Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adjust set_password_hashing_algorithm_* for RHEL 10 #12782

Merged
merged 5 commits into from
Jan 10, 2025
+20 −21
Merged

Adjust set_password_hashing_algorithm_* for RHEL 10 #12782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d4714cb
Update set_password_hashing_algorithm_passwordauth for RHEL 10
Mab879 Jan 7, 2025
ba93c22
Update set_password_hashing_algorithm_systemauth for RHEL 10
Mab879 Jan 7, 2025
5cf3aa4
RHEL 10 ISM O control should use yescrypt
Mab879 Jan 7, 2025
12248c4
RHEL 10 STIG should use yescrypt
Mab879 Jan 7, 2025
105a8ca
Fix bash remedation for set_password_hashing_algorithm_systemauth
Mab879 Jan 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion controls/ism_o.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ controls:
- set_password_hashing_algorithm_passwordauth
- set_password_hashing_algorithm_systemauth
- sshd_disable_gssapi_auth
- var_password_hashing_algorithm_pam=sha512
- var_password_hashing_algorithm_pam=yescrypt
status: automated

- id: '0421'
Expand Down
3 changes: 1 addition & 2 deletions controls/srg_gpos/SRG-OS-000730-GPOS-00190.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ controls:
- var_password_pam_maxclassrepeat=3
- var_password_pam_dictcheck=1
- accounts_password_pam_dictcheck
- var_password_hashing_algorithm_pam=sha512
- var_password_pam_unix_rounds=5000
- var_password_pam_unix_rounds=5
- var_password_pam_remember=5
- var_password_pam_remember_control_flag=requisite_or_required
2 changes: 1 addition & 1 deletion ...s-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ ocil: |-

platform: package[pam]

{{% if product in ['ol9', 'rhel9'] %}}
{{% if product in ['ol9', 'rhel9', 'rhel10'] %}}
srg_requirement: 'The {{{ full_name }}} pam_unix.so module must be configured in the password-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.'

fixtext: |-
Expand Down
2 changes: 1 addition & 1 deletion ...orithm/set_password_hashing_algorithm_passwordauth/tests/authselect_correct_value.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512

authselect create-profile hardening -b sssd
Expand Down
2 changes: 1 addition & 1 deletion ...thm/set_password_hashing_algorithm_passwordauth/tests/authselect_incorrect_option.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512

authselect create-profile hardening -b sssd
Expand Down
2 changes: 1 addition & 1 deletion ...rithm/set_password_hashing_algorithm_passwordauth/tests/authselect_missing_option.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512

authselect create-profile hardening -b sssd
Expand Down
2 changes: 1 addition & 1 deletion ...gorithm/set_password_hashing_algorithm_passwordauth/tests/authselect_modified_pam.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512
# remediation = none

Expand Down
2 changes: 1 addition & 1 deletion ...thm/set_password_hashing_algorithm_passwordauth/tests/authselect_multiple_options.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512

authselect create-profile hardening -b sssd
Expand Down
2 changes: 1 addition & 1 deletion ...orithm/set_password_hashing_algorithm_passwordauth/tests/authselect_wrong_control.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512

authselect create-profile hardening -b sssd
Expand Down
6 changes: 3 additions & 3 deletions ...m/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,13 @@

{{% if 'sle' in product or 'slmicro' in product -%}}
PAM_FILE_PATH="/etc/pam.d/common-password"
CONTROL="required"
{{% set control = "required" %}}
{{%- elif 'ubuntu' in product -%}}
{{{ bash_pam_unix_enable() }}}
PAM_FILE_PATH=/usr/share/pam-configs/cac_unix
{{%- else -%}}
PAM_FILE_PATH="/etc/pam.d/system-auth"
CONTROL="sufficient"
{{% set control = "sufficient" %}}
{{%- endif %}}

{{% if 'ubuntu' in product -%}}
Expand All @@ -31,7 +31,7 @@ if ! grep -qzP "Password-Initial:\s*\n\s+.*\s+pam_unix.so\s+.*\b$var_password_ha
fi

{{%- else -%}}
{{{ bash_ensure_pam_module_configuration("$PAM_FILE_PATH", 'password', "$CONTROL", 'pam_unix.so', "$var_password_hashing_algorithm_pam", '', '') }}}
{{{ bash_ensure_pam_module_configuration("$PAM_FILE_PATH", 'password', control, 'pam_unix.so', "$var_password_hashing_algorithm_pam", '', '') }}}
{{%- endif %}}

# Ensure only the correct hashing algorithm option is used.
Expand Down
4 changes: 2 additions & 2 deletions ...nts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ ocil: |-
platform: package[pam]

fixtext: |-
{{% if product in ['ol9', 'rhel9', 'ubuntu2204', 'ubuntu2404'] -%}}
{{% if product in ['ol9', 'rhel9', 'rhel10', 'ubuntu2204', 'ubuntu2404'] -%}}
Configure {{{ full_name }}} to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.
{{% else %}}
Configure {{{ full_name }}} to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.
Expand All @@ -106,7 +106,7 @@ fixtext: |-
password sufficient pam_unix.so {{{ xccdf_value("var_password_hashing_algorithm_pam") }}}
{{%- endif %}}

{{% if product in ['ol9', 'rhel9'] -%}}
{{% if product in ['ol9', 'rhel9', 'rhel10'] -%}}
srg_requirement: 'The {{{ full_name }}} pam_unix.so module must be configured in the system-auth file to use a FIPS 140-3 approved cryptographic hashing algorithm for system authentication.'
{{%- endif %}}

Expand Down
2 changes: 1 addition & 1 deletion ...lgorithm/set_password_hashing_algorithm_systemauth/tests/authselect_correct_value.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512

authselect create-profile hardening -b sssd
Expand Down
2 changes: 1 addition & 1 deletion ...rithm/set_password_hashing_algorithm_systemauth/tests/authselect_incorrect_option.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512

authselect create-profile hardening -b sssd
Expand Down
2 changes: 1 addition & 1 deletion ...gorithm/set_password_hashing_algorithm_systemauth/tests/authselect_missing_option.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512

authselect create-profile hardening -b sssd
Expand Down
2 changes: 1 addition & 1 deletion ...algorithm/set_password_hashing_algorithm_systemauth/tests/authselect_modified_pam.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512
# remediation = none

Expand Down
2 changes: 1 addition & 1 deletion ...rithm/set_password_hashing_algorithm_systemauth/tests/authselect_multiple_options.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512

authselect create-profile hardening -b sssd
Expand Down
2 changes: 1 addition & 1 deletion ...lgorithm/set_password_hashing_algorithm_systemauth/tests/authselect_wrong_control.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel,multi_platform_fedora
# variables = var_password_hashing_algorithm_pam=sha512

authselect create-profile hardening -b sssd
Expand Down
Loading