From a0801693f0a504deba0b2295074d4da7c4c4eaa4 Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Thu, 24 Sep 2026 20:31:06 -0700 Subject: [PATCH 01/13] Fix lineinfile Ansible template emitting empty regexp --- shared/templates/lineinfile/ansible.template | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/shared/templates/lineinfile/ansible.template b/shared/templates/lineinfile/ansible.template index ebcd780919f..90d96606751 100644 --- a/shared/templates/lineinfile/ansible.template +++ b/shared/templates/lineinfile/ansible.template @@ -6,5 +6,4 @@ {{%- set _lineinfile_default_mode = FILEMODE if FILEMODE else '0644' %}} {{{ ansible_stat("Check the current permissions of " ~ PATH ~ " to preserve them", path=PATH, register="lineinfile_mode_stat") }}} -{{{ ansible_lineinfile(msg='', path=PATH, new_line=TEXT, create='yes', mode="{{ lineinfile_mode_stat.stat.mode if lineinfile_mode_stat.stat.exists else '" ~ _lineinfile_default_mode ~ "' }}", state='present', insert_after='', insert_before='', rule_title=rule_title) -}}} - +{{{ ansible_lineinfile(msg='', path=PATH, new_line=TEXT, regex=REGEX, create='yes', mode="{{ lineinfile_mode_stat.stat.mode if lineinfile_mode_stat.stat.exists else '" ~ _lineinfile_default_mode ~ "' }}", state='present', insert_after='', insert_before='', rule_title=rule_title) -}}} From 6dc162139ee84b086ed6b22b2b64da8346cbfbf9 Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Thu, 24 Sep 2026 20:41:29 -0700 Subject: [PATCH 02/13] Add regex to accounts_password_pam_enforce_root rule --- .../rule.yml | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml index 569bfe9987b..98b7c7570c2 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml @@ -1,62 +1,83 @@ documentation_complete: true + + title: 'Ensure PAM Enforces Password Requirements - Enforce for root User' + description: |- The pam_pwquality module's enforce_for_root parameter controls requirements for enforcing password complexity for the root user. Enable the enforce_for_root setting in {{{ pwquality_path }}} to require the root user to use complex passwords. + rationale: |- Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. + Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. + severity: medium + identifiers: cce@rhel8: CCE-83377-2 cce@rhel9: CCE-86356-3 cce@rhel10: CCE-90134-8 + references: nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4) srg: SRG-OS-000072-GPOS-00040,SRG-OS-000071-GPOS-00039,SRG-OS-000070-GPOS-00038,SRG-OS-000266-GPOS-00101,SRG-OS-000078-GPOS-00046,SRG-OS-000480-GPOS-00225,SRG-OS-000069-GPOS-00037 + ocil_clause: '"enforce_for_root" is commented or missing' + ocil: |- Verify that {{{ full_name }}} enforces password complexity rules for the root account. + Check if root user is required to use complex passwords with the following command: + 
$ grep enforce_for_root {{{ pwquality_path }}} /etc/security/pwquality.conf.d/*.conf
 
+
     {{{ pwquality_path }}}:enforce_for_root
+ fixtext: |- Configure {{{ full_name }}} to enforce password complexity on the root account. + Add or update the following line in {{{ pwquality_path }}}: + enforce_for_root + srg_requirement: |- {{{ full_name }}} must enforce password complexity rules for the root account. + platform: package[libpwquality] + template: name: "lineinfile" vars: text: "enforce_for_root" + regex: '^[\s]*enforce_for_root\b' path: "{{{ pwquality_path }}}" filemode: '0644' backends: oval: off + From bbc2901bd062e184d6bdfb0e2fa683f7bb20a522 Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Thu, 24 Sep 2026 20:42:17 -0700 Subject: [PATCH 03/13] Add regex to accounts_password_pam_enforce_local rule --- .../accounts_password_pam_enforce_local/rule.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml index 563dda34d1e..04493b5b699 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml @@ -1,8 +1,11 @@ documentation_complete: true + + title: 'Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only' + description: |- The pam_pwquality module's local_users_only parameter controls requirements for enforcing password complexity by pam_pwquality only for local user accounts and ignoring @@ -10,39 +13,50 @@ description: |- setting in {{{ pwquality_path }}} to require password complexity enforcement for only local user accounts. + rationale: |- The operating system must provide automated mechanisms for supporting account management functions. Enterprise environments make application account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other error. + severity: medium + identifiers: cce@rhel8: CCE-83364-0 + references: nist: AC-2(1) srg: SRG-OS-000001-GPOS-00001 + ocil_clause: 'local_users_only is not uncommented or configured correctly' + ocil: |- To verify if password complexities are only enforce on local users, run the following command: 
$ grep local_users_only {{{ pwquality_path }}}
The output should return local_users_only uncommented. + platform: package[libpwquality] + warnings: - management: |- Using this rule bypasses pam_faillock's functionality and should be used in cases where centralized management such as LDAP or Active Directory is in use. + template: name: "lineinfile" vars: text: "local_users_only" + regex: '^[\s]*local_users_only\b' path: "{{{ pwquality_path }}}" oval_extend_definitions: - accounts_password_pam_pwquality + From 7943972eac9e7d3ccb9fb018a1ead22c5d8073ac Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Thu, 24 Sep 2026 20:43:11 -0700 Subject: [PATCH 04/13] Add regex to accounts_password_pam_enforcing rule --- .../accounts_password_pam_enforcing/rule.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml index 53b571a0b6a..a634f134627 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml @@ -1,12 +1,16 @@ documentation_complete: true + + title: 'Ensure PAM Enforces Password Requirements - Enforcing' + description: |- Verify that the operating system uses "pwquality" to enforce the password complexity rules. + Verify the pwquality module is being enforced by operating system by running the following command: 
@@ -14,9 +18,11 @@ description: |-
     enforcing = 1
+ If the value of "enforcing" is not "1" or the line is commented out, this is a finding. + rationale: |- Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, @@ -25,20 +31,26 @@ rationale: |- enforces complex password construction configuration and has the ability to limit brute-force attacks on the system. + severity: medium + references: srg: SRG-OS-000480-GPOS-00225 + ocil_clause: 'enforcing is not uncommented or configured correctly' + ocil: |- To verify that enforcing is correctly applied, run the following command: 
$ grep -i enforcing {{{ pwquality_path }}}
The output should return enforcing = 1 uncommented. + platform: package[libpwquality] + {{% if product == "ubuntu2404" %}} template: name: accounts_password @@ -50,7 +62,9 @@ template: name: "lineinfile" vars: text: "enforcing = 1" + regex: '^[\s]*enforcing[\s]*=[\s]*1\b' path: "{{{ pwquality_path }}}" oval_extend_definitions: - accounts_password_pam_pwquality {{% endif %}} + From 97e9284a739a1100c5b04e5da02b6808d6af8008 Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Thu, 24 Sep 2026 20:44:15 -0700 Subject: [PATCH 05/13] Add regex to accounts_password_pam_pwhistory_enforce_for_root rule --- .../rule.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_for_root/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_for_root/rule.yml index d196bb569a3..d7baa0f7d60 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_for_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_for_root/rule.yml @@ -1,28 +1,36 @@ documentation_complete: true + title: Ensure Password History Is Enforced for the Root User + description: |- The enforce_for_root option enforces password history for the root user. Enable the enforce_for_root setting in /etc/security/pwhistory.conf to require the root user to use a password that has not been used recently. + rationale: |- Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password. + identifiers: cce@rhel8: CCE-86734-1 cce@rhel9: CCE-86742-4 cce@rhel10: CCE-87591-4 + severity: medium + platform: package[pam] + template: name: lineinfile vars: text: "enforce_for_root" + regex: '^[\s]*enforce_for_root\b' path: "/etc/security/pwhistory.conf" filemode: '0644' From 003857d61f484f5e45b63872557d9287d8581508 Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Thu, 24 Sep 2026 20:49:28 -0700 Subject: [PATCH 06/13] Add regex to verify_use_mappers rule --- .../smart_card_login/verify_use_mappers/rule.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml index b96c0b8793e..6cbfd5b139d 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml @@ -1,43 +1,59 @@ documentation_complete: true + + title: "Verify that 'use_mappers' is set to 'pwent' in PAM" + description: |- The operating system must map the authenticated identity to the user or group account for PKI-based authentication. + Verify that use_mappers is set to pwent in /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: + 
$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
 
+
     use_mappers = pwent
+ rationale: |- Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis. + severity: low + references: srg: SRG-OS-000068-GPOS-00036 + ocil_clause: 'use_mappers is not uncommented or configured correctly' + ocil: |- Verify that use_mappers is set to pwent in /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: + 
$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
 
+
     use_mappers = pwent
+ template: name: lineinfile vars: text: "use_mappers = pwent" + regex: '^[\s]*use_mappers[\s]*=[\s]*pwent\b' path: /etc/pam_pkcs11/pam_pkcs11.conf oval_extended_definitions: smartcard_configure_cert_checking + From 8b969e7ed623894acefbb41f6eb7009d6d3b6421 Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Fri, 25 Sep 2026 09:23:03 -0700 Subject: [PATCH 07/13] Remove spurious blank lines from rule.yml Signed-off-by: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> --- .../rule.yml | 66 +++++++------------ 1 file changed, 24 insertions(+), 42 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml index 04493b5b699..d6f17802f89 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml @@ -1,62 +1,44 @@ documentation_complete: true - - -title: 'Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only' - +title: "Verify that 'use_mappers' is set to 'pwent' in PAM" description: |- - The pam_pwquality module's local_users_only parameter controls requirements for - enforcing password complexity by pam_pwquality only for local user accounts and ignoring - centralized user account management password complexity configurations. Enable the local_users_only - setting in {{{ pwquality_path }}} to require password complexity enforcement - for only local user accounts. + The operating system must map the authenticated identity to the user or + group account for PKI-based authentication. + Verify that use_mappers is set to pwent in + /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: -rationale: |- - The operating system must provide automated mechanisms for supporting account management - functions. Enterprise environments make application account management challenging and - complex. A manual process for account management functions adds the risk of a potential - oversight or other error. + 
$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
 
+    use_mappers = pwent
-severity: medium - - -identifiers: - cce@rhel8: CCE-83364-0 +rationale: |- + Without mapping the certificate used to authenticate to the user account, + the ability to determine the identity of the individual user or group will + not be available for forensic analysis. +severity: low references: - nist: AC-2(1) - srg: SRG-OS-000001-GPOS-00001 - - -ocil_clause: 'local_users_only is not uncommented or configured correctly' + srg: SRG-OS-000068-GPOS-00036 +ocil_clause: 'use_mappers is not uncommented or configured correctly' ocil: |- - To verify if password complexities are only enforce on local users, run the following command: - 
$ grep local_users_only {{{ pwquality_path }}}
- The output should return local_users_only uncommented. - + Verify that use_mappers is set to pwent in + /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: -platform: package[libpwquality] - - -warnings: - - management: |- - Using this rule bypasses pam_faillock's functionality and should be used in cases - where centralized management such as LDAP or Active Directory is in use. + 
$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
 
+    use_mappers = pwent
template: - name: "lineinfile" + name: lineinfile vars: - text: "local_users_only" - regex: '^[\s]*local_users_only\b' - path: "{{{ pwquality_path }}}" - oval_extend_definitions: - - accounts_password_pam_pwquality - + text: "use_mappers = pwent" + regex: '^[\s]*use_mappers[\s]*=[\s]*pwent\b' + path: /etc/pam_pkcs11/pam_pkcs11.conf + oval_extended_definitions: + smartcard_configure_cert_checking From 606e0ffb0e722ee42e2f4491a5c27232e02eb6b1 Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Fri, 25 Sep 2026 09:23:48 -0700 Subject: [PATCH 08/13] Remove spurious blank lines from rule.yml Signed-off-by: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> --- .../accounts_password_pam_enforcing/rule.yml | 80 +++++++++---------- 1 file changed, 36 insertions(+), 44 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml index a634f134627..d2816e4a6bf 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml @@ -1,70 +1,62 @@ documentation_complete: true - - -title: 'Ensure PAM Enforces Password Requirements - Enforcing' - +title: 'Ensure PAM Enforces Password Requirements - Enforce for root User' description: |- - Verify that the operating system uses "pwquality" to enforce the - password complexity rules. - + The pam_pwquality module's enforce_for_root parameter controls requirements for + enforcing password complexity for the root user. Enable the enforce_for_root + setting in {{{ pwquality_path }}} to require the root user + to use complex passwords. - Verify the pwquality module is being enforced by operating system by - running the following command: - 
-    $ grep -i enforcing {{{ pwquality_path }}}
-    enforcing = 1
-
+rationale: |- + Use of a complex password helps to increase the time and resources required to compromise + the password. Password complexity, or strength, is a measure of the effectiveness of a + password in resisting attempts at guessing and brute-force attacks. + Password complexity is one factor of several that determines how long it takes to crack a + password. The more complex the password, the greater the number of possible combinations + that need to be tested before the password is compromised. - If the value of "enforcing" is not "1" or the line is commented out, - this is a finding. +severity: medium +identifiers: + cce@rhel8: CCE-83377-2 + cce@rhel9: CCE-86356-3 + cce@rhel10: CCE-90134-8 -rationale: |- - Use of a complex password helps to increase the time and resources - required to compromise the password. Password complexity, or strength, - is a measure of the effectiveness of a password in resisting attempts at - guessing and brute-force attacks. Using enforcing=1 ensures "pwquality" - enforces complex password construction configuration and has the ability - to limit brute-force attacks on the system. +references: + nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4) + srg: SRG-OS-000072-GPOS-00040,SRG-OS-000071-GPOS-00039,SRG-OS-000070-GPOS-00038,SRG-OS-000266-GPOS-00101,SRG-OS-000078-GPOS-00046,SRG-OS-000480-GPOS-00225,SRG-OS-000069-GPOS-00037 +ocil_clause: '"enforce_for_root" is commented or missing' -severity: medium +ocil: |- + Verify that {{{ full_name }}} enforces password complexity rules for the root account. + Check if root user is required to use complex passwords with the following command: -references: - srg: SRG-OS-000480-GPOS-00225 + 
$ grep enforce_for_root {{{ pwquality_path }}} /etc/security/pwquality.conf.d/*.conf
 
+    {{{ pwquality_path }}}:enforce_for_root
-ocil_clause: 'enforcing is not uncommented or configured correctly' +fixtext: |- + Configure {{{ full_name }}} to enforce password complexity on the root account. + Add or update the following line in {{{ pwquality_path }}}: -ocil: |- - To verify that enforcing is correctly applied, run the following command: - 
$ grep -i enforcing {{{ pwquality_path }}}
- The output should return enforcing = 1 uncommented. + enforce_for_root +srg_requirement: |- + {{{ full_name }}} must enforce password complexity rules for the root account. platform: package[libpwquality] - -{{% if product == "ubuntu2404" %}} -template: - name: accounts_password - vars: - variable: enforcing - operation: equals -{{% else %}} template: name: "lineinfile" vars: - text: "enforcing = 1" - regex: '^[\s]*enforcing[\s]*=[\s]*1\b' + text: "enforce_for_root" + regex: '^[\s]*enforce_for_root\b' path: "{{{ pwquality_path }}}" - oval_extend_definitions: - - accounts_password_pam_pwquality -{{% endif %}} - + backends: + oval: off From e7393249e98a80930ec5624dc735d3dd4aeaf8ce Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Fri, 25 Sep 2026 09:24:15 -0700 Subject: [PATCH 09/13] Remove spurious blank lines from rule.yml Signed-off-by: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> --- .../verify_use_mappers/rule.yml | 61 +++++-------------- 1 file changed, 15 insertions(+), 46 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml index 6cbfd5b139d..76d69663415 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml @@ -1,59 +1,28 @@ documentation_complete: true - - - -title: "Verify that 'use_mappers' is set to 'pwent' in PAM" - +title: Ensure Password History Is Enforced for the Root User description: |- - The operating system must map the authenticated identity to the user or - group account for PKI-based authentication. - - - Verify that use_mappers is set to pwent in - /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: - - - 
$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
-
-
-    use_mappers = pwent
- + The enforce_for_root option enforces password history for the root user. + Enable the enforce_for_root setting in /etc/security/pwhistory.conf + to require the root user to use a password that has not been used recently. rationale: |- - Without mapping the certificate used to authenticate to the user account, - the ability to determine the identity of the individual user or group will - not be available for forensic analysis. + Requiring users not to reuse their passwords make it less likely that an attacker will be + able to guess the password or use a compromised password. +identifiers: + cce@rhel8: CCE-86734-1 + cce@rhel9: CCE-86742-4 + cce@rhel10: CCE-87591-4 -severity: low - - -references: - srg: SRG-OS-000068-GPOS-00036 - - -ocil_clause: 'use_mappers is not uncommented or configured correctly' - - -ocil: |- - Verify that use_mappers is set to pwent in - /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: - - - 
$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
-
-
-    use_mappers = pwent
+severity: medium +platform: package[pam] template: name: lineinfile vars: - text: "use_mappers = pwent" - regex: '^[\s]*use_mappers[\s]*=[\s]*pwent\b' - path: /etc/pam_pkcs11/pam_pkcs11.conf - oval_extended_definitions: - smartcard_configure_cert_checking - + text: "enforce_for_root" + regex: '^[\s]*enforce_for_root\b' + path: "/etc/security/pwhistory.conf" From b354ac29330b4ef7ce8696839339a7837363a0e9 Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Fri, 25 Sep 2026 09:31:59 -0700 Subject: [PATCH 10/13] Remove spurious blank lines from rule.yml Signed-off-by: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> --- .../rule.yml | 57 ++++++++++--------- 1 file changed, 31 insertions(+), 26 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml index d6f17802f89..848134334af 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml @@ -1,44 +1,49 @@ documentation_complete: true -title: "Verify that 'use_mappers' is set to 'pwent' in PAM" +title: 'Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only' description: |- - The operating system must map the authenticated identity to the user or - group account for PKI-based authentication. - - Verify that use_mappers is set to pwent in - /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: - - 
$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
-
-    use_mappers = pwent
+ The pam_pwquality module's local_users_only parameter controls requirements for + enforcing password complexity by pam_pwquality only for local user accounts and ignoring + centralized user account management password complexity configurations. Enable the local_users_only + setting in {{{ pwquality_path }}} to require password complexity enforcement + for only local user accounts. rationale: |- - Without mapping the certificate used to authenticate to the user account, - the ability to determine the identity of the individual user or group will - not be available for forensic analysis. + The operating system must provide automated mechanisms for supporting account management + functions. Enterprise environments make application account management challenging and + complex. A manual process for account management functions adds the risk of a potential + oversight or other error. + +severity: medium -severity: low +identifiers: + cce@rhel8: CCE-83364-0 references: - srg: SRG-OS-000068-GPOS-00036 + nist: AC-2(1) + srg: SRG-OS-000001-GPOS-00001 -ocil_clause: 'use_mappers is not uncommented or configured correctly' +ocil_clause: 'local_users_only is not uncommented or configured correctly' ocil: |- - Verify that use_mappers is set to pwent in - /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: + To verify if password complexities are only enforce on local users, run the following command: + 
$ grep local_users_only {{{ pwquality_path }}}
+ The output should return local_users_only uncommented. - 
$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
+platform: package[libpwquality]
 
-    use_mappers = pwent
+warnings: + - management: |- + Using this rule bypasses pam_faillock's functionality and should be used in cases + where centralized management such as LDAP or Active Directory is in use. template: - name: lineinfile + name: "lineinfile" vars: - text: "use_mappers = pwent" - regex: '^[\s]*use_mappers[\s]*=[\s]*pwent\b' - path: /etc/pam_pkcs11/pam_pkcs11.conf - oval_extended_definitions: - smartcard_configure_cert_checking + text: "local_users_only" + regex: '^[\s]*local_users_only\b' + path: "{{{ pwquality_path }}}" + oval_extend_definitions: + - accounts_password_pam_pwquality From 5b4767ef62af1e622aef8558bde1d577befd14f8 Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Fri, 25 Sep 2026 09:33:35 -0700 Subject: [PATCH 11/13] Remove spurious blank lines from rule.yml Signed-off-by: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> --- .../accounts_password_pam_enforcing/rule.yml | 77 +++++++++---------- 1 file changed, 36 insertions(+), 41 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml index d2816e4a6bf..918c43b0806 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforcing/rule.yml @@ -1,62 +1,57 @@ documentation_complete: true -title: 'Ensure PAM Enforces Password Requirements - Enforce for root User' +title: 'Ensure PAM Enforces Password Requirements - Enforcing' description: |- - The pam_pwquality module's enforce_for_root parameter controls requirements for - enforcing password complexity for the root user. Enable the enforce_for_root - setting in {{{ pwquality_path }}} to require the root user - to use complex passwords. + Verify that the operating system uses "pwquality" to enforce the + password complexity rules. -rationale: |- - Use of a complex password helps to increase the time and resources required to compromise - the password. Password complexity, or strength, is a measure of the effectiveness of a - password in resisting attempts at guessing and brute-force attacks. + Verify the pwquality module is being enforced by operating system by + running the following command: + 
+    $ grep -i enforcing {{{ pwquality_path }}}
+    enforcing = 1
+
- Password complexity is one factor of several that determines how long it takes to crack a - password. The more complex the password, the greater the number of possible combinations - that need to be tested before the password is compromised. + If the value of "enforcing" is not "1" or the line is commented out, + this is a finding. -severity: medium +rationale: |- + Use of a complex password helps to increase the time and resources + required to compromise the password. Password complexity, or strength, + is a measure of the effectiveness of a password in resisting attempts at + guessing and brute-force attacks. Using enforcing=1 ensures "pwquality" + enforces complex password construction configuration and has the ability + to limit brute-force attacks on the system. -identifiers: - cce@rhel8: CCE-83377-2 - cce@rhel9: CCE-86356-3 - cce@rhel10: CCE-90134-8 +severity: medium references: - nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4) - srg: SRG-OS-000072-GPOS-00040,SRG-OS-000071-GPOS-00039,SRG-OS-000070-GPOS-00038,SRG-OS-000266-GPOS-00101,SRG-OS-000078-GPOS-00046,SRG-OS-000480-GPOS-00225,SRG-OS-000069-GPOS-00037 + srg: SRG-OS-000480-GPOS-00225 -ocil_clause: '"enforce_for_root" is commented or missing' +ocil_clause: 'enforcing is not uncommented or configured correctly' ocil: |- - Verify that {{{ full_name }}} enforces password complexity rules for the root account. - - Check if root user is required to use complex passwords with the following command: - - 
$ grep enforce_for_root {{{ pwquality_path }}} /etc/security/pwquality.conf.d/*.conf
-
-    {{{ pwquality_path }}}:enforce_for_root
- -fixtext: |- - Configure {{{ full_name }}} to enforce password complexity on the root account. - - Add or update the following line in {{{ pwquality_path }}}: - - enforce_for_root - -srg_requirement: |- - {{{ full_name }}} must enforce password complexity rules for the root account. + To verify that enforcing is correctly applied, run the following command: + 
$ grep -i enforcing {{{ pwquality_path }}}
+ The output should return enforcing = 1 uncommented. platform: package[libpwquality] +{{% if product == "ubuntu2404" %}} +template: + name: accounts_password + vars: + variable: enforcing + operation: equals +{{% else %}} template: name: "lineinfile" vars: - text: "enforce_for_root" - regex: '^[\s]*enforce_for_root\b' + text: "enforcing = 1" + regex: '^[\s]*enforcing[\s]*=[\s]*1\b' path: "{{{ pwquality_path }}}" - backends: - oval: off + oval_extend_definitions: + - accounts_password_pam_pwquality +{{% endif %}} From a5cbd632bf0abba92ad5864a23840303ca00d06f Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Fri, 25 Sep 2026 09:34:43 -0700 Subject: [PATCH 12/13] Remove spurious blank lines from rule.yml Signed-off-by: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> --- .../verify_use_mappers/rule.yml | 46 +++++++++++++------ 1 file changed, 31 insertions(+), 15 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml index 76d69663415..d6f17802f89 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/verify_use_mappers/rule.yml @@ -1,28 +1,44 @@ documentation_complete: true -title: Ensure Password History Is Enforced for the Root User + +title: "Verify that 'use_mappers' is set to 'pwent' in PAM" description: |- - The enforce_for_root option enforces password history for the root user. - Enable the enforce_for_root setting in /etc/security/pwhistory.conf - to require the root user to use a password that has not been used recently. + The operating system must map the authenticated identity to the user or + group account for PKI-based authentication. + + Verify that use_mappers is set to pwent in + /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: + + 
$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
+
+    use_mappers = pwent
rationale: |- - Requiring users not to reuse their passwords make it less likely that an attacker will be - able to guess the password or use a compromised password. + Without mapping the certificate used to authenticate to the user account, + the ability to determine the identity of the individual user or group will + not be available for forensic analysis. + +severity: low + +references: + srg: SRG-OS-000068-GPOS-00036 + +ocil_clause: 'use_mappers is not uncommented or configured correctly' -identifiers: - cce@rhel8: CCE-86734-1 - cce@rhel9: CCE-86742-4 - cce@rhel10: CCE-87591-4 +ocil: |- + Verify that use_mappers is set to pwent in + /etc/pam_pkcs11/pam_pkcs11.conf file with the following command: -severity: medium + 
$ grep ^use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
 
-platform: package[pam]
+    use_mappers = pwent
template: name: lineinfile vars: - text: "enforce_for_root" - regex: '^[\s]*enforce_for_root\b' - path: "/etc/security/pwhistory.conf" + text: "use_mappers = pwent" + regex: '^[\s]*use_mappers[\s]*=[\s]*pwent\b' + path: /etc/pam_pkcs11/pam_pkcs11.conf + oval_extended_definitions: + smartcard_configure_cert_checking From bdef0a1a86f22a73ed65fc222ed959fd11a1726b Mon Sep 17 00:00:00 2001 From: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> Date: Fri, 16 Oct 2026 07:33:33 -0700 Subject: [PATCH 13/13] Restore upstream rule.yml formatting after rebase The rebase of the two rule.yml files onto current master picked up extra blank lines from the old branch base. Restore master's exact formatting, keeping only the regex vars added by this PR. Signed-off-by: HSP18SCM23P <38229980+HSP18SCM23P@users.noreply.github.com> --- .../rule.yml | 9 +------- .../rule.yml | 22 +------------------ 2 files changed, 2 insertions(+), 29 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_for_root/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_for_root/rule.yml index d7baa0f7d60..034fb5dfdec 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_for_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_enforce_for_root/rule.yml @@ -1,36 +1,29 @@ documentation_complete: true - title: Ensure Password History Is Enforced for the Root User - description: |- The enforce_for_root option enforces password history for the root user. Enable the enforce_for_root setting in /etc/security/pwhistory.conf to require the root user to use a password that has not been used recently. - rationale: |- Requiring users not to reuse their passwords make it less likely that an attacker will be able to guess the password or use a compromised password. - identifiers: cce@rhel8: CCE-86734-1 cce@rhel9: CCE-86742-4 cce@rhel10: CCE-87591-4 - severity: medium - platform: package[pam] - template: name: lineinfile vars: text: "enforce_for_root" - regex: '^[\s]*enforce_for_root\b' + regex: '^[\\s]*enforce_for_root\\b' path: "/etc/security/pwhistory.conf" filemode: '0644' diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml index 98b7c7570c2..88189ad8f66 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml @@ -1,83 +1,63 @@ documentation_complete: true - - title: 'Ensure PAM Enforces Password Requirements - Enforce for root User' - description: |- The pam_pwquality module's enforce_for_root parameter controls requirements for enforcing password complexity for the root user. Enable the enforce_for_root setting in {{{ pwquality_path }}} to require the root user to use complex passwords. - rationale: |- Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. - Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. - severity: medium - identifiers: cce@rhel8: CCE-83377-2 cce@rhel9: CCE-86356-3 cce@rhel10: CCE-90134-8 - references: nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4) srg: SRG-OS-000072-GPOS-00040,SRG-OS-000071-GPOS-00039,SRG-OS-000070-GPOS-00038,SRG-OS-000266-GPOS-00101,SRG-OS-000078-GPOS-00046,SRG-OS-000480-GPOS-00225,SRG-OS-000069-GPOS-00037 - ocil_clause: '"enforce_for_root" is commented or missing' - ocil: |- Verify that {{{ full_name }}} enforces password complexity rules for the root account. - Check if root user is required to use complex passwords with the following command: - 
$ grep enforce_for_root {{{ pwquality_path }}} /etc/security/pwquality.conf.d/*.conf
 
-
     {{{ pwquality_path }}}:enforce_for_root
- fixtext: |- Configure {{{ full_name }}} to enforce password complexity on the root account. - Add or update the following line in {{{ pwquality_path }}}: - enforce_for_root - srg_requirement: |- {{{ full_name }}} must enforce password complexity rules for the root account. - platform: package[libpwquality] - template: name: "lineinfile" vars: text: "enforce_for_root" - regex: '^[\s]*enforce_for_root\b' + regex: '^[\\s]*enforce_for_root\\b' path: "{{{ pwquality_path }}}" filemode: '0644' backends: oval: off -