<Group id="module_useradmin">
	<title>UserAdmin Module Required Settings</title>
	<description>To support a secured and compliant configuration, a number of 
	user account settings need to be modified from there default configuration.</description>

	<Value id="var_webmin_module_useradmin_accounts_inactive" type="number" >
	<title>number of days account inactivity until the account is permanently disabled</title>
	<description>The number of days to wait after not logging in to an account, until the account will be permanently disabled.</description>
	<warning category="general">This will only apply to newly created accounts</warning>
	<value selector="">35</value>
	<value selector="30">30</value>
	<value selector="35">35</value>
	<value selector="60">60</value>
	<value selector="90">90</value>
	<value selector="180">180</value>
	</Value>

	<Value id="var_webmin_module_useradmin_accounts_max" type="number" >
	<title>maximum password age</title>
	<description>Maximum age of password in days</description>
	<warning category="general">This will only apply to newly created accounts</warning>
	<value selector="">60</value>
	<value selector="60">60</value>
	<value selector="90">90</value>
	<value selector="120">120</value>
	<value selector="180">180</value>
	</Value>

	<Value id="var_webmin_module_useradmin_accounts_min" type="number" >
	<title>minimum password age</title>
	<description>Minimum age of password in days</description>
	<warning category="general">This will only apply to newly created accounts</warning>
	<value selector="">7</value>
	<value selector="0">0</value>
	<value selector="1">1</value>
	<value selector="2">2</value>
	<value selector="5">5</value>
	<value selector="7">7</value>
	</Value>

	<Value id="var_webmin_module_useradmin_accounts_warn" type="number" >
	<title>warning days before password expires</title>
	<description>The number of days' warning given before a password expires.</description>
	<warning category="general">This will only apply to newly created accounts</warning>
	<value selector="">7</value>
	<value selector="0">0</value>
	<value selector="7">7</value>
	<value selector="14">14</value>
	</Value>

	<Value id="var_webmin_module_useradmin_accounts_password_hash" type="number" >
	<title>password hash algorithm</title>
	<description>The hash algorithm used to store user passwords.</description>
	<warning category="general">This will only apply to newly created accounts</warning>
	<value selector="">4</value>
	<value selector="Automatic">0</value>
	<value selector="DES crypt">1</value>
	<value selector="MD5">2</value>
	<value selector="Blowfish">3</value>
	<value selector="SHA512">4</value>
	</Value>

	<Value id="var_webmin_module_useradmin_accounts_min_length" type="number" >
	<title>minimum password length</title>
	<description>Minimum number of characters in password</description>
	<warning category="general">This will only check new passwords</warning>
	<value selector="">14</value>
	<value selector="6">6</value>
	<!-- NIST 800-53 requires 1 in a million using brute force which translates to six numbers -->
	<value selector="8">8</value>
	<value selector="10">10</value>
	<value selector="12">12</value>
	<value selector="14">14</value>
	</Value>
	
	<Rule id="module_useradmin_accounts_home_perms" severity="medium">
	<title>Configure new accounts to create their home directory with a default permission setting of 750.</title>
	<description>
	New users created through the UserAdmin Webmin module 
	must have the default permissions of 750 applied to their home directory when created.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_home_perms"/>
	<ident cce="" />
	<ref nist="IA-5(f)" />
	</Rule>

	<Rule id="module_useradmin_accounts_inactive" severity="medium">
	<title>Configure new accounts to lock out after a number of days 
	of no activity.</title>
	<description>
	New users created through the UserAdmin Webmin module 
	must include required account expiration criteria.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_inactive" value="var_webmin_module_useradmin_accounts_inactive"/>
	<ident cce="" />
	<ref nist="AC-2(2), AC-2(3)" disa="16,17,795"/>
	</Rule>

	<Rule id="module_useradmin_accounts_max" severity="medium">
	<title>Configure new accounts to expire their password after a maximum number days.</title>
	<description>
	New users created through the UserAdmin Webmin module 
	must include required maximum password life criteria.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_max" value="var_webmin_module_useradmin_accounts_max"/>
	<ident cce="" />
	<ref nist="IA-5(f),IA-5(g),IA-5(1)(d)" disa="180,199" />
	</Rule>

	<Rule id="module_useradmin_accounts_min" severity="medium">
	<title>Configure new accounts to prevent changing passwords more than once per the minimum number of days defined.</title>
	<description>
	New users created through the UserAdmin Webmin module 
	must include required minimum password life criteria.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_min" value="var_webmin_module_useradmin_accounts_min"/>
	<ident cce="" />
	<ref nist="IA-5(f),IA-5(1)(d)" disa="198"/>
	</Rule>

	<Rule id="module_useradmin_accounts_warn" severity="medium">
	<title>Configure new accounts to warn the user about their password expiring.</title>
	<description>
	New users created through the UserAdmin Webmin module 
	must include required account password expiration warning criteria.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_warn" value="var_webmin_module_useradmin_accounts_warn"/>
	<ident cce="" />
	<ref nist="IA-5(f)" />
	</Rule>

	<Rule id="module_useradmin_accounts_password_hash" severity="medium">
	<title>Configure the UserAdmin Webmin module to store passwords created using a specified hashing algorithm.</title>
	<description>
	Passwords generated through the UserAdmin Webmin module 
	must be stored using the specified hashing algorithm.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_password_hash" value="var_webmin_module_useradmin_accounts_password_hash"/>
	<ident cce="" />
	<ref nist="IA-5(f)"/>
	</Rule>

	<Rule id="module_useradmin_accounts_min_length" severity="medium">
	<title>Configure the UserAdmin Webmin module to require a minimum number of characters in passwords defined.</title>
	<description>
	Passwords created through the UserAdmin Webmin module 
	must include the minimum defined number of characters in the password.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_min_length" value="var_webmin_module_useradmin_accounts_min_length"/>
	<ident cce="" />
	<ref nist="IA-5(f),IA-5(1)(a)" disa="205" />
	</Rule>

	<Rule id="module_useradmin_accounts_char_types" severity="medium">
	<title>Configure the UserAdmin Webmin module to require at least 1 upper-case character, 1 lower-case character, 1 numeric character, and 1 special character.</title>
	<description>
	Passwords created through the UserAdmin Webmin module 
	must include at least 1 upper-case character, 1 lower-case character, 1 numeric character, and 1 special character.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_char_types"/>
	<ident cce="" />
	<ref nist="IA-5(f),IA-5(1)(a)" disa="205" />
	</Rule>

	<Rule id="module_useradmin_accounts_password_dictionary" severity="medium">
	<title>Configure the UserAdmin Webmin module to require passwords to not include dictionary words.</title>
	<description>
	Passwords created through the UserAdmin Webmin module 
	must not include dictionary words.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_password_dictionary"/>
	<ident cce="" />
	<ref nist="IA-5(f),IA-5(1)(a)" disa="205" />
	</Rule>

	<Rule id="module_useradmin_accounts_password_same" severity="medium">
	<title>Configure the UserAdmin Webmin module to require passwords to be different from the previously configured password.</title>
	<description>
	Passwords created through the UserAdmin Webmin module 
	must not be the same as the previous password used.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_password_same"/>
	<ident cce="" />
	<ref nist="IA-5(f),IA-5(1)(a)" disa="205" />
	</Rule>

	<Rule id="module_useradmin_accounts_password_masked" severity="medium">
	<title>Configure the UserAdmin Webmin module to mask the password characters entered with stars.</title>
	<description>
	The UserAdmin Webmin module must not display the characters entered for the password in clear text.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_password_masked" />
	<ident cce="" />
	<ref nist="IA-5(f)" />
	</Rule>

	<Rule id="module_useradmin_accounts_last_login" severity="medium">
	<title>Configure the UserAdmin Webmin module to display last login information for all users.</title>
	<description>
	User last login information must be displayed to support detecting unauthorized access.
	</description>
	<rationale>
	</rationale>
	<oval id="module_useradmin_accounts_last_login" />
	<ident cce="" />
	<ref nist="IA-5(f)" />
	</Rule>

</Group>
