Skip to content

Commit e4120cd

Browse files
dodysdodys
authored
Merge pull request #12784 from alanmcanonical/ubt24_53331
Ubuntu 24.04: Implement rule 5.3.3.3.1 Ensure password history remember is configured
2 parents 25cd0c5 + 1c20e93 commit e4120cd

7 files changed

Lines changed: 136 additions & 5 deletions

File tree

‎controls/cis_ubuntu2404.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2008,11 +2008,10 @@ controls:
20082008
levels:
20092009
- l1_server
20102010
- l1_workstation
2011-
related_rules:
2012-
- var_password_pam_remember=5
2013-
- accounts_password_pam_unix_remember
2014-
status: planned
2015-
notes: TODO. Partial/incorrect implementation exists.See related rules. Analogous to ubuntu2204/5.4.3.
2011+
rules:
2012+
- var_password_pam_remember=24
2013+
- accounts_password_pam_pwhistory_remember
2014+
status: automated
20162015

20172016
- id: 5.3.3.3.2
20182017
title: Ensure password history is enforced for the root user (Automated)

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember/bash/ubuntu.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# platform = multi_platform_ubuntu
2+
3+
{{{ bash_pam_pwhistory_enable('cac_pwhistory','requisite') }}}
4+
5+
{{{ bash_instantiate_variables("var_password_pam_remember") }}}
6+
7+
sed -i -E '/^Password:/,/^[^[:space:]]/ {
8+
/pam_pwhistory\.so/ {
9+
s/\s*remember=[^[:space:]]*//g
10+
s/$/ remember='"$var_password_pam_remember"'/g
11+
}
12+
}' /usr/share/pam-configs/cac_pwhistory
13+
14+
sed -i -E '/^Password-Initial:/,/^[^[:space:]]/ {
15+
/pam_pwhistory\.so/ {
16+
s/\s*remember=[^[:space:]]*//g
17+
s/$/ remember='"$var_password_pam_remember"'/g
18+
}
19+
}' /usr/share/pam-configs/cac_pwhistory
20+
21+
DEBIAN_FRONTEND=noninteractive pam-auth-update --enable cac_pwhistory

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember/oval/shared.xml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{% if "sle12" in product or "debian" in product or "ubuntu" in product %}}
2+
{{%- set accounts_password_pam_file = '/etc/pam.d/common-password' -%}}
3+
{{% endif %}}
4+
5+
<def-group>
6+
<definition class="compliance" id="{{{ rule_id }}}" version="2">
7+
{{{ oval_metadata("The passwords to remember of pam_pwhistory should be set correctly.") }}}
8+
<criteria operator="AND" comment="Check if pam_pwhistory.so is properly configured">
9+
<criterion test_ref="test_accounts_password_pam_pwhistory_enabled"
10+
comment="pam_pwhistory.so is properly defined in password section of PAM file"/>
11+
<criterion test_ref="test_accounts_password_pam_pwhistory_remember_parameter"
12+
comment="Remember parameter of pam_pwhistory.so is properly configured"/>
13+
</criteria>
14+
</definition>
15+
16+
<external_variable comment="number of passwords that should be remembered" datatype="int" id="var_password_pam_remember" version="1" />
17+
18+
<!-- is pam_pwhistory.so enabled? -->
19+
<ind:textfilecontent54_test id="test_accounts_password_pam_pwhistory_enabled"
20+
check="all" version="1" comment="Check pam_pwhistory.so presence in PAM file">
21+
<ind:object object_ref="object_accounts_password_pam_pwhistory_enabled"/>
22+
</ind:textfilecontent54_test>
23+
24+
<ind:textfilecontent54_object id="object_accounts_password_pam_pwhistory_enabled"
25+
version="1">
26+
<ind:filepath>{{{ accounts_password_pam_file }}}</ind:filepath>
27+
<ind:pattern var_ref="var_accounts_password_pam_pwhistory_module_regex"
28+
var_check="at least one" operation="pattern match"/>
29+
<ind:instance datatype="int">1</ind:instance>
30+
</ind:textfilecontent54_object>
31+
32+
<!-- variables used to check the module implementation -->
33+
<local_variable id="var_accounts_password_pam_pwhistory_module_regex"
34+
datatype="string" version="1"
35+
comment="The regex is to confirm the pam_pwhistory.so module is enabled">
36+
<literal_component>^[ \t]*password[ \t]+(?:(?:sufficient)|(?:required)|(?:requisite)|(?:\[.*\]))[ \t]+pam_pwhistory\.so.*$</literal_component>
37+
</local_variable>
38+
39+
<ind:textfilecontent54_state id="state_accounts_password_pam_pwhistory_remember" version="1">
40+
<ind:subexpression datatype="int" operation="greater than or equal"
41+
var_ref="var_password_pam_remember"/>
42+
</ind:textfilecontent54_state>
43+
44+
<!-- Check the pam_pwhistory.so remember parameter -->
45+
<ind:textfilecontent54_test id="test_accounts_password_pam_pwhistory_remember_parameter" version="1"
46+
check="all" check_existence="all_exist"
47+
comment="Test if remember attribute of pam_pwhistory.so is set correctly in {{{ accounts_password_pam_file }}}">
48+
<ind:object object_ref="object_accounts_password_pam_pwhistory_remember_parameter" />
49+
<ind:state state_ref="state_accounts_password_pam_pwhistory_remember" />
50+
</ind:textfilecontent54_test>
51+
52+
<ind:textfilecontent54_object id="object_accounts_password_pam_pwhistory_remember_parameter" version="1">
53+
<ind:filepath>{{{ accounts_password_pam_file }}}</ind:filepath>
54+
<ind:pattern operation="pattern match">^[ \t]*password[ \t]+(?:(?:sufficient)|(?:required)|(?:requisite)|(?:\[.*\]))[ \t]+pam_pwhistory\.so[ \t]+[^#\n\r]*\bremember=([0-9]*)\b.*$</ind:pattern>
55+
<ind:instance datatype="int">1</ind:instance>
56+
</ind:textfilecontent54_object>
57+
58+
</def-group>

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember/rule.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ ocil: |-
4949
5050
platform: package[pam]
5151

52+
{{% if 'ubuntu' not in product or product == 'ubuntu2004' %}}
5253
template:
5354
name: pam_options
5455
vars:
@@ -61,3 +62,4 @@ template:
6162
operation: greater than or equal
6263
- argument: use_authtok
6364
new_argument: use_authtok
65+
{{% endif %}}

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember/tests/ubuntu_argument_missing.fail.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
# platform = multi_platform_ubuntu
3+
# packages = pam
4+
# variables = var_password_pam_remember=5
5+
6+
config_file=/usr/share/pam-configs/tmp_pwhistory
7+
8+
cat << EOF > "$config_file"
9+
Name: pwhistory password history checking
10+
Default: yes
11+
Priority: 1024
12+
Password-Type: Primary
13+
Password: requisite pam_pwhistory.so enforce_for_root try_first_pass use_authtok
14+
EOF
15+
16+
DEBIAN_FRONTEND=noninteractive pam-auth-update --enable tmp_pwhistory
17+
rm "$config_file"

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember/tests/ubuntu_correct_value.pass.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
# platform = multi_platform_ubuntu
3+
# packages = pam
4+
# variables = var_password_pam_remember=5
5+
6+
config_file=/usr/share/pam-configs/tmp_pwhistory
7+
8+
cat << EOF > "$config_file"
9+
Name: pwhistory password history checking
10+
Default: yes
11+
Priority: 1024
12+
Password-Type: Primary
13+
Password: requisite pam_pwhistory.so remember=5 enforce_for_root try_first_pass use_authtok
14+
EOF
15+
16+
DEBIAN_FRONTEND=noninteractive pam-auth-update --enable tmp_pwhistory
17+
rm "$config_file"

‎linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember/tests/ubuntu_wrong_value.fail.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
# platform = multi_platform_ubuntu
3+
# packages = pam
4+
# variables = var_password_pam_remember=5
5+
6+
config_file=/usr/share/pam-configs/tmp_pwhistory
7+
8+
cat << EOF > "$config_file"
9+
Name: pwhistory password history checking
10+
Default: yes
11+
Priority: 1024
12+
Password-Type: Primary
13+
Password: requisite pam_pwhistory.so remember=4 enforce_for_root try_first_pass use_authtok
14+
EOF
15+
16+
DEBIAN_FRONTEND=noninteractive pam-auth-update --enable tmp_pwhistory
17+
rm "$config_file"

0 commit comments

Comments
 (0)