updates for accounts_passwords_pam_faillock_unlock_time

[shawndwells]

• Updated XCCDF naming to follow other faillocks (f6a61f7)
• Updated OVAL name (f6a61f7)
• Added remediation using @iankko 's template (adcc8cf)

[landscape-bot]

Code quality remained the same when pulling adcc8cf on shawndwells:accounts_passwords_pam_fail_interval into 998d195 on OpenSCAP:master.

[shawndwells]

kind bump to get a review :)

[iankko]

@shawndwells

kind bump to get a review :)

Hi Shawn,

three issues basically:

1. looks not all former accounts_passwords_pam_fail_interval have been replaced with the new form:

$ grep -rHn "accounts_passwords_pam_fail_interval" * | more
Fedora/input/system/accounts/pam.xml:538:<Rule id="accounts_passwords_pam_fail_interval" severity="medium">
Fedora/input/system/accounts/pam.xml:558:<!--oval id="accounts_passwords_pam_fail_interval" value="var_accounts_passwords_pam_faillock_fail_interval"/
-->
RHEL/7/input/system/accounts/pam.xml:571:<Rule id="accounts_passwords_pam_fail_interval" severity="medium">
RHEL/7/input/system/accounts/pam.xml:598:<oval id="accounts_passwords_pam_fail_interval" value="var_accounts_passwords_pam_faillock_fail_interval"/>
RHEL/7/input/profiles/usgcb-rhel7-server.xml:32:<select idref="accounts_passwords_pam_fail_interval" selected="true" />
RHEL/7/input/profiles/stig-rhel7-server-upstream.xml:34:<select idref="accounts_passwords_pam_fail_interval" selected="true" />
RHEL/7/input/auxiliary/stig_overlay.xml:1007:   <overlay owner="disastig" ruleid="accounts_passwords_pam_fail_interval" ownerid="RHEL-06-000357" disa=
"1452" severity="medium">

2. Though applying the template looks fine, there isn't var_accounts_passwords_pam_faillock_interval variable (like it's currently used in the remediation). It's var_accounts_passwords_pam_faillock_fail_interval instead:
   https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/system/accounts/pam.xml#L230

So either update the XCCDF s/var_accounts_passwords_pam_faillock_fail_interval/var_accounts_passwords_pam_faillock_interval/g, or update the provided remediation to do the vice versa switch (this seems to be better approach since there aren't that much var_accounts_passwords_pam_faillock_interval occurrences):

$ grep -rHn "var_accounts_passwords_pam_faillock_fail_interval" * | uniq | wc -l
31

vs

$ grep -rHn "var_accounts_passwords_pam_faillock_interval" * | uniq | wc -l
7

So IMHO it will be easier to replace var_accounts_passwords_pam_faillock_interval.

3. Last but not least - even when both above changes are done, though the remediation being correct from source code PoV, the functional check returns 'error' when performing the remediation.
   This is because corresponding OVAL check needs to be modified too (in the same way like the shared/oval/accounts_passwords_pam_faillock_deny.xml has been modified here:
   45792dd

In other words instead of requiring first example from pam_faillock(8) manual page it should be updated to require second example from that manual page - since this has been consulted with PAM developers as the correct solution we should use / recommend. And the second example is what we actually describe as the requirements in the corresponding XCCDF rules).

But this is not a blocker, once the issues 1) and 2) are fixed, I can merge this & rewrite the OVAL check to follow the shared/*_deny.xml template.

Thanks, Jan.

[shawndwells]

@iankko, updated the PR with your comments in #1 (rule naming) and #2 (variable naming)

[landscape-bot]

Code quality remained the same when pulling b357322 on shawndwells:accounts_passwords_pam_fail_interval into 998d195 on OpenSCAP:master.

[iankko]

Looks good to me. Thank you for the updates! ACK && Merging.