<def-group>
  <definition class="compliance" id="set_password_hashing_algorithm_logindefs" version="2">
    <metadata>
      <title>Set SHA512 Password Hashing Algorithm in /etc/login.defs</title>
      <affected family="unix">
        <platform>multi_platform_rhel</platform>
        <platform>multi_platform_fedora</platform>
      </affected>
      <description>The password hashing algorithm should be set correctly in /etc/login.defs.</description>
      <reference source="JL" ref_id="RHEL6_20150201" ref_url="test_attestation" />
      <reference source="JL" ref_id="RHEL7_20150201" ref_url="test_attestation" />
      <reference source="JL" ref_id="FEDORA20_20150201" ref_url="test_attestation" />
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="test_etc_login_defs_encrypt_method" />
    </criteria>
  </definition>

  <ind:variable_test id="test_etc_login_defs_encrypt_method" check="all" comment="The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs" version="1">
    <ind:object object_ref="object_last_encrypt_method_instance_value" />
    <ind:state state_ref="state_last_encrypt_method_instance_value" />
  </ind:variable_test>

  <ind:textfilecontent54_object id="object_last_encrypt_method_from_etc_login_defs" version="1">
    <!-- Read whole /etc/login.defs as single line so we can retrieve last ENCRYPT_METHOD directive occurrence -->
    <ind:behaviors singleline="true" />
    <ind:filepath>/etc/login.defs</ind:filepath>
    <!-- Retrieve last (uncommented) occurrence of ENCRYPT_METHOD directive -->
    <ind:pattern operation="pattern match">.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <!-- Capture the actual ENCRYPT_METHOD string value from the previously retrieved last instance -->
  <local_variable id="variable_last_encrypt_method_instance_value" datatype="string" comment="The value of last ENCRYPT_METHOD directive in /etc/login.defs" version="1">
    <regex_capture pattern="ENCRYPT_METHOD\s+(\w+)">
      <object_component item_field="subexpression" object_ref="object_last_encrypt_method_from_etc_login_defs" />
    </regex_capture>
  </local_variable>

  <!-- Construct OVAL object from this local variable so we can use it in variable test above -->
  <ind:variable_object id="object_last_encrypt_method_instance_value" version="1">
    <ind:var_ref>variable_last_encrypt_method_instance_value</ind:var_ref>
  </ind:variable_object>

  <!-- Define corresponding variable state (the requirement) for the variable object -->
  <!-- The check should PASS if retrieved last ENCRYPT_METHOD value is equal to the requirement -->
  <ind:variable_state id="state_last_encrypt_method_instance_value" version="1">
    <ind:value operation="equals" datatype="string">SHA512</ind:value>
  </ind:variable_state>

</def-group>
