Merge pull request #12687 from mpurg/faillock_template_fix

Improve template pam_account_password_faillock
ComplianceAsCode · Jan 6, 2025 · d82db2b · d82db2b
2 parents 038e629 + 8055c39
commit d82db2b
Show file tree

Hide file tree

Showing 76 changed files with 289 additions and 613 deletions.
diff --git a/docs/templates/template_reference.md b/docs/templates/template_reference.md
@@ -612,6 +612,30 @@ When the remediation is applied duplicate occurrences of `key` are removed.
     - **app** - optional. If not set the check will use the default text `The respective application or service`.
       If set, the `app` is used within sentences like: "`application` is configured correctly and configuration file exists"
 
+#### pam_account_password_faillock
+-   Checks if the pam_faillock is enabled in PAM and if the specified
+    parameter is correctly configured either in /etc/security/faillock.conf
+    or directly in /etc/pam.d/* files.
+
+    The allowed interval for the faillock parameter is defined by
+    template parameters `variable_lower_bound` and `variable_upper_bound`.
+    The boundaries are inclusive (lower <= parameter value <= upper) and
+    can be set as:
+    - `use_ext_variable`: use value in external XCCDF variable defined by `ext_variable`
+    - number: literal number
+    - undefined: no boundary
+
+-   Parameters:
+    -   **description** - Description of rule
+    -   **prm_name** - name of faillock parameter
+    -   **prm_regex_conf** - regex for faillock parameter in /etc/security/faillock.conf
+    -   **prm_regex_pamd** - regex for faillock parameter in /etc/pam.d/*
+    -   **variable_lower_bound** - lower boundary for allowed parameter value
+    -   **variable_upper_bound** - upper boundary for allowed parameter value
+    -   **ext_variable** - external XCCDG variable used to define interval boundaries and
+                           the value used in the remediation.
+
+
 #### pam_options
 -   Checks if the parameters or arguments of a given Linux-PAM (Pluggable
     Authentication Modules) module in a given PAM configuration file

diff --git a/.../accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml b/.../accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml
@@ -97,4 +97,4 @@ template:
     ext_variable: var_accounts_passwords_pam_faillock_deny
     description: Lockout account after failed login attempts.
     variable_upper_bound: use_ext_variable
-    variable_lower_bound: 0
+    variable_lower_bound: 1
diff --git a/...sword_attempts/accounts_passwords_pam_faillock_deny/tests/authselect_modified_pam.fail.sh b/...sword_attempts/accounts_passwords_pam_faillock_deny/tests/authselect_modified_pam.fail.sh
diff --git a/...tempts/accounts_passwords_pam_faillock_deny/tests/pam_faillock_expected_pam_files.pass.sh b/...tempts/accounts_passwords_pam_faillock_deny/tests/pam_faillock_expected_pam_files.pass.sh
diff --git a/...ttempts/accounts_passwords_pam_faillock_deny/tests/pam_faillock_lenient_pam_files.fail.sh b/...ttempts/accounts_passwords_pam_faillock_deny/tests/pam_faillock_lenient_pam_files.fail.sh
diff --git a/...tempts/accounts_passwords_pam_faillock_deny/tests/pam_faillock_stricter_pam_files.pass.sh b/...tempts/accounts_passwords_pam_faillock_deny/tests/pam_faillock_stricter_pam_files.pass.sh
diff --git a/...sword_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_commented_values.fail.sh b/...sword_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_commented_values.fail.sh
diff --git a/...locking_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_common.sh b/...locking_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_common.sh
diff --git a/...g_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_correct.pass.sh b/...g_out_password_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_correct.pass.sh
diff --git a/..._password_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_correct_pamd.pass.sh b/..._password_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_correct_pamd.pass.sh
diff --git a/..._password_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_missing_pamd.fail.sh b/..._password_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_missing_pamd.fail.sh
diff --git a/...t_password_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_wrong_value.fail.sh b/...t_password_attempts/accounts_passwords_pam_faillock_deny/tests/ubuntu_wrong_value.fail.sh
diff --git a/...d_attempts/accounts_passwords_pam_faillock_interval/tests/authselect_modified_pam.fail.sh b/...d_attempts/accounts_passwords_pam_faillock_interval/tests/authselect_modified_pam.fail.sh
diff --git a/...ts/accounts_passwords_pam_faillock_interval/tests/conflicting_settings_authselect.fail.sh b/...ts/accounts_passwords_pam_faillock_interval/tests/conflicting_settings_authselect.fail.sh
diff --git a/.../accounts_passwords_pam_faillock_interval/tests/pam_faillock_conflicting_settings.fail.sh b/.../accounts_passwords_pam_faillock_interval/tests/pam_faillock_conflicting_settings.fail.sh
diff --git a/...ord_attempts/accounts_passwords_pam_faillock_interval/tests/pam_faillock_disabled.fail.sh b/...ord_attempts/accounts_passwords_pam_faillock_interval/tests/pam_faillock_disabled.fail.sh
diff --git a/...ccounts_passwords_pam_faillock_interval/tests/pam_faillock_expected_faillock_conf.pass.sh b/...ccounts_passwords_pam_faillock_interval/tests/pam_faillock_expected_faillock_conf.pass.sh
diff --git a/...ts/accounts_passwords_pam_faillock_interval/tests/pam_faillock_expected_pam_files.pass.sh b/...ts/accounts_passwords_pam_faillock_interval/tests/pam_faillock_expected_pam_files.pass.sh
diff --git a/...accounts_passwords_pam_faillock_interval/tests/pam_faillock_lenient_faillock_conf.fail.sh b/...accounts_passwords_pam_faillock_interval/tests/pam_faillock_lenient_faillock_conf.fail.sh
diff --git a/...pts/accounts_passwords_pam_faillock_interval/tests/pam_faillock_lenient_pam_files.fail.sh b/...pts/accounts_passwords_pam_faillock_interval/tests/pam_faillock_lenient_pam_files.fail.sh
diff --git a/...asswords_pam_faillock_interval/tests/pam_faillock_multiple_pam_unix_faillock_conf.fail.sh b/...asswords_pam_faillock_interval/tests/pam_faillock_multiple_pam_unix_faillock_conf.fail.sh
diff --git a/...ts_passwords_pam_faillock_interval/tests/pam_faillock_multiple_pam_unix_pam_files.fail.sh b/...ts_passwords_pam_faillock_interval/tests/pam_faillock_multiple_pam_unix_pam_files.fail.sh
diff --git a/...ccounts_passwords_pam_faillock_interval/tests/pam_faillock_not_required_pam_files.fail.sh b/...ccounts_passwords_pam_faillock_interval/tests/pam_faillock_not_required_pam_files.fail.sh
diff --git a/...ccounts_passwords_pam_faillock_interval/tests/pam_faillock_stricter_faillock_conf.pass.sh b/...ccounts_passwords_pam_faillock_interval/tests/pam_faillock_stricter_faillock_conf.pass.sh
diff --git a/...ts/accounts_passwords_pam_faillock_interval/tests/pam_faillock_stricter_pam_files.pass.sh b/...ts/accounts_passwords_pam_faillock_interval/tests/pam_faillock_stricter_pam_files.pass.sh
diff --git a/...d_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_commented_values.fail.sh b/...d_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_commented_values.fail.sh
diff --git a/...ing_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_common.sh b/...ing_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_common.sh
diff --git a/...t_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_correct.pass.sh b/...t_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_correct.pass.sh
diff --git a/...sword_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_correct_pamd.pass.sh b/...sword_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_correct_pamd.pass.sh