.RHEL 8 STIG profiles are better aligned with the benchmark
Four existing rules that satisfy RHEL 8 STIG requirements were part of the data stream but were previously not included in the STIG profiles (`stig` and `stig_gui`). With this update, the following rules are now included in the profiles:
* `accounts_passwords_pam_faillock_dir`
* `accounts_passwords_pam_faillock_silent`
* `account_password_selinux_faillock_dir`
* `fapolicy_default_deny`
As a result, the RHEL 8 STIG profiles have a higher coverage.
Description of problem:
From StigViewer, RHEL-08-010130 is supposed to apply on the content of /etc/login.defs.
The implementation is indeed matching, as shown below:
~~~
./linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_min_rounds_logindefs/rule.yml
stigid@rhel8: RHEL-08-010130
./products/rhel8/profiles/stig.profile
~~~
# RHEL-08-010130
- set_password_hashing_min_rounds_logindefs
However other STIG files we have reference another rule applying to pam_unix instead (accounts_password_pam_unix_rounds_password_auth):
~~~
./controls/stig_rhel8.yml
- id: RHEL-08-010130
levels:
- medium
title: The RHEL 8 password-auth file must be configured to use a sufficient number
of hashing rounds.
rules:
- accounts_password_pam_unix_rounds_password_auth
status: automated
./linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_password_auth/rule.yml:
~~~
references:
~~~
anssi: BP28(R32)
disa: CCI-000196
srg: SRG-OS-000073-GPOS-00041
stigid@ol8: OL08-00-010130
~~~
Version-Release number of selected component (if applicable):
scap-security-guide-0.1.63-4.el8.noarch.rpm
Hello Rajesh,
it is true that the rule accounts_password_pam_unix_rounds_password_auth is placed into the stig_rhel8.yml control file. However, this control file exists in upstream, but it is not used by any product.
The STIG profile for RHEL8 can be found in products/rhel8/profiles/stig.profile.
The rule is part of ANSSI profiles.
So yes, the rule is in the datastream, but it is not part of the STIG profile for RHEL8.
Does this explanation solve the problem?
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (scap-security-guide bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2023:2869
Comment 27Red Hat Bugzilla
2023-09-19 04:31:58 UTC
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days
Description of problem: From StigViewer, RHEL-08-010130 is supposed to apply on the content of /etc/login.defs. The implementation is indeed matching, as shown below: ~~~ ./linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_min_rounds_logindefs/rule.yml stigid@rhel8: RHEL-08-010130 ./products/rhel8/profiles/stig.profile ~~~ # RHEL-08-010130 - set_password_hashing_min_rounds_logindefs However other STIG files we have reference another rule applying to pam_unix instead (accounts_password_pam_unix_rounds_password_auth): ~~~ ./controls/stig_rhel8.yml - id: RHEL-08-010130 levels: - medium title: The RHEL 8 password-auth file must be configured to use a sufficient number of hashing rounds. rules: - accounts_password_pam_unix_rounds_password_auth status: automated ./linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_password_auth/rule.yml: ~~~ references: ~~~ anssi: BP28(R32) disa: CCI-000196 srg: SRG-OS-000073-GPOS-00041 stigid@ol8: OL08-00-010130 ~~~ Version-Release number of selected component (if applicable): scap-security-guide-0.1.63-4.el8.noarch.rpm