rpms / scap-security-guide

Clone
Source Code
GIT

Files

  1.   889f2b583f8e6c5f14571e0d693652afe8844c45
  2.   SOURCES
  3.   scap-security-guide-0.1.58-RHEL_08_020300-PR_7289.patch
Blob Blame History Raw 
From 2af7d6d8f86f80dbac088d115a50162cfc28c542 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Tue, 27 Jul 2021 07:49:50 -0500
Subject: [PATCH] Add rule for RHEL-08-020300

---
 .../accounts_password_pam_dictcheck/rule.yml  | 45 +++++++++++++++++++
 .../tests/disabled.fail.sh                    |  3 ++
 .../tests/enable.pass.sh                      |  3 ++
 .../tests/not_defined.fail.sh                 |  3 ++
 .../var_password_pam_dictcheck.var            | 16 +++++++
 products/rhel8/profiles/stig.profile          |  2 +
 shared/references/cce-redhat-avail.txt        |  1 -
 .../data/profile_stability/rhel8/stig.profile |  2 +
 .../profile_stability/rhel8/stig_gui.profile  |  2 +
 9 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
 create mode 100644 linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var

diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
new file mode 100644
index 0000000000..2990150c0a
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml
@@ -0,0 +1,45 @@
+documentation_complete: true
+
+prodtype: fedora,rhel8
+
+title: 'Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words'
+
+description: |-
+    The pam_pwquality module's <tt>dictcheck</tt> check if passwords contains dictionary words. When
+    <tt>dictcheck</tt> is set to <tt>1</tt> passwords will be checked for dictionary words.
+
+rationale: |-
+    Use of a complex password helps to increase the time and resources required to compromise the password.
+    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at
+    guessing and brute-force attacks.
+    <br /><br />
+    Password complexity is one factor of several that determines how long it takes to crack a password. The more
+    complex the password, the greater the number of possible combinations that need to be tested before the
+    password is compromised.
+    <br /><br />
+    Passwords with dictionary words may be more vulnerable to password-guessing attacks.
+
+severity: medium
+
+identifiers:
+    cce@rhel8: CCE-86233-4
+
+references:
+    disa: CCI-000366
+    nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4)
+    stigid@rhel8: RHEL-08-020300
+
+ocil_clause: 'dictcheck is not found or not equal to the required value'
+
+ocil: |-
+    To check if dictionary words are disallowed run the following command:
+    <pre>$ sudo grep dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf</pre>
+    The <tt>dictcheck</tt> parameter should be equal to 1. The value should look like
+    <pre>dictcheck=1</pre>
+
+
+template:
+    name: accounts_password
+    vars:
+        variable: dictcheck
+        operation: equals
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
new file mode 100644
index 0000000000..cb84c6d968
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/disabled.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "dictcheck=0" > /etc/security/pwquality.conf
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
new file mode 100644
index 0000000000..ceb9f7ec44
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/enable.pass.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "dictcheck=1" > /etc/security/pwquality.conf
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
new file mode 100644
index 0000000000..57e54b6623
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/tests/not_defined.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+sed -i s/dictcheck.+//g /etc/security/pwquality.conf
diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
new file mode 100644
index 0000000000..26452c3a8e
--- /dev/null
+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/var_password_pam_dictcheck.var
@@ -0,0 +1,16 @@
+documentation_complete: true
+
+title: dictcheck
+
+description: |-
+    Prevent the use of dictionary words for passwords.
+
+type: number
+
+operator: equals
+
+interactive: false
+
+options:
+    1: 1
+    default: 1
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index bf410c2087..f17a7b88b1 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -45,6 +45,7 @@ selections:
     - var_password_pam_minlen=15
     - var_password_pam_ocredit=1
     - var_password_pam_dcredit=1
+    - var_password_pam_dictcheck=1
     - var_password_pam_ucredit=1
     - var_password_pam_lcredit=1
     - var_password_pam_retry=3
@@ -567,6 +568,7 @@ selections:
     - sssd_offline_cred_expiration
 
     # RHEL-08-020300
+    - accounts_password_pam_dictcheck
 
     # RHEL-08-020310
     - accounts_logon_fail_delay
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index 0b794d5c2a..dae4495b2d 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -362,7 +362,6 @@ CCE-86229-2
 CCE-86230-0
 CCE-86231-8
 CCE-86232-6
-CCE-86233-4
 CCE-86234-2
 CCE-86235-9
 CCE-86236-7
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index ddfa13e731..236e595604 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -35,6 +35,7 @@ selections:
 - accounts_password_all_shadowed_sha512
 - accounts_password_minlen_login_defs
 - accounts_password_pam_dcredit
+- accounts_password_pam_dictcheck
 - accounts_password_pam_difok
 - accounts_password_pam_lcredit
 - accounts_password_pam_maxclassrepeat
@@ -332,6 +333,7 @@ selections:
 - var_password_pam_minlen=15
 - var_password_pam_ocredit=1
 - var_password_pam_dcredit=1
+- var_password_pam_dictcheck=1
 - var_password_pam_ucredit=1
 - var_password_pam_lcredit=1
 - var_password_pam_retry=3
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index 017ab8c0e3..9973b5adef 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -46,6 +46,7 @@ selections:
 - accounts_password_all_shadowed_sha512
 - accounts_password_minlen_login_defs
 - accounts_password_pam_dcredit
+- accounts_password_pam_dictcheck
 - accounts_password_pam_difok
 - accounts_password_pam_lcredit
 - accounts_password_pam_maxclassrepeat
@@ -342,6 +343,7 @@ selections:
 - var_password_pam_minlen=15
 - var_password_pam_ocredit=1
 - var_password_pam_dcredit=1
+- var_password_pam_dictcheck=1
 - var_password_pam_ucredit=1
 - var_password_pam_lcredit=1
 - var_password_pam_retry=3

Powered by Pagure 5.14.1

SSH Hostkey/Fingerprint | Documentation