-
Notifications
You must be signed in to change notification settings - Fork 194
Conversation
and set default to 60 see Telekom 2021.07-01 SoC 3.01 Req 25 and SoC 3.65 Req46 Signed-off-by: Maik Stuebner <Maik.Stuebner@t-systems.com>
deddf31 to
109d01a
Compare
@chris-rock
chris-rock
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you @m41kc0d3 I added some comments and happy to discuss how we proceed?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This collects 60 passwords. I suggest to go with the CIS default of 5 and make this the default argument for this policy. You can than override the policy with 60 for your needs.
What do you think if we also split this into multiple pieces as CIS DIL 5.3 is doing?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I set the default back to 5
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
All controls that we are adding to the base line need to be applicable and tested on all major linux distributions.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @chris-rock,
in dev-sec/ansible-collection-hardening there is currently no configuration of this for other distributions and I am not the Debian master that can create them. So I only change some code in dev-sec/ansible-collection-hardening and create the missing test in this repo.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Our code for PAM configuration on any non-RHEL based distribution is severely lacking.
I would propose to open an issue for this and going on with only RHEL support here.
Signed-off-by: Maik Stuebner <Maik.Stuebner@t-systems.com>
Signed-off-by: Maik Stuebner <Maik.Stuebner@t-systems.com>
and set default to 60
see Telekom 2021.07-01 SoC 3.01 Req 25 and SoC 3.65 Req46
Public Telekom Security - Requirements