>From 428c86dc9314dd1699f79b32c52c9fe754bc1c71 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Tue, 24 Dec 2013 02:48:15 -0500 Subject: [PATCH 02/31] Renamed password_require_uppercases to accounts_password_pam_cracklib_ucredit, added to shared/ - Renamed XCCDF rule to match other cracklib checks. "Password Require Uppercases" is a requirement, whereas accounts_password_pam_cracklib_ucredit reflects a specific configuration setting to meet that requirement. - Moved OVAL to shared/ - Tested on RHEL7, updated CPE --- RHEL/6/input/auxiliary/stig_overlay.xml | 2 +- .../accounts_password_pam_cracklib_ucredit.xml | 44 +-------------------- RHEL/6/input/profiles/CS2.xml | 2 +- RHEL/6/input/profiles/common.xml | 2 +- .../6/input/profiles/fisma-medium-rhel6-server.xml | 2 +- RHEL/6/input/profiles/rht-ccp.xml | 2 +- RHEL/6/input/profiles/usgcb-rhel6-server.xml | 2 +- RHEL/6/input/system/accounts/pam.xml | 2 +- .../accounts_password_pam_cracklib_ucredit.xml | 1 + RHEL/7/input/profiles/.rht-ccp.xml.swp | Bin 0 -> 20480 bytes .../accounts_password_pam_cracklib_ucredit.xml | 44 +++++++++++++++++++++ 11 files changed, 53 insertions(+), 50 deletions(-) mode change 100644 => 120000 RHEL/6/input/checks/accounts_password_pam_cracklib_ucredit.xml create mode 120000 RHEL/7/input/checks/accounts_password_pam_cracklib_ucredit.xml create mode 100644 RHEL/7/input/profiles/.rht-ccp.xml.swp create mode 100644 shared/oval/accounts_password_pam_cracklib_ucredit.xml diff --git a/RHEL/6/input/auxiliary/stig_overlay.xml b/RHEL/6/input/auxiliary/stig_overlay.xml index 051f22e..08a0424 100644 --- a/RHEL/6/input/auxiliary/stig_overlay.xml +++ b/RHEL/6/input/auxiliary/stig_overlay.xml @@ -172,7 +172,7 @@ The system must require passwords to contain at least one numeric character. - + The system must require passwords to contain at least one uppercase alphabetic character. diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_ucredit.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_ucredit.xml deleted file mode 100644 index e6151e7..0000000 --- a/RHEL/6/input/checks/accounts_password_pam_cracklib_ucredit.xml +++ /dev/null @@ -1,43 +0,0 @@ - - - - Set Password ucredit Requirements - - Red Hat Enterprise Linux 6 - - The password ucredit should meet minimum - requirements using pam_cracklib - - - - - - - - - - - - - - 1 - - - - - - - /etc/pam.d/system-auth - ^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]ucredit=(-?\d+)(?:[\s]|$) - 1 - - diff --git a/RHEL/6/input/checks/accounts_password_pam_cracklib_ucredit.xml b/RHEL/6/input/checks/accounts_password_pam_cracklib_ucredit.xml new file mode 120000 index 0000000..7aa3ff4 --- /dev/null +++ b/RHEL/6/input/checks/accounts_password_pam_cracklib_ucredit.xml @@ -0,0 +1 @@ +../../../../shared/oval/accounts_password_pam_cracklib_ucredit.xml \ No newline at end of file diff --git a/RHEL/6/input/profiles/CS2.xml b/RHEL/6/input/profiles/CS2.xml index 1bfacc4..375a4cc 100644 --- a/RHEL/6/input/profiles/CS2.xml +++ b/RHEL/6/input/profiles/CS2.xml @@ -9,7 +9,7 @@ - - + diff --git a/RHEL/6/input/profiles/rht-ccp.xml b/RHEL/6/input/profiles/rht-ccp.xml index 3262b18..48d9bb3 100644 --- a/RHEL/6/input/profiles/rht-ccp.xml +++ b/RHEL/6/input/profiles/rht-ccp.xml @@ -55,7 +55,7 @@ + diff --git a/RHEL/6/input/profiles/usgcb-rhel6-server.xml b/RHEL/6/input/profiles/usgcb-rhel6-server.xml index 78f7634..8432dd0 100644 --- a/RHEL/6/input/profiles/usgcb-rhel6-server.xml +++ b/RHEL/6/input/profiles/usgcb-rhel6-server.xml @@ -75,7 +75,7 @@ + diff --git a/RHEL/6/input/system/accounts/pam.xml b/RHEL/6/input/system/accounts/pam.xml index 9d8155c..f7cba14 100644 --- a/RHEL/6/input/system/accounts/pam.xml +++ b/RHEL/6/input/system/accounts/pam.xml @@ -292,7 +292,7 @@ search space. - + Set Password Strength Minimum Uppercase Characters The pam_cracklib module's ucredit= parameter controls requirements for usage of uppercase letters in a password. When set to a negative number, any password will be required to diff --git a/RHEL/7/input/checks/accounts_password_pam_cracklib_ucredit.xml b/RHEL/7/input/checks/accounts_password_pam_cracklib_ucredit.xml new file mode 120000 index 0000000..7aa3ff4 --- /dev/null +++ b/RHEL/7/input/checks/accounts_password_pam_cracklib_ucredit.xml @@ -0,0 +1 @@ +../../../../shared/oval/accounts_password_pam_cracklib_ucredit.xml \ No newline at end of file diff --git a/RHEL/7/input/profiles/.rht-ccp.xml.swp b/RHEL/7/input/profiles/.rht-ccp.xml.swp new file mode 100644 index 0000000000000000000000000000000000000000..97717044d1504ade012cc16cd29c2b0745d565a9 GIT binary patch literal 20480 zcmeHOON<;x8Eyy=2sW`C#Dz;|iBRHXcl;n;C#+Yj#uIxL@54L05g>(9O?S;qXM4Ij zRn@aQ5lT2AMFcqn2`(H^0Et|3;UPdEq!0-uxdb8Q01{G;0fGpKi+zBv`Z2HVneCpn zgcQ}tpU3N&|F6Hks`~5ys%smkA6s3s7Z*Nf;dR2YZhYYvTi>_8Y5i!$vSgd?1^WLF zdHLL-ew$0R5dX{N9qQ%TRk~DE_V)HFZPoEB(xKtJWKJYJ)thfcp35p*S87))ixn>j zBUK3nZ+bqH7137njuS5Icl<*lF&`TS3io!qaQ z|1=C31`Gp+0mFb{z%XDKFbo(5-k%Jp@HXoibnSy__Z~{$KQQ+Gq4ejEr|%cXKEEyf z`BM6RdF=D_NAqSFFbo(53GHFkl!k3>XFs1BL;^!2f{(>RQ$d5dSY|0gvbZ zng0LvotEVT$AEV~VOcK&PXPAP zuK~{k*8v}R0C?xami1Gh2Yep*4-PMW0_+0!0Dnebb$`DFJO_Bd1>h!lcm?PJ_XB^y zA;=Gb9{|q*+rR}Nel1DnGe_B;D_Ha5TqK#`djS(fwx@hVUA{;3t%f-}v1jhZIVB=C zS6Q|mS-o1bH)~sKtM&To#=2d-QmZ~%x2!RLf;|~|f)VKjEuZOz35`@c&*PY-WQv4T z$~`Vz(x$Qv4}|(Hjw=}L4)MK)_U7=Qc?+EJmKV6JDUa?-_M~E+f_-#Z&>M7;Dp-c9 zNDzHuGJajJ*>u`e%w+8IJupcn%dE$Sf;tY50wo8bhBW@lQh_gah$E=8i}50nBbe){ z0wm|PIONE^RgMHxqBm1KdsGC3wixmC+#v-gPrqLsFYr21=LjD9Qvj}f7R(q&zzHrh z5w`EJP?4vQ7YeWeBfTJ*Bs@|QccG9+bh0RBs^|D%)@M^r4JVheX@&OCn(rr6H#zcF zvdYqVS)koM@qOBa&PGThoe2~2?)iCprCQzCS>LwTR@PT8*VbzIXOida`T6Aoxh}*s z*E51@M!Y~O>if*i3+{j^3uJ^W*$P`un>o8AU|nQN*ORm{!NnLw;|^LrZ=m@ep^oyp z6zt~3G3F$@;D&Xs5QijDNE9b7%nMkjAz+EOsnT89WxeS%ENPB+HZQGgudZJnVb+R2 z5*YMFyCL{4d)Ph@tM3KTK6V5ji?8cBEWUq7eA>WXm)F~P%qDmVx$ikW)eDPs6q{k( zGzNGAF}h#Vf@gsqSCTnuaISn#T_$p9PQun6>$R(^>pNc@A!@8YAr;C~9uJ6KCAh+< z(*kzfVp%uWIwz#@P5yvgX&coEb8U3Db)`}NQhmF&HrjKPGG4&uyVQ?ZR@o#OqCo>) z+$gr+-)p$gWlzg#=uAx`U+EfVDbIx_t)DI8f+gxuxtoQj9i3iWoNC_BF>OyOE_wvp z3~rf@CL8VO!D4PgI=uIJO+FIMxfz`JqZ_D>Ru{|~%~(~S-JF@BQzJEj zb~2sd{#@yg`jpZ@yPH0D`tGJz2!}iBhtr|RlC6GX)0PjNp2|xWg?B&^oqwe%oCM}qxMzNJdy$6CtlJc!8j zlKh;FTk?UtIM-Gxe7I7HYabsuQ!WJfd!faq5EF~Lf|ZL6T1I*!1KT+a1!_<^#6B&$AQlR|A7AgIq)^$8Gr-l zfdAqQ;8(!YKoz(hcn$jh8^Ahn0=N^ni8FxLf$sv31NQ*$Li_&~&}RW(0qzHGK=Z!> zd>e3pQ^3EW`+o^M4OD?UfImR{zX|*d=m9IhG2ks|{}+Kaa3An@aPcxAfB?|kGywCO ziGig`I!~7^UE+_GS8+bmvVn#n)(vxsk?j!m>?frhg-_3zshKKIdkMrJ6qWnp&pk;gg}~_Q@+_$X)jd-k8ZWP@xuxvxJLNGTxLkS*n?0 zr43QeFq?<8OWR)F=#C|b?E9*z@&!$DkebPr2XGo_dxV4w_J&Lg4bH%FANo`k z8J>*m$p$Oy+pE`hR<>)Ga15~Z*ecSXJuLuj_sF2vc8m^9@K11OEhs_1z=y=E_5YWl-CqQ> z{)aq|U#~**e;rr_P5`e$^Y?%UfPdk;?*V_x>{1)^W*9IG7zPXjh5^HXVZbn87%&VN t1`Gp7VPH(&4;1Ag%Ff&-&cEgSzPL?1?P_QLhDmmjS%%E + + + Set Password ucredit Requirements + + Red Hat Enterprise Linux 6 + Red Hat Enterprise Linux 7 + + The password ucredit should meet minimum + requirements using pam_cracklib + + + + + + + + + + + + + + 1 + + + + + + + /etc/pam.d/system-auth + ^[\s]*password[\s]+(?:(?:required)|(?:requisite))[\s]+[\w_\.\-=\s]+[\s]ucredit=(-?\d+)(?:[\s]|$) + 1 + + -- 1.8.3.1