-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
accounts_password_set_max_life_existing does not exclude no passwords or locked accounts #9954
accounts_password_set_max_life_existing does not exclude no passwords or locked accounts #9954
Conversation
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
@@ -4,4 +4,4 @@
while IFS= read -r i; do
chage -M $var_accounts_maximum_age_login_defs $i
-done < <(awk -v var="$var_accounts_maximum_age_login_defs" -F: '$5 > var || $5 == "" {print $1}' /etc/shadow)
+done < <(awk -v var="$var_accounts_maximum_age_login_defs" -F: '(/^[^:]+:[^!*]/ && ($5 > var || $5 == "")) {print $1}' /etc/shadow)
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
@@ -6,8 +6,8 @@
- name: Collect users with not correct maximum time period between password changes
ansible.builtin.command:
- cmd: awk -F':' '$5 > {{ var_accounts_maximum_age_login_defs }} || $5 == "" {print
- $1}' /etc/shadow
+ cmd: awk -F':' '(/^[^:]+:[^!*]/ && ($5 > {{ var_accounts_maximum_age_login_defs
+ }} || $5 == "")) {print $1}' /etc/shadow
register: user_names
tags:
- CCE-82473-0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The assessment and bash remediation are working fine. Could you also update the Ansible remediation, please?
dbccb47
to
e34e2a7
Compare
any_exist. This is needed for environments that don't have interactive users other than root.
e34e2a7
to
2e8aaf1
Compare
2e8aaf1
to
cf6e9b9
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The comments here are also valid for #9955 . After these small details I believe we they will be good to be merged.
...nts-restrictions/password_expiration/accounts_password_set_max_life_existing/oval/shared.xml
Outdated
Show resolved
Hide resolved
...nts-restrictions/password_expiration/accounts_password_set_max_life_existing/oval/shared.xml
Outdated
Show resolved
Hide resolved
...nts-restrictions/password_expiration/accounts_password_set_max_life_existing/oval/shared.xml
Outdated
Show resolved
Hide resolved
...word_expiration/accounts_password_set_max_life_existing/tests/incorrect_max_pass_age.fail.sh
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The comments here are also valid for #9955 . After these small details I believe we they will be good to be merged.
...word_expiration/accounts_password_set_max_life_existing/tests/incorrect_max_pass_age.fail.sh
Outdated
Show resolved
Hide resolved
test user account. Suggested-by: Marcus Burghardt <maburgha@redhat.com>
tests independent of the benchmark
Code Climate has analyzed commit 5eacd51 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 49.9% (0.1% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @dodys
Description: