Description of problem:

e.g. xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing

This is a similar to BZ #2203791 but for password check.

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
 30   <unix:shadow_object id="object_shadow_password_users_max_life_existing" version="1">
 31     <unix:username operation="pattern match">.*</unix:username>
 32     <filter action="include">filter_no_passwords_or_locked_accounts_max_life</filter>
 33   </unix:shadow_object>
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

The implementation relies on "unix:shadow_object" which makes use of getpwent(), which browses all users provides by the NSS "shadow" map:

Source code (src/OVAL/probes/unix/shadow_probe.c):
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
180 static int read_shadow(SEXP_t *un_ent, probe_ctx *ctx)
181 {
182         int err = 1;
183         struct spwd *pw;
184 
185         while ((pw = getspent())) {
 :
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Systems using 3rd party CentrifyDC NSS provider have a "shadow: centrifydc" line in /etc/nsswitch.conf, causing the remote users to be affected by these rules.

Version-Release number of selected component (if applicable):

scap-security-guide
openscap-scanner

How reproducible:

Always on Centrify systems