Enforce explicit setting in password-auth #11742
Conversation
The rule passes if the rounds option isn't set but the profile uses a value that equals to system default value. This will no longer be possible. We will always require rounds to be set explicitly. The reason is to align the rule with DISA STIG. The commit also updates the test scenarios to fail if the rounds isn't set and system default is used. Fixes: ComplianceAsCode#11696
jan-cerny
added
bugfix
|
Start a new ephemeral environment with changes proposed in this pull request: rhel8 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
|
This datastream diff is auto generated by the check Click here to see the full diffOVAL for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1
+++ oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1
@@ -1,5 +1,2 @@
criteria OR
criterion oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1
-criteria AND
-criterion oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1
-criterion oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1 |
|
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
|
Code Climate has analyzed commit 2213049 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.3% (0.0% change). View more on Code Climate. |
The rule passes if the rounds option isn't set but the profile uses a value that equals to system default value. This will no longer be possible. We will always require rounds to be set explicitly. The reason is to align the rule with DISA STIG.
The commit also updates the test scenarios to fail if the rounds isn't set and system default is used.
Fixes: #11696