Class password::password
In: /tmp/puppet/modules/password/manifests/init.pp
Parent:

Module: password

Class: password

Description:

        This class sets some general password settings, such as appropriate
        permissions on shadow & passwd, password expiration parameters,
        password algorithm as sha512, and other maintenance tasks.

Defines:

      None

LinuxGuide:

        2.2.3.1
        2.3.1.4
        2.3.1.5
        2.3.1.6
        2.3.1.7
        2.3.3.5

CCERef#:

        CCE-3932-1
        CCE-3967-7
        CCE-3883-6
        CCE-4064-2
        CCE-4130-1
        CCE-3495-9
        CCE-3918-0
        CCE-3988-3
        CCE-4210-1
        CCE-3566-7
        CCE-3958-6
        CCE-3276-3
        CCE-4092-3
        CCE-4180-6
        CCE-4154-1
        CCE-4097-2
        CCE-3987-5
        CCE-4238-2
        CCE-4009-7

Defines:

        None

File: /etc/puppet/modules/password/manifests/init.pp

Resources

Resources

Exec["/etc/puppet/scripts/checkUsers.bash"]
   user => root
   logoutput => true
   require => File["/etc/puppet/scripts/checkUsers.bash"]
Exec["/usr/sbin/authconfig --passalgo=sha512 --update"]
   user => root

GuideSection 2.3.3.5 Upgrade password hashing algorithm

Exec["awk -F: '(\$2 == "") {print}' /etc/shadow"]
   user => root
   logoutput => true

GuideSection 2.3.1.5 Verify that no accounts have empty Password Fields

Exec["awk -F: '(\$3 == "0" && \$1 !="root") {print}' /etc/passwd"]
   user => root
   logoutput => true

GuideSection 2.3.1.6 Verify that No Non-Root Accounts Have UID 0

Exec["passmaxdays"]
   command => "sed -i 's/PASS_MAX_DAYS[ \t]*[0-9][0-9]*/PASS_MAX_DAYS\t60/g' /etc/login.defs"

GuideSection 2.3.1.7 Password expiration

Exec["passmindays"]
   command => "sed -i 's/PASS_MIN_DAYS[ \t]*[0-9][0-9]*/PASS_MIN_DAYS\t7/g' /etc/login.defs"
Exec["passminlength"]
   command => "sed -i 's/PASS_MIN_LEN[ \t]*[0-9][0-9]*/PASS_MIN_LEN\t8/g' /etc/login.defs"
File["/etc/group"]
   owner => root
   group => root
   mode => 644
File["/etc/gshadow"]
   owner => root
   group => root
   mode => 400
File["/etc/passwd"]
   owner => root
   group => root
   mode => 644

GuideSection 2.2.3.1 Verify permissions on password related files

File["/etc/puppet/scripts"]
   ensure => "directory"
   owner => "root"
   group => "root"
   mode => 700

GuideSection 2.3.1.4 Block Shell and Login Access for Non-Root System Accounts

File["/etc/puppet/scripts/checkUsers.bash"]
   owner => root
   group => root
   mode => 700
   source => "puppet:///modules/password/checkUsers.bash"
File["/etc/shadow"]
   owner => root
   group => root
   mode => 400

[Validate]