rpms/scap-security-guide
7
0
Fork 0
Code Issues Pull Requests Releases Activity
38497d8b9b
scap-security-guide/SOURCES/scap-security-guide-0.1.58-RHEL_08_020300-PR_7289.patch
CentOS Sources 38497d8b9b import scap-security-guide-0.1.57-3.el8_4
2021-11-02 16:51:38 +00:00

195 lines
8.6 KiB
Diff
Raw Blame History

From 2af7d6d8f86f80dbac088d115a50162cfc28c542 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Tue, 27 Jul 2021 07:49:50 -0500
Subject: [PATCH] Add rule for RHEL-08-020300
---
.../accounts_password_pam_dictcheck/rule.yml | 45 +++++++++++++++++++
.../tests/disabled.fail.sh | 3 ++
.../tests/enable.pass.sh | 3 ++
.../tests/not_defined.fail.sh | 3 ++
.../var_password_pam_dictcheck.var | 16 +++++++
products/rhel8/profiles/stig.profile | 2 +
shared/references/cce-redhat-avail.txt | 1 -
.../data/profile_stability/rhel8/stig.profile | 2 +
.../profile_stability/rhel8/stig_gui.profile | 2 +
9 files changed, 76 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
new file mode 100644
index 0000000000..2990150c0a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
@@ -0,0 +1,45 @@
+documentation_complete: true
+
+prodtype: fedora,rhel8
+
+title: 'Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words'
+
+description: |-
+ The pam_pwquality module's <tt>dictcheck</tt> check if passwords contains dictionary words. When
+ <tt>dictcheck</tt> is set to <tt>1</tt> passwords will be checked for dictionary words.
+
+rationale: |-
+ Use of a complex password helps to increase the time and resources required to compromise the password.
+ Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
+ guessing and brute-force attacks.
+ <br /><br />
+ Password complexity is one factor of several that determines how long it takes to crack a password. The more
+ complex the password, the greater the number of possible combinations that need to be tested before the
+ password is compromised.
+ <br /><br />
+ Passwords with dictionary words may be more vulnerable to password-guessing attacks.
+
+severity: medium
+
+identifiers:
+ cce@rhel8: CCE-86233-4
+
+references:
+ disa: CCI-000366
+ nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4)
+ stigid@rhel8: RHEL-08-020300
+
+ocil_clause: 'dictcheck is not found or not equal to the required value'
+
+ocil: |-
+ To check if dictionary words are disallowed run the following command:
+ <pre>$ sudo grep dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf</pre>
+ The <tt>dictcheck</tt> parameter should be equal to 1. The value should look like
+ <pre>dictcheck=1</pre>
+
+
+template:
+ name: accounts_password
+ vars:
+ variable: dictcheck
+ operation: equals
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
new file mode 100644
index 0000000000..cb84c6d968
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "dictcheck=0" > /etc/security/pwquality.conf
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
new file mode 100644
index 0000000000..ceb9f7ec44
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "dictcheck=1" > /etc/security/pwquality.conf
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
new file mode 100644
index 0000000000..57e54b6623
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+sed -i s/dictcheck.+//g /etc/security/pwquality.conf
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
new file mode 100644
index 0000000000..26452c3a8e
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
@@ -0,0 +1,16 @@
+documentation_complete: true
+
+title: dictcheck
+
+description: |-
+ Prevent the use of dictionary words for passwords.
+
+type: number
+
+operator: equals
+
+interactive: false
+
+options:
+ 1: 1
+ default: 1
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index bf410c2087..f17a7b88b1 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -45,6 +45,7 @@ selections:
- var_password_pam_minlen=15
- var_password_pam_ocredit=1
- var_password_pam_dcredit=1
+ - var_password_pam_dictcheck=1
- var_password_pam_ucredit=1
- var_password_pam_lcredit=1
- var_password_pam_retry=3
@@ -567,6 +568,7 @@ selections:
- sssd_offline_cred_expiration
# RHEL-08-020300
+ - accounts_password_pam_dictcheck
# RHEL-08-020310
- accounts_logon_fail_delay
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 0b794d5c2a..dae4495b2d 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -362,7 +362,6 @@ CCE-86229-2
CCE-86230-0
CCE-86231-8
CCE-86232-6
-CCE-86233-4
CCE-86234-2
CCE-86235-9
CCE-86236-7
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index ddfa13e731..236e595604 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -35,6 +35,7 @@ selections:
- accounts_password_all_shadowed_sha512
- accounts_password_minlen_login_defs
- accounts_password_pam_dcredit
+- accounts_password_pam_dictcheck
- accounts_password_pam_difok
- accounts_password_pam_lcredit
- accounts_password_pam_maxclassrepeat
@@ -332,6 +333,7 @@ selections:
- var_password_pam_minlen=15
- var_password_pam_ocredit=1
- var_password_pam_dcredit=1
+- var_password_pam_dictcheck=1
- var_password_pam_ucredit=1
- var_password_pam_lcredit=1
- var_password_pam_retry=3
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 017ab8c0e3..9973b5adef 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -46,6 +46,7 @@ selections:
- accounts_password_all_shadowed_sha512
- accounts_password_minlen_login_defs
- accounts_password_pam_dcredit
+- accounts_password_pam_dictcheck
- accounts_password_pam_difok
- accounts_password_pam_lcredit
- accounts_password_pam_maxclassrepeat
@@ -342,6 +343,7 @@ selections:
- var_password_pam_minlen=15
- var_password_pam_ocredit=1
- var_password_pam_dcredit=1
+- var_password_pam_dictcheck=1
- var_password_pam_ucredit=1
- var_password_pam_lcredit=1
- var_password_pam_retry=3
Reference in New Issue View Git Blame Copy Permalink