>From b225c50d538f0d409fcfde6ff3aac4fe5a676af7 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn@redhat.com>
Date: Tue, 24 Dec 2013 03:16:35 -0500
Subject: [PATCH 06/31] Renamed XCCDF password_require_diffchars to
 accounts_password_pam_cracklib_difok.xml, added to shared/

- Renamed XCCDF rule to reflect granular configuration setting vs broader requirement

- Moved OVAL to shared/

- Tested on RHEL7, updated CPE info
---
 RHEL/6/input/auxiliary/stig_overlay.xml            |  2 +-
 .../accounts_password_pam_cracklib_difok.xml       | 39 +---------------------
 RHEL/6/input/profiles/CS2.xml                      |  2 +-
 RHEL/6/input/profiles/common.xml                   |  2 +-
 .../6/input/profiles/fisma-medium-rhel6-server.xml |  4 +--
 RHEL/6/input/profiles/rht-ccp.xml                  |  2 +-
 RHEL/6/input/profiles/usgcb-rhel6-server.xml       |  2 +-
 RHEL/6/input/system/accounts/pam.xml               |  2 +-
 RHEL/7/input/auxiliary/stig_overlay.xml            |  2 +-
 .../accounts_password_pam_cracklib_difok.xml       |  1 +
 RHEL/7/input/profiles/rht-ccp.xml                  |  2 +-
 RHEL/7/input/system/accounts/pam.xml               |  2 +-
 .../oval/accounts_password_pam_cracklib_difok.xml  | 38 +++++++++++++++++++++
 13 files changed, 51 insertions(+), 49 deletions(-)
 mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml
 create mode 120000 RHEL/7/input/checks/accounts_password_pam_cracklib_difok.xml
 create mode 100644 shared/oval/accounts_password_pam_cracklib_difok.xml

diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml
index d89720c..0e77ee6 100644
--- a/RHEL/6/input/auxiliary/stig_overlay.xml
+++ b/RHEL/6/input/auxiliary/stig_overlay.xml
@@ -184,7 +184,7 @@
 		<VMSinfo VKey="38571" SVKey="50372" VRelease="1" />
 		<title>The system must require passwords to contain at least one lowercase alphabetic character.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="password_require_diffchars" ownerid="RHEL-06-000060" disa="195" severity="low">
+	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_difok" ownerid="RHEL-06-000060" disa="195" severity="low">
 		<VMSinfo VKey="38572" SVKey="50373" VRelease="1" />
 		<title>The system must require at least four characters be changed between the old and new passwords during a password change.</title>
 	</overlay>
diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml
deleted file mode 100644
index 80fd21e..0000000
--- a/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml
+++ /dev/null
@@ -1,38 +0,0 @@
-<def-group>
- <definition class="compliance" id="accounts_password_pam_cracklib_difok" version="1">
-    <metadata>
-      <title>Set Password difok Requirements</title>
-      <affected family="unix">
-        <platform>Red Hat Enterprise Linux 6</platform>
-      </affected>
-      <description>The password difok should meet minimum
-      requirements using pam_cracklib</description>
-      <reference source="DS" ref_id="20131011" ref_url="test_attestation" />
-    </metadata>
-    <criteria>
-      <criterion comment="Conditions for difok are satisfied"
-      test_ref="test_accounts_password_pam_cracklib_difok" />
-    </criteria>
-  </definition>
-
-  <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="test_accounts_password_pam_cracklib_difok" version="1">
-    <ind:object object_ref="object_accounts_password_pam_cracklib_difok" />
-    <ind:state state_ref="state_accounts_password_pam_cracklib_difok" />
-  </ind:textfilecontent54_test>
-
-  <external_variable comment="External variable for pam_cracklib difok"
-  datatype="int" id="var_password_pam_cracklib_difok" version="1" />
-
-  <ind:textfilecontent54_object id="object_accounts_password_pam_cracklib_difok" version="1">
-    <ind:path>/etc/pam.d</ind:path>
-    <ind:filename>system-auth</ind:filename>
-    <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]difok=(-?\d+)(?:[\s]|$)</ind:pattern>
-    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_state id="state_accounts_password_pam_cracklib_difok" version="1">
-    <ind:instance datatype="int">1</ind:instance>
-    <ind:subexpression datatype="int" operation="greater than or equal" var_ref="var_password_pam_cracklib_difok" />
-  </ind:textfilecontent54_state>
-
-</def-group>
diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml
new file mode 120000
index 0000000..ca78167
--- /dev/null
+++ b/RHEL/6/input/checks/accounts_password_pam_cracklib_difok.xml
@@ -0,0 +1 @@
+../../../../shared/oval/accounts_password_pam_cracklib_difok.xml
\ No newline at end of file
diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml
index fc348ae..8bb284c 100644
--- a/RHEL/6/input/profiles/CS2.xml
+++ b/RHEL/6/input/profiles/CS2.xml
@@ -12,7 +12,7 @@
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_lcredit" selected="true"/>
-<select idref="password_require_diffchars" selected="true"/>
+<select idref="accounts_password_pam_cracklib_difok" selected="true"/>
 <select idref="accounts_password_reuse_limit" selected="true"/>
 <refine-value idref="var_password_history_retain_limit" selector="10"/>
 <select idref="accounts_password_warn_age_login_defs" selected="true"/>
diff --git a/RHEL/6/input/profiles/common.xml b/RHEL/6/input/profiles/common.xml
index 01ad314..3944bd4 100644
--- a/RHEL/6/input/profiles/common.xml
+++ b/RHEL/6/input/profiles/common.xml
@@ -56,7 +56,7 @@
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_lcredit" selected="true"/>
-<select idref="password_require_diffchars" selected="true"/>
+<select idref="accounts_password_pam_cracklib_difok" selected="true"/>
 <select idref="deny_password_attempts" selected="true"/>
 <select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
 <select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
diff --git a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
index 7522ca2..16d7d29 100644
--- a/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
+++ b/RHEL/6/input/profiles/fisma-medium-rhel6-server.xml
@@ -281,7 +281,7 @@
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true" />
 <select idref="accounts_password_pam_cracklib_ocredit" selected="true" />
 <select idref="accounts_password_pam_cracklib_lcredit" selected="true" />
-<select idref="password_require_diffchars" selected="true" />
+<select idref="accounts_password_pam_cracklib_difok" selected="true" />
 <refine-value idref="var_password_history_retain_limit" selector="24" />
 <select idref="accounts_password_reuse_limit" selected="true" />
 <select idref="set_password_hashing_algorithm_systemauth" selected="true" />
@@ -297,6 +297,6 @@
 <select idref="accounts_password_warn_age_login_defs" selected="true" />
 <select idref="require_singleuser_auth" selected="true" />
 <refine-value idref="var_password_pam_cracklib_difok" selector="1" />
-<select idref="password_require_diffchars" selected="true" />
+<select idref="accounts_password_pam_cracklib_difok" selected="true" />
 
 </Profile>
diff --git a/RHEL/6/input/profiles/rht-ccp.xml b/RHEL/6/input/profiles/rht-ccp.xml
index d5f983a..9040055 100644
--- a/RHEL/6/input/profiles/rht-ccp.xml
+++ b/RHEL/6/input/profiles/rht-ccp.xml
@@ -58,7 +58,7 @@
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_lcredit" selected="true"/>
-<select idref="password_require_diffchars" selected="true"/>
+<select idref="accounts_password_pam_cracklib_difok" selected="true"/>
 <select idref="deny_password_attempts" selected="true"/>
 <select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
 <select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
index 704aa62..4693fae 100644
--- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml
+++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml
@@ -81,7 +81,7 @@
 <refine-value idref="var_password_pam_cracklib_ocredit" selector="1" />
 <select idref="accounts_password_pam_cracklib_ocredit" selected="true" />
 <refine-value idref="var_password_pam_cracklib_difok" selector="3" />
-<select idref="password_require_diffchars" selected="true" />
+<select idref="accounts_password_pam_cracklib_difok" selected="true" />
 <refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="5" />
 <select idref="deny_password_attempts" selected="true" />
 <select idref="set_password_hashing_algorithm_systemauth" selected="true" />
diff --git a/RHEL/6/input/system/accounts/pam.xml b/RHEL/6/input/system/accounts/pam.xml
index fb3a72e..f566344 100644
--- a/RHEL/6/input/system/accounts/pam.xml
+++ b/RHEL/6/input/system/accounts/pam.xml
@@ -367,7 +367,7 @@ more difficult by ensuring a larger search space.
 <tested by="DS" on="20121024"/>
 </Rule>
 
-<Rule id="password_require_diffchars">
+<Rule id="accounts_password_pam_cracklib_difok">
 <title>Set Password Strength Minimum Different Characters</title>
 <description>The pam_cracklib module's <tt>difok</tt> parameter controls requirements for
 usage of different characters during a password change.
diff --git a/RHEL/7/input/auxiliary/stig_overlay.xml b/RHEL/7/input/auxiliary/stig_overlay.xml
index 32eb751..721e4b9 100644
--- a/RHEL/7/input/auxiliary/stig_overlay.xml
+++ b/RHEL/7/input/auxiliary/stig_overlay.xml
@@ -184,7 +184,7 @@
 		<VMSinfo VKey="38571" SVKey="50372" VRelease="1" />
 		<title>The system must require passwords to contain at least one lowercase alphabetic character.</title>
 	</overlay>
-	<overlay owner="disastig" ruleid="password_require_diffchars" ownerid="RHEL-06-000060" disa="195" severity="low">
+	<overlay owner="disastig" ruleid="accounts_password_pam_cracklib_difok" ownerid="RHEL-06-000060" disa="195" severity="low">
 		<VMSinfo VKey="38572" SVKey="50373" VRelease="1" />
 		<title>The system must require at least four characters be changed between the old and new passwords during a password change.</title>
 	</overlay>
diff --git a/RHEL/7/input/checks/accounts_password_pam_cracklib_difok.xml b/RHEL/7/input/checks/accounts_password_pam_cracklib_difok.xml
new file mode 120000
index 0000000..ca78167
--- /dev/null
+++ b/RHEL/7/input/checks/accounts_password_pam_cracklib_difok.xml
@@ -0,0 +1 @@
+../../../../shared/oval/accounts_password_pam_cracklib_difok.xml
\ No newline at end of file
diff --git a/RHEL/7/input/profiles/rht-ccp.xml b/RHEL/7/input/profiles/rht-ccp.xml
index fc36e04..f761500 100644
--- a/RHEL/7/input/profiles/rht-ccp.xml
+++ b/RHEL/7/input/profiles/rht-ccp.xml
@@ -57,7 +57,7 @@
 <select idref="accounts_password_pam_cracklib_ucredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_ocredit" selected="true"/>
 <select idref="accounts_password_pam_cracklib_lcredit" selected="true"/>
-<select idref="password_require_diffchars" selected="true"/>
+<select idref="accounts_password_pam_cracklib_difok" selected="true"/>
 <select idref="deny_password_attempts" selected="true"/>
 <select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
 <select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
diff --git a/RHEL/7/input/system/accounts/pam.xml b/RHEL/7/input/system/accounts/pam.xml
index 2e0243e..d17c439 100644
--- a/RHEL/7/input/system/accounts/pam.xml
+++ b/RHEL/7/input/system/accounts/pam.xml
@@ -367,7 +367,7 @@ more difficult by ensuring a larger search space.
 <tested by="DS" on="20121024"/>
 </Rule>
 
-<Rule id="password_require_diffchars">
+<Rule id="accounts_password_pam_cracklib_difok">
 <title>Set Password Strength Minimum Different Characters</title>
 <description>The pam_cracklib module's <tt>difok</tt> parameter controls requirements for
 usage of different characters during a password change.
diff --git a/shared/oval/accounts_password_pam_cracklib_difok.xml b/shared/oval/accounts_password_pam_cracklib_difok.xml
new file mode 100644
index 0000000..80fd21e
--- /dev/null
+++ b/shared/oval/accounts_password_pam_cracklib_difok.xml
@@ -0,0 +1,38 @@
+<def-group>
+ <definition class="compliance" id="accounts_password_pam_cracklib_difok" version="1">
+    <metadata>
+      <title>Set Password difok Requirements</title>
+      <affected family="unix">
+        <platform>Red Hat Enterprise Linux 6</platform>
+      </affected>
+      <description>The password difok should meet minimum
+      requirements using pam_cracklib</description>
+      <reference source="DS" ref_id="20131011" ref_url="test_attestation" />
+    </metadata>
+    <criteria>
+      <criterion comment="Conditions for difok are satisfied"
+      test_ref="test_accounts_password_pam_cracklib_difok" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="test_accounts_password_pam_cracklib_difok" version="1">
+    <ind:object object_ref="object_accounts_password_pam_cracklib_difok" />
+    <ind:state state_ref="state_accounts_password_pam_cracklib_difok" />
+  </ind:textfilecontent54_test>
+
+  <external_variable comment="External variable for pam_cracklib difok"
+  datatype="int" id="var_password_pam_cracklib_difok" version="1" />
+
+  <ind:textfilecontent54_object id="object_accounts_password_pam_cracklib_difok" version="1">
+    <ind:path>/etc/pam.d</ind:path>
+    <ind:filename>system-auth</ind:filename>
+    <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]difok=(-?\d+)(?:[\s]|$)</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_accounts_password_pam_cracklib_difok" version="1">
+    <ind:instance datatype="int">1</ind:instance>
+    <ind:subexpression datatype="int" operation="greater than or equal" var_ref="var_password_pam_cracklib_difok" />
+  </ind:textfilecontent54_state>
+
+</def-group>
-- 
1.8.3.1