From d6a5542e3a86fe7206546aff431ace2823091ae3 Mon Sep 17 00:00:00 2001

From: Gabriel Becker <ggasparb@redhat.com>

Date: Wed, 9 Sep 2020 16:33:13 +0200

Subject: [PATCH] Set a lower bound value for

 accounts_passwords_pam_faillock_deny check.

---

 .../oval/shared.xml                           | 36 ++++++++++++-------

 .../tests/pam_config_deny_zero                | 26 ++++++++++++++

 .../tests/remediable_deny_zero.fail.sh        |  6 ++++

 3 files changed, 55 insertions(+), 13 deletions(-)

 create mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/pam_config_deny_zero

 create mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/remediable_deny_zero.fail.sh

diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/oval/shared.xml

index db91fa97c6..8fdd7fb3d3 100644

--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/oval/shared.xml

+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/oval/shared.xml

@@ -45,9 +45,10 @@

   check="all" check_existence="all_exist"

-  comment="Checks if pam_faillock authfail is hit even if pam_unix skips lines by defaulting, and also authfail deny value" version="1">

+  comment="Checks if pam_faillock authfail is hit even if pam_unix skips lines by defaulting, and also authfail deny value" version="2">

     <ind:object object_ref="object_accounts_passwords_pam_faillock_when_lines_skipped_system-auth" />

-    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_upper_bound" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_lower_bound" />

   </ind:textfilecontent54_test>

@@ -78,9 +79,10 @@

   check="all" check_existence="all_exist"

-  comment="Checks if pam_faillock authfail is hit even if pam_unix skips lines by defaulting, and also authfail deny value" version="1">

+  comment="Checks if pam_faillock authfail is hit even if pam_unix skips lines by defaulting, and also authfail deny value" version="2">

     <ind:object object_ref="object_accounts_passwords_pam_faillock_when_lines_skipped_password-auth" />

-    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_upper_bound" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_lower_bound" />

   </ind:textfilecontent54_test>

@@ -113,17 +115,22 @@

   comment="number of failed login attempts allowed" version="1" />

-  <ind:textfilecontent54_state id="state_var_accounts_passwords_pam_faillock_deny_value" version="1">

+  <ind:textfilecontent54_state id="state_var_accounts_passwords_pam_faillock_deny_value_upper_bound" version="1">

     <ind:subexpression datatype="int" operation="less than or equal" var_ref="var_accounts_passwords_pam_faillock_deny" />

   </ind:textfilecontent54_state>

+  <ind:textfilecontent54_state id="state_var_accounts_passwords_pam_faillock_deny_value_lower_bound" version="1">

+    <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>

+  </ind:textfilecontent54_state>

+

   check="all" check_existence="all_exist"

-  comment="Check pam_faillock.so preauth silent present, with correct deny value, and is followed by pam_unix." version="1">

+  comment="Check pam_faillock.so preauth silent present, with correct deny value, and is followed by pam_unix." version="2">

     <ind:object object_ref="object_accounts_passwords_pam_faillock_preauth_silent_system-auth" />

-    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_upper_bound" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_lower_bound" />

   </ind:textfilecontent54_test>

   <ind:textfilecontent54_object id="object_accounts_passwords_pam_faillock_preauth_silent_system-auth" version="1">

@@ -138,9 +145,10 @@

   check="all" check_existence="all_exist"

-  comment="Check control values of pam_unix, that it is followed by pam_faillock.so authfail and deny value of pam_faillock.so authfail" version="1">

+  comment="Check control values of pam_unix, that it is followed by pam_faillock.so authfail and deny value of pam_faillock.so authfail" version="2">

     <ind:object object_ref="object_accounts_passwords_pam_faillock_authfail_deny_system-auth" />

-    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_upper_bound" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_lower_bound" />

   </ind:textfilecontent54_test>

   <ind:textfilecontent54_object id="object_accounts_passwords_pam_faillock_authfail_deny_system-auth" version="1">

@@ -170,9 +178,10 @@

   check="all" check_existence="all_exist"

-  comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth, has correct deny value, and is followed by pam_unix" version="1">

+  comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth, has correct deny value, and is followed by pam_unix" version="2">

     <ind:object object_ref="object_accounts_passwords_pam_faillock_preauth_silent_password-auth" />

-    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_upper_bound" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_lower_bound" />

   </ind:textfilecontent54_test>

   <ind:textfilecontent54_object id="object_accounts_passwords_pam_faillock_preauth_silent_password-auth" version="1">

@@ -187,9 +196,10 @@

   check="all" check_existence="all_exist"

-  comment="Check pam_faillock authfail is present after pam_unix, check pam_unix has proper control values, and authfail deny value is correct." version="1">

+  comment="Check pam_faillock authfail is present after pam_unix, check pam_unix has proper control values, and authfail deny value is correct." version="2">

     <ind:object object_ref="object_accounts_passwords_pam_faillock_authfail_deny_password-auth" />

-    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_upper_bound" />

+    <ind:state state_ref="state_var_accounts_passwords_pam_faillock_deny_value_lower_bound" />

   </ind:textfilecontent54_test>

   <ind:textfilecontent54_object id="object_accounts_passwords_pam_faillock_authfail_deny_password-auth" version="1">

diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/pam_config_deny_zero b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/pam_config_deny_zero

new file mode 100644

index 0000000000..4f426dca55

--- /dev/null

+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/pam_config_deny_zero

@@ -0,0 +1,26 @@

+# This pam config is an example of a pam_faillock and pam_unix configured correctly

+# without skipping any module

+

+auth        required      pam_env.so

+auth        required      pam_faildelay.so delay=2000000

+auth        required      pam_faillock.so preauth silent deny=0 unlock_time=1200

+auth        sufficient    pam_unix.so nullok try_first_pass

+auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success

+auth        [default=die] pam_faillock.so authfail deny=0 unlock_time=1200

+auth        required      pam_deny.so

+

+account     required      pam_faillock.so

+account     required      pam_unix.so

+account     sufficient    pam_localuser.so

+account     sufficient    pam_succeed_if.so uid < 1000 quiet

+account     required      pam_permit.so

+

+password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=

+password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok

+password    required      pam_deny.so

+

+session     optional      pam_keyinit.so revoke

+session     required      pam_limits.so

+-session     optional      pam_systemd.so

+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

+session     required      pam_unix.so

diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/remediable_deny_zero.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/remediable_deny_zero.fail.sh

new file mode 100644

index 0000000000..b3f71fc16c

--- /dev/null

+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/remediable_deny_zero.fail.sh

@@ -0,0 +1,6 @@

+#!/bin/bash

+#

+# profiles = xccdf_org.ssgproject.content_profile_ospp

+

+cp pam_config_deny_zero /etc/pam.d/system-auth

+cp pam_config_deny_zero /etc/pam.d/password-auth