diff --git a/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml b/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml index a00fc16..dc1b249 100644 --- a/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml +++ b/RHEL/6/input/profiles/stig-rhel6-server-upstream.xml @@ -99,7 +99,7 @@ upstream project homepage is https://fedorahosted.org/scap-security-guide/. - + diff --git a/RHEL/6/input/system/accounts/pam.xml b/RHEL/6/input/system/accounts/pam.xml index adf0aaf..b2da2a4 100644 --- a/RHEL/6/input/system/accounts/pam.xml +++ b/RHEL/6/input/system/accounts/pam.xml @@ -48,7 +48,7 @@ operator="equals" interactive="0"> /etc/security/opasswd in order to force password change history and keep the user from alternating between the same password too frequently. -24 +5 0 5 10 @@ -342,7 +342,7 @@ more difficult by ensuring a larger search space. usage of special (or ``other'') characters in a password. When set to a negative number, any password will be required to contain that many special characters. When set to a positive number, pam_cracklib will grant +1 additional length credit for each special character. -Add ocredit=-1 after pam_cracklib.so to require use of a special character in passwords. +Add ocredit= after pam_cracklib.so to require use of a special character in passwords. To check how many special characters are required in a password, run the following command: @@ -357,7 +357,7 @@ more difficult by ensuring a larger search space. - + @@ -551,7 +551,7 @@ be accomplished by using the remember option for the pam_unix module. In the file /etc/pam.d/system-auth, append remember= to the line which refers to the pam_unix.so module, as shown: 
password sufficient pam_unix.so existing_options remember=
-The DoD and FISMA requirement is 24 passwords. +The DoD STIG requirement is 5 passwords. To verify the password reuse setting is compliant, run the following command: 
$ grep remember /etc/pam.d/system-auth
diff --git a/RHEL/6/input/system/accounts/restrictions/password_expiration.xml b/RHEL/6/input/system/accounts/restrictions/password_expiration.xml index e4af5aa..a8e90c2 100644 --- a/RHEL/6/input/system/accounts/restrictions/password_expiration.xml +++ b/RHEL/6/input/system/accounts/restrictions/password_expiration.xml @@ -159,7 +159,7 @@ increases the risk of users writing down the password in a convenient location subject to physical compromise. - + diff --git a/RHEL/7/input/checks/accounts_password_pam_minlen.xml b/RHEL/7/input/checks/accounts_password_pam_minlen.xml new file mode 100644 index 0000000..77f89af --- /dev/null +++ b/RHEL/7/input/checks/accounts_password_pam_minlen.xml @@ -0,0 +1,40 @@ + + + + Set Password minlen Requirements + + Red Hat Enterprise Linux 7 + + The password minlen should meet minimum requirements + + + + + + + + + + + + + + + + /etc/pam.d/system-auth + ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*minlen=(-?\d+)(?:[\s]|$) + 1 + + + + + 1 + + + + + + diff --git a/RHEL/7/input/fixes/bash/accounts_password_pam_minlen.sh b/RHEL/7/input/fixes/bash/accounts_password_pam_minlen.sh new file mode 100644 index 0000000..5bc5b0f --- /dev/null +++ b/RHEL/7/input/fixes/bash/accounts_password_pam_minlen.sh @@ -0,0 +1,8 @@ +source ./templates/support.sh +populate var_password_pam_minlen + +if grep -q "minlen=" /etc/pam.d/system-auth; then + sed -i --follow-symlink "s/\(minlen *= *\).*/\1$var_password_pam_minlen/" /etc/pam.d/system-auth +else + sed -i --follow-symlink "/pam_pwquality.so/ s/$/ minlen=$var_password_pam_minlen/" /etc/pam.d/system-auth +fi diff --git a/RHEL/7/input/profiles/stig-rhel7-server-upstream.xml b/RHEL/7/input/profiles/stig-rhel7-server-upstream.xml index ef079b4..19a06b3 100644 --- a/RHEL/7/input/profiles/stig-rhel7-server-upstream.xml +++ b/RHEL/7/input/profiles/stig-rhel7-server-upstream.xml @@ -2,6 +2,36 @@ Pre-release Draft STIG for RHEL 7 Server This profile is being developed under the DoD consensus model to become a STIG in coordination with DISA FSO. + + + + + + + + + + + + + + + + + + + + + + diff --git a/RHEL/7/input/system/accounts/pam.xml b/RHEL/7/input/system/accounts/pam.xml index 3cdd433..f5d9cdf 100644 --- a/RHEL/7/input/system/accounts/pam.xml +++ b/RHEL/7/input/system/accounts/pam.xml @@ -48,7 +48,7 @@ operator="equals" interactive="0"> /etc/security/opasswd in order to force password change history and keep the user from alternating between the same password too frequently. -24 +5 0 5 10 @@ -137,13 +137,14 @@ reason. minlen Minimum number of characters in password -14 +15 6 8 10 12 14 + 15 @@ -190,11 +191,12 @@ password password Keep this high for short passwords -4 +15 2 3 4 5 +15 @@ -306,10 +308,34 @@ search space. - + + +Set Password Minimum Length +The pam_pwquality module's minlen parameter controls requirements for +minimum characters required in a password. Add minlen= +after pam_pwquality to set minimum password length requirements. + + +To check how many characters are required in a password, run the following command: +
$ grep pam_pwquality /etc/pam.d/system-auth
+Your output should contain minlen= + + +Password length is one factor of several that helps to determine +strength and how long it takes to crack a password. Use of more characters in +a password helps to exponentially increase the time and/or resources +required to compromise the password. + + + + + + + + Set Password Strength Minimum Uppercase Characters The pam_pwquality module's ucredit= parameter controls requirements for @@ -331,18 +357,18 @@ more difficult by ensuring a larger search space. - + Set Password Strength Minimum Special Characters The pam_pwquality module's ocredit= parameter controls requirements for -usage of special (or ``other'') characters in a password. When set to a negative number, any password will be required to +usage of special (or "other") characters in a password. When set to a negative number, any password will be required to contain that many special characters. When set to a positive number, pam_pwquality will grant +1 additional length credit for each special character. -Add ocredit=-1 after pam_pwquality.so to require use of a special character in passwords. - +Add ocredit= after pam_pwquality.so to +require use of a special character in passwords. To check how many special characters are required in a password, run the following command: 
$ grep pam_pwquality /etc/pam.d/system-auth
@@ -356,7 +382,7 @@ more difficult by ensuring a larger search space. - + @@ -381,7 +407,7 @@ more difficult by ensuring a larger search space. - + @@ -391,14 +417,14 @@ more difficult by ensuring a larger search space. usage of different characters during a password change. Add difok=NUM after pam_pwquality.so to require differing characters when changing passwords, substituting NUM appropriately. -The DoD requirement is 4. +The DoD requirement is 15. To check how many characters must differ during a password change, run the following command: 
$ grep pam_pwquality /etc/pam.d/system-auth
The difok parameter will indicate how many characters must differ. -The DoD requires four characters differ during a password change. -This would appear as difok=4. +The DoD requires 15 characters differ during a password change. +This would appear as difok=15. Requiring a minimum number of different characters during password changes ensures that @@ -407,7 +433,7 @@ Note that passwords which are changed on compromised systems will still be compr - + @@ -476,13 +502,13 @@ attempts using pam_faillock.so:

Add the following lines immediately below the pam_unix.so statement in AUTH section of both /etc/pam.d/system-auth and /etc/pam.d/password-auth: -
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900
-
auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900
+
auth [default=die] pam_faillock.so authfail deny= unlock_time=604800 fail_interval=
+
auth required pam_faillock.so authsucc deny=  unlock_time=604800 fail_interval=
To ensure the failed password attempt policy is configured correctly, run the following command: 
$ grep pam_faillock /etc/pam.d/system-auth
-The output should show deny=3. +The output should show deny=. Locking out user accounts after a number of incorrect attempts @@ -490,7 +516,7 @@ prevents direct password guessing attacks. - + @@ -500,8 +526,8 @@ To configure the system to lock out accounts after a number of incorrect login attempts and require an administrator to unlock the account using pam_faillock.so:

Add the following lines immediately below the pam_env.so statement in /etc/pam.d/system-auth: -
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900
-
auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900
+
auth [default=die] pam_faillock.so authfail deny= unlock_time=604800 fail_interval=
+
auth required pam_faillock.so authsucc deny=  unlock_time=604800 fail_interval=
To ensure the failed password attempt policy is configured correctly, run the following command: @@ -527,43 +553,46 @@ attempts.

Add the following fail_interval directives to pam_faillock.so immediately below the pam_env.so statement in /etc/pam.d/system-auth and /etc/pam.d/password-auth: -
auth [default=die] pam_faillock.so authfail deny=3 unlock_time=604800 fail_interval=900
-
auth required pam_faillock.so authsucc deny=3 unlock_time=604800 fail_interval=900
+
auth [default=die] pam_faillock.so authfail deny= unlock_time=604800 fail_interval=
+
auth required pam_faillock.so authsucc deny=  unlock_time=604800 fail_interval=
To ensure the failed password attempt policy is configured correctly, run the following command: 
$ grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth
-For each file, the output should show fail_interval=<interval-in-seconds> where interval-in-seconds is 900 (15 minutes) or greater. If the fail_interval parameter is not set, the default setting of 900 seconds is acceptable. +For each file, the output should show fail_interval=<interval-in-seconds> where interval-in-seconds is + or greater. +If the fail_interval parameter is not set, the default setting of 900 seconds is acceptable. Locking out user accounts after a number of incorrect attempts within a specific period of time prevents direct password guessing attacks. - + - + Limit Password Reuse Do not allow users to reuse recent passwords. This can be accomplished by using the remember option for the pam_unix PAM -module. In the file /etc/pam.d/system-auth, append remember=24 to the +module. In the file /etc/pam.d/system-auth, append +remember= to the line which refers to the pam_unix.so module, as shown: -
password sufficient pam_unix.so existing_options remember=24
-The DoD and FISMA requirement is 24 passwords. +
password sufficient pam_unix.so existing_options remember=
+The DoD STIG requirement is 5 passwords. To verify the password reuse setting is compliant, run the following command: 
$ grep remember /etc/pam.d/system-auth
The output should show the following at the end of the line: -
remember=24
+
remember=
 Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user. - + diff --git a/RHEL/7/input/system/accounts/restrictions/password_expiration.xml b/RHEL/7/input/system/accounts/restrictions/password_expiration.xml index d79c4a8..9e56b9d 100644 --- a/RHEL/7/input/system/accounts/restrictions/password_expiration.xml +++ b/RHEL/7/input/system/accounts/restrictions/password_expiration.xml @@ -60,8 +60,8 @@ age, and 7 day warning period with the following command: 7 7 5 -1 2 +1 0 @@ -131,7 +131,7 @@ after satisfying the password reuse requirement. - + @@ -145,7 +145,7 @@ and add or correct the following line, replacing DAYS appropriately: A value of 180 days is sufficient for many environments. The DoD requirement is 60. - + To check the maximum password age, run the command: 
$ grep PASS_MAX_DAYS /etc/login.defs
The DoD and FISMA requirement is 60. @@ -157,9 +157,9 @@ periodically change their passwords. This could possibly decrease the utility of a stolen password. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise. - + - + diff --git a/shared/.gitignore b/shared/.gitignore index d7b3ccb..39328cf 100644 --- a/shared/.gitignore +++ b/shared/.gitignore @@ -1,3 +1,4 @@ # files not to track in git *.pyc *.ini +*.swp diff --git a/shared/references/cce-rhel-avail.txt b/shared/references/cce-rhel-avail.txt index 381d3da..41dc47e 100644 --- a/shared/references/cce-rhel-avail.txt +++ b/shared/references/cce-rhel-avail.txt @@ -1,6 +1,3 @@ -CCE-27051-2 -CCE-26615-5 -CCE-26763-3 CCE-26436-6 CCE-26989-4 CCE-26992-8