From d907acba7aba3676001e0849a2608b95b14b1363 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 3 Sep 2020 16:37:24 +0200
Subject: [PATCH 1/2] update severity, fix ocil

---
 .../accounts-session/accounts_logon_fail_delay/rule.yml       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/rule.yml
index 2888cb365a..9a359b22c5 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/rule.yml
@@ -11,7 +11,7 @@ rationale: |-
     Increasing the time between a failed authentication attempt and re-prompting to
     enter credentials helps to slow a single-threaded brute force attack.
 
-severity: low
+severity: medium
 
 identifiers:
     cce@rhel7: CCE-80352-8
@@ -37,6 +37,6 @@ ocil: |-
     <pre>$ sudo grep -i "FAIL_DELAY" /etc/login.defs</pre>
     All output must show the value of <tt>FAIL_DELAY</tt> set as shown in the below:
     <pre>$ sudo grep -i "FAIL_DELAY" /etc/login.defs
-    fail_delay <sub idref="var_accounts_fail_delay" /></pre>
+    FAIL_DELAY <sub idref="var_accounts_fail_delay" /></pre>
 
 platform: login_defs

From 633f4f12413d27467f63f0676887018c0d147024 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 3 Sep 2020 16:38:19 +0200
Subject: [PATCH 2/2] add tests

---
 .../accounts_logon_fail_delay/tests/correct.pass.sh       | 8 ++++++++
 .../accounts_logon_fail_delay/tests/missing.fail.sh       | 6 ++++++
 .../accounts_logon_fail_delay/tests/stricter.pass.sh      | 8 ++++++++
 .../accounts_logon_fail_delay/tests/wrong.fail.sh         | 8 ++++++++
 4 files changed, 30 insertions(+)
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/correct.pass.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/missing.fail.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/stricter.pass.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/wrong.fail.sh

diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/correct.pass.sh
new file mode 100644
index 0000000000..147f350247
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/correct.pass.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+if grep -q 'FAIL_DELAY' /etc/login.defs; then
+	sed -i 's/^.*FAIL_DELAY.*/FAIL_DELAY 4/' /etc/login.defs
+else
+	echo 'FAIL_DELAY 4' >> /etc/login.defs
+fi
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/missing.fail.sh b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/missing.fail.sh
new file mode 100644
index 0000000000..c9d31494b4
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/missing.fail.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+if grep -q 'FAIL_DELAY' /etc/login.defs; then
+	sed -i '/^.*FAIL_DELAY.*/d' /etc/login.defs
+fi
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/stricter.pass.sh b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/stricter.pass.sh
new file mode 100644
index 0000000000..6154484445
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/stricter.pass.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+if grep -q 'FAIL_DELAY' /etc/login.defs; then
+	sed -i 's/^.*FAIL_DELAY.*/FAIL_DELAY 8/' /etc/login.defs
+else
+	echo 'FAIL_DELAY 8' >> /etc/login.defs
+fi
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/wrong.fail.sh b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/wrong.fail.sh
new file mode 100644
index 0000000000..c1b0d600cb
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/tests/wrong.fail.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# profiles = xccdf_org.ssgproject.content_profile_stig
+
+if grep -q 'FAIL_DELAY' /etc/login.defs; then
+	sed -i 's/^.*FAIL_DELAY.*/FAIL_DELAY 1/' /etc/login.defs
+else
+	echo 'FAIL_DELAY 1' >> /etc/login.defs
+fi