|
 |
cf5f1e |
From 25216f8eb9caa6e783322158967b689e8bd784e7 Mon Sep 17 00:00:00 2001
|
|
|
cf5f1e |
From: Watson Sato <wsato@redhat.com>
|
|
|
cf5f1e |
Date: Mon, 13 Feb 2023 17:49:14 +0100
|
|
|
cf5f1e |
Subject: [PATCH 4/5] Accept required and requisite control flag for
|
|
|
cf5f1e |
pam_pwhistory
|
|
|
cf5f1e |
|
|
|
cf5f1e |
Patch-name: scap-security-guide-0.1.67-pwhistory_control-PR_10175.patch
|
|
|
cf5f1e |
Patch-status: Accept required and requisite control flag for pam_pwhistory
|
|
|
cf5f1e |
---
|
|
|
cf5f1e |
controls/cis_rhel8.yml | 2 +-
|
|
|
cf5f1e |
controls/cis_rhel9.yml | 2 +-
|
|
|
cf5f1e |
controls/srg_gpos/SRG-OS-000077-GPOS-00045.yml | 2 +-
|
|
|
cf5f1e |
.../rule.yml | 4 ++++
|
|
|
cf5f1e |
.../var_password_pam_remember_control_flag.var | 1 +
|
|
|
cf5f1e |
products/rhel8/profiles/stig.profile | 2 +-
|
|
|
cf5f1e |
tests/data/profile_stability/rhel8/stig.profile | 2 +-
|
|
|
cf5f1e |
tests/data/profile_stability/rhel8/stig_gui.profile | 2 +-
|
|
|
cf5f1e |
8 files changed, 11 insertions(+), 6 deletions(-)
|
|
|
cf5f1e |
|
|
|
cf5f1e |
diff --git a/controls/cis_rhel8.yml b/controls/cis_rhel8.yml
|
|
|
cf5f1e |
index c0406f97b8..efc53d03fd 100644
|
|
|
cf5f1e |
--- a/controls/cis_rhel8.yml
|
|
|
cf5f1e |
+++ b/controls/cis_rhel8.yml
|
|
|
cf5f1e |
@@ -2267,7 +2267,7 @@ controls:
|
|
|
cf5f1e |
rules:
|
|
|
cf5f1e |
- accounts_password_pam_pwhistory_remember_password_auth
|
|
|
cf5f1e |
- accounts_password_pam_pwhistory_remember_system_auth
|
|
|
cf5f1e |
- - var_password_pam_remember_control_flag=requisite
|
|
|
cf5f1e |
+ - var_password_pam_remember_control_flag=requisite_or_required
|
|
|
cf5f1e |
- var_password_pam_remember=5
|
|
|
cf5f1e |
|
|
|
cf5f1e |
- id: 5.5.4
|
|
|
cf5f1e |
diff --git a/controls/cis_rhel9.yml b/controls/cis_rhel9.yml
|
|
|
cf5f1e |
index 7299a39528..30f7e8d182 100644
|
|
|
cf5f1e |
--- a/controls/cis_rhel9.yml
|
|
|
cf5f1e |
+++ b/controls/cis_rhel9.yml
|
|
|
cf5f1e |
@@ -2112,7 +2112,7 @@ controls:
|
|
|
cf5f1e |
rules:
|
|
|
cf5f1e |
- accounts_password_pam_pwhistory_remember_password_auth
|
|
|
cf5f1e |
- accounts_password_pam_pwhistory_remember_system_auth
|
|
|
cf5f1e |
- - var_password_pam_remember_control_flag=requisite
|
|
|
cf5f1e |
+ - var_password_pam_remember_control_flag=requisite_or_required
|
|
|
cf5f1e |
- var_password_pam_remember=5
|
|
|
cf5f1e |
|
|
|
cf5f1e |
- id: 5.5.4
|
|
|
cf5f1e |
diff --git a/controls/srg_gpos/SRG-OS-000077-GPOS-00045.yml b/controls/srg_gpos/SRG-OS-000077-GPOS-00045.yml
|
|
|
cf5f1e |
index 1e8286a4a4..b02b7da419 100644
|
|
|
cf5f1e |
--- a/controls/srg_gpos/SRG-OS-000077-GPOS-00045.yml
|
|
|
cf5f1e |
+++ b/controls/srg_gpos/SRG-OS-000077-GPOS-00045.yml
|
|
|
cf5f1e |
@@ -5,7 +5,7 @@ controls:
|
|
|
cf5f1e |
title: {{{ full_name }}} must prohibit password reuse for a minimum of five generations.
|
|
|
cf5f1e |
rules:
|
|
|
cf5f1e |
- var_password_pam_remember=5
|
|
|
cf5f1e |
- - var_password_pam_remember_control_flag=requisite
|
|
|
cf5f1e |
+ - var_password_pam_remember_control_flag=requisite_or_required
|
|
|
cf5f1e |
- accounts_password_pam_pwhistory_remember_password_auth
|
|
|
cf5f1e |
- accounts_password_pam_pwhistory_remember_system_auth
|
|
|
cf5f1e |
status: automated
|
|
|
cf5f1e |
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml
|
|
|
cf5f1e |
index c549de2e96..d2b220ef9f 100644
|
|
|
cf5f1e |
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml
|
|
|
cf5f1e |
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml
|
|
|
cf5f1e |
@@ -129,3 +129,7 @@ warnings:
|
|
|
cf5f1e |
Newer versions of <tt>authselect</tt> contain an authselect feature to easily and properly
|
|
|
cf5f1e |
enable <tt>pam_pwhistory.so</tt> module. If this feature is not yet available in your
|
|
|
cf5f1e |
system, an authselect custom profile must be used to avoid integrity issues in PAM files.
|
|
|
cf5f1e |
+ If a custom profile was created and used in the system before this authselect feature was
|
|
|
cf5f1e |
+ available, the new feature can't be used with this custom profile and the
|
|
|
cf5f1e |
+ remediation will fail. In this case, the custom profile should be recreated or manually
|
|
|
cf5f1e |
+ updated.
|
|
|
cf5f1e |
diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/var_password_pam_remember_control_flag.var b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/var_password_pam_remember_control_flag.var
|
|
|
cf5f1e |
index 8f01007550..1959936c04 100644
|
|
|
cf5f1e |
--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/var_password_pam_remember_control_flag.var
|
|
|
cf5f1e |
+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/var_password_pam_remember_control_flag.var
|
|
|
cf5f1e |
@@ -20,4 +20,5 @@ options:
|
|
|
cf5f1e |
"sufficient": "sufficient"
|
|
|
cf5f1e |
"binding": "binding"
|
|
|
cf5f1e |
"ol8": "required,requisite"
|
|
|
cf5f1e |
+ "requisite_or_required": "requisite,required"
|
|
|
cf5f1e |
default: "requisite"
|
|
|
cf5f1e |
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
|
|
cf5f1e |
index 8c64868619..a3f7dc9720 100644
|
|
|
cf5f1e |
--- a/products/rhel8/profiles/stig.profile
|
|
|
cf5f1e |
+++ b/products/rhel8/profiles/stig.profile
|
|
|
cf5f1e |
@@ -37,7 +37,7 @@ selections:
|
|
|
cf5f1e |
- var_accounts_minimum_age_login_defs=1
|
|
|
cf5f1e |
- var_accounts_max_concurrent_login_sessions=10
|
|
|
cf5f1e |
- var_password_pam_remember=5
|
|
|
cf5f1e |
- - var_password_pam_remember_control_flag=requisite
|
|
|
cf5f1e |
+ - var_password_pam_remember_control_flag=requisite_or_required
|
|
|
cf5f1e |
- var_selinux_state=enforcing
|
|
|
cf5f1e |
- var_selinux_policy_name=targeted
|
|
|
cf5f1e |
- var_password_pam_unix_rounds=5000
|
|
|
cf5f1e |
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
|
|
cf5f1e |
index 6970a32b4f..5d694c6ae1 100644
|
|
|
cf5f1e |
--- a/tests/data/profile_stability/rhel8/stig.profile
|
|
|
cf5f1e |
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
|
|
cf5f1e |
@@ -433,7 +433,7 @@ selections:
|
|
|
cf5f1e |
- var_accounts_minimum_age_login_defs=1
|
|
|
cf5f1e |
- var_accounts_max_concurrent_login_sessions=10
|
|
|
cf5f1e |
- var_password_pam_remember=5
|
|
|
cf5f1e |
-- var_password_pam_remember_control_flag=requisite
|
|
|
cf5f1e |
+- var_password_pam_remember_control_flag=requisite_or_required
|
|
|
cf5f1e |
- var_selinux_state=enforcing
|
|
|
cf5f1e |
- var_selinux_policy_name=targeted
|
|
|
cf5f1e |
- var_password_pam_unix_rounds=5000
|
|
|
cf5f1e |
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
cf5f1e |
index 314f14e4f6..e165525b90 100644
|
|
|
cf5f1e |
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
cf5f1e |
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
cf5f1e |
@@ -441,7 +441,7 @@ selections:
|
|
|
cf5f1e |
- var_accounts_minimum_age_login_defs=1
|
|
|
cf5f1e |
- var_accounts_max_concurrent_login_sessions=10
|
|
|
cf5f1e |
- var_password_pam_remember=5
|
|
|
cf5f1e |
-- var_password_pam_remember_control_flag=requisite
|
|
|
cf5f1e |
+- var_password_pam_remember_control_flag=requisite_or_required
|
|
|
cf5f1e |
- var_selinux_state=enforcing
|
|
|
cf5f1e |
- var_selinux_policy_name=targeted
|
|
|
cf5f1e |
- var_password_pam_unix_rounds=5000
|
|
|
cf5f1e |
--
|
|
|
cf5f1e |
2.39.1
|
|
|
cf5f1e |
|