Bug 1178967
| Summary: | pam_cracklib replaced by pam_pwquality | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Erinn Looney-Triggs <erinn.looneytriggs> |
| Component: | scap-security-guide | Assignee: | Jan Lieskovsky <jlieskov> |
| Status: | CLOSED ERRATA | QA Contact: | Marek Haicman <mhaicman> |
| Severity: | low | Docs Contact: | Lenka Špačková <lkuprova> |
| Priority: | unspecified | ||
| Version: | 7.0 | CC: | mhaicman, pbokoc, slukasik, swells |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | scap-security-guide-0.1.23-1.el7 | Doc Type: | Bug Fix |
| Doc Text: |
Instructions for correcting a compliance error reported by a SCAP Security Guide scan against the "Protect Accounts by Configuring PAM" group were not applicable to Red Hat Enterprise Linux 7. This update provides updated instructions (XCCDF prose) which recommend using the "pam_pwquality" PAM module for enforcing strong passwords.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 11:59:31 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Erinn Looney-Triggs
2015-01-05 19:33:59 UTC
Thank you for the report, Erinn. SCAP Security Guide upstream is aware of this PAM modules transition and working on updating the content to reflect that. Upstream PR finishing the 'pam_cracklib' to 'pam_pwquality' transition for RHEL/7 and Fedora products is the following: [1] https://github.com/OpenSCAP/scap-security-guide/pull/579 After this change being applied, there are just four occurrences of 'pam_cracklib' left in RHEL/7 and Fedora content: * for RHEL/7: $ pwd .. /scap-security-guide/RHEL/7 $ grep -rHn 'pam_cracklib' input/system/accounts/pam.xml:97:The <tt>pam_cracklib</tt> PAM module can also provide strength input/system/accounts/pam.xml:105:The man pages <tt>pam_pwquality(8)</tt> and <tt>pam_cracklib(8)</tt> * for Fedora: $ pwd .. scap-security-guide/Fedora $ grep -rHn "pam_cracklib" * input/system/accounts/pam.xml:95:The <tt>pam_cracklib</tt> PAM module can also provide strength input/system/accounts/pam.xml:108:The man pages <tt>pam_pwquality(8)</tt>, <tt>pam_cracklib(8)</tt>, and These are just text entries mentioning that 'pam_cracklib' modules is available besides the default 'pam_pwquality' PAM module too, and mentioning the 'pam_cracklib' modules manual page for the case it would be preferred for use. Other occurrences of 'pam_cracklib' module in the OVAL checks and remediation scripts have been replaced upstream already by previous fixes (the list is too long to be in patch-by-patch manner listed here). Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2363.html |