commit 11140ac5d67f256a7d3c8fdac9eca73c007dabb8

Author: Watson Sato <wsato@redhat.com>

Date:   Mon Feb 28 11:04:30 2022 +0100

    Manual edited patch scap-security-guide-0.1.61-update_accounts_password_template-PR_8164.patch.

diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml

index 1d53a71..2e47e16 100644

--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml

@@ -46,7 +46,7 @@ ocil_clause: 'that is not the case'

 ocil: |-

     To check the value for maximum consecutive repeating characters, run the following command:

     
$ grep maxclassrepeat /etc/security/pwquality.conf

-    For DoD systems, the output should show <tt>maxclassrepeat</tt>=4.

+    For DoD systems, the output should show <tt>maxclassrepeat</tt>=4 or less but greater than zero.

 platform: pam

@@ -55,3 +55,4 @@ template:

     vars:

         variable: maxclassrepeat

         operation: less than or equal

+        zero_comparison_operation: greater than

diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value.pass.sh

new file mode 100644

index 0000000..5d91559

--- /dev/null

+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value.pass.sh

@@ -0,0 +1,8 @@

+#!/bin/bash

+

+if grep -q 'maxclassrepeat' /etc/security/pwquality.conf; then

+	sed -i 's/.*maxclassrepeat.*/maxclassrepeat = 4/' /etc/security/pwquality.conf

+else

+	echo "maxclassrepeat = 4" >> /etc/security/pwquality.conf

+fi

+

diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value_less_than_variable.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value_less_than_variable.pass.sh

new file mode 100644

index 0000000..4bd8070

--- /dev/null

+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/correct_value_less_than_variable.pass.sh

@@ -0,0 +1,8 @@

+#!/bin/bash

+

+if grep -q 'maxclassrepeat' /etc/security/pwquality.conf; then

+	sed -i 's/.*maxclassrepeat.*/maxclassrepeat = 2/' /etc/security/pwquality.conf

+else

+	echo "maxclassrepeat = 2" >> /etc/security/pwquality.conf

+fi

+

diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/negative_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/negative_value.fail.sh

new file mode 100644

index 0000000..61538a4

--- /dev/null

+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/negative_value.fail.sh

@@ -0,0 +1,7 @@

+#!/bin/bash

+

+if grep -q 'maxclassrepeat' /etc/security/pwquality.conf; then

+	sed -i 's/.*maxclassrepeat.*/maxclassrepeat = -1/' /etc/security/pwquality.conf

+else

+	echo "maxclassrepeat = -1" >> /etc/security/pwquality.conf

+fi

diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value.fail.sh

new file mode 100644

index 0000000..2218250

--- /dev/null

+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value.fail.sh

@@ -0,0 +1,8 @@

+#!/bin/bash

+

+if grep -q 'maxclassrepeat' /etc/security/pwquality.conf; then

+	sed -i 's/.*maxclassrepeat.*/maxclassrepeat = 5/' /etc/security/pwquality.conf

+else

+	echo "maxclassrepeat = 5" >> /etc/security/pwquality.conf

+fi

+

diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value_0.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value_0.fail.sh

new file mode 100644

index 0000000..780873c

--- /dev/null

+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/tests/wrong_value_0.fail.sh

@@ -0,0 +1,8 @@

+#!/bin/bash

+

+if grep -q 'maxclassrepeat' /etc/security/pwquality.conf; then

+	sed -i 's/.*maxclassrepeat.*/maxclassrepeat = 0/' /etc/security/pwquality.conf

+else

+	echo "maxclassrepeat = 0" >> /etc/security/pwquality.conf

+fi

+

diff --git a/shared/templates/accounts_password/oval.template b/shared/templates/accounts_password/oval.template

index 332a280..b995db1 100644

--- a/shared/templates/accounts_password/oval.template

+++ b/shared/templates/accounts_password/oval.template

@@ -7,11 +7,14 @@

     </criteria>

   </definition>

-  

+  

   comment="check the configuration of /etc/security/pwquality.conf"

   id="test_password_pam_pwquality_{{{ VARIABLE }}}" version="3">

     <ind:object object_ref="obj_password_pam_pwquality_{{{ VARIABLE }}}" />

     <ind:state state_ref="state_password_pam_{{{ VARIABLE }}}" />

+  {{%- if ZERO_COMPARISON_OPERATION %}}

+    <ind:state state_ref="state_password_pam_{{{ VARIABLE }}}_zero_comparison" />

+  {{%- endif %}}

   </ind:textfilecontent54_test>

   <ind:textfilecontent54_object id="obj_password_pam_pwquality_{{{ VARIABLE }}}" version="3">

@@ -24,5 +27,11 @@

     <ind:subexpression datatype="int" operation="{{{ OPERATION }}}" var_ref="var_password_pam_{{{ VARIABLE }}}" />

   </ind:textfilecontent54_state>

+  {{%- if ZERO_COMPARISON_OPERATION %}}

+  <ind:textfilecontent54_state id="state_password_pam_{{{ VARIABLE }}}_zero_comparison" version="1">

+    <ind:subexpression datatype="int" operation="{{{ ZERO_COMPARISON_OPERATION }}}" >0</ind:subexpression>

+  </ind:textfilecontent54_state>

+  {{%- endif %}}

+

   <external_variable comment="External variable for pam_{{{ VARIABLE }}}" datatype="int" id="var_password_pam_{{{ VARIABLE }}}" version="3" />

 </def-group>

diff --git a/shared/templates/accounts_password/template.py b/shared/templates/accounts_password/template.py

index 65c25ec..ab849d1 100644

--- a/shared/templates/accounts_password/template.py

+++ b/shared/templates/accounts_password/template.py

@@ -1,4 +1,7 @@

+from ssg.utils import parse_template_boolean_value

+

 def preprocess(data, lang):

     if lang == "oval":

         data["sign"] = "-?" if data["variable"].endswith("credit") else ""

+    data["zero_comparison_operation"] = data.get("zero_comparison_operation", None)

     return data