-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
accounts_password_set_min_life_existing: Avoid system accounts #9955
accounts_password_set_min_life_existing: Avoid system accounts #9955
Conversation
This datastream diff is auto generated by the check Click here to see the full diffbash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing
@@ -3,5 +3,5 @@
while IFS= read -r i; do
- passwd -n $var_accounts_minimum_age_login_defs $i
-done < <(awk -v var="$var_accounts_minimum_age_login_defs" -F: '$4 < var || $4 == "" {print $1}' /etc/shadow)
+ chage -m $var_accounts_minimum_age_login_defs $i
+done < <(awk -v var="$var_accounts_minimum_age_login_defs" -F: '(/^[^:]+:[^!*]/ && ($4 < var || $4 == "")) {print $1}' /etc/shadow) |
/retest |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The errors in testing-farm:centos-stream-8-x86_64
and testing-farm:centos-stream-9-x86_64
seems to be legit. The rule is still failing after the Ansible remediation. Could you check it, please?
@marcusburghardt I'm not really sure why it is failing for fedora and CentOS, do you have any idea? |
No yet but I can take a look on this. |
Hi! Doing some testing on our side with these commits backported we found an issue were the This issue is also present on the Changing the |
any_exist. This is needed for environments that don't have interactive users other than root.
00c5c9a
to
c71c6b4
Compare
Thanks Freddie for testing this PR. Indeed your suggestions make sense, so I add a new commit changing the existence check to |
0d47ea8
to
cb053ea
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please, take a look in the comments from #9954
...word_expiration/accounts_password_set_min_life_existing/tests/incorrect_min_pass_age.fail.sh
Outdated
Show resolved
Hide resolved
test user account. Suggested-by: Marcus Burghardt <maburgha@redhat.com>
tests independent of the benchmark.
Code Climate has analyzed commit 2ef1c60 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 49.9% (0.1% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the improvements in this rule @dodys .
Description: