_state>
+
+ <external_variable comment="password expiration warning age in days"
datatype="int" id="var_password_warn_age" version="1" />
+
</def-group>
--
1.7.1