[Stabilization]: fix set_password_hashing_min_rounds_logindefs

[vojtapolasek]

Description:

• use correct variable in RHEL 8 STIG profiles
• remove a variable which was not used in the profile but had a confusing name, suggesting that it is used with this rule
• fix Ansible remediation of the rule so that it is more robust

Rationale:

• remediation of the rule was not working properly
• thanks to the wrong variable (default value) the content was not aligned with DISA

Review Hints:

• remediate with Bash / Ansible and verify with the latest STIG SCAP content

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs
@@ -55,11 +55,12 @@
     has Minimum Value of 5000
   ansible.builtin.replace:
     path: /etc/login.defs
-    regexp: (^\s*SHA_CRYPT_MIN_ROUNDS\s+)(?!(?:[5-9]\d{3,}|\d{5,}))\S*(\s*$)
+    regexp: (^\s*SHA_CRYPT_MIN_ROUNDS\s+)(?:\d+)(.*$)
     replace: \g<1>{{ var_password_hashing_min_rounds_login_defs }}\g<2>
     backup: false
-  when: etc_login_defs_sha_crypt_min_rounds | length > 0 and etc_login_defs_sha_crypt_min_rounds
-    | first | int < var_password_hashing_min_rounds_login_defs | int
+  when: etc_login_defs_sha_crypt_min_rounds is defined and etc_login_defs_sha_crypt_min_rounds
+    | length > 0 and etc_login_defs_sha_crypt_min_rounds | first | int < var_password_hashing_min_rounds_login_defs
+    | int
   tags:
   - CCE-89707-4
   - DISA-STIG-RHEL-08-010130
@@ -74,11 +75,12 @@
     has Minimum Value of 5000
   ansible.builtin.replace:
     path: /etc/login.defs
-    regexp: (^\s*SHA_CRYPT_MAX_ROUNDS\s+)(?!(?:[5-9]\d{3,}|\d{5,}))\S*(\s*$)
+    regexp: (^\s*SHA_CRYPT_MAX_ROUNDS\s+)(?:\d+)(.*$)
     replace: \g<1>{{ var_password_hashing_min_rounds_login_defs }}\g<2>
     backup: false
-  when: etc_login_defs_sha_crypt_max_rounds | length > 0 and etc_login_defs_sha_crypt_max_rounds
-    | first | int < var_password_hashing_min_rounds_login_defs | int
+  when: etc_login_defs_sha_crypt_max_rounds is defined and etc_login_defs_sha_crypt_max_rounds
+    | length > 0 and etc_login_defs_sha_crypt_max_rounds | first | int < var_password_hashing_min_rounds_login_defs
+    | int
   tags:
   - CCE-89707-4
   - DISA-STIG-RHEL-08-010130
@@ -89,7 +91,8 @@
   - restrict_strategy
   - set_password_hashing_min_rounds_logindefs
 
-- name: '{{ rule_title }} - SHA_CRYPT_MIN_ROUNDS add configuration if not found'
+- name: Set Password Hashing Rounds in /etc/login.defs - SHA_CRYPT_MIN_ROUNDS add
+    configuration if not found
   ansible.builtin.lineinfile:
     line: SHA_CRYPT_MIN_ROUNDS {{ var_password_hashing_min_rounds_login_defs }}
     path: /etc/login.defs
@@ -105,7 +108,8 @@
   - restrict_strategy
   - set_password_hashing_min_rounds_logindefs
 
-- name: '{{ rule_title }} - SHA_CRYPT_MAX_ROUNDS add configuration if not found'
+- name: Set Password Hashing Rounds in /etc/login.defs - SHA_CRYPT_MAX_ROUNDS add
+    configuration if not found
   ansible.builtin.lineinfile:
     line: SHA_CRYPT_MAX_ROUNDS {{ var_password_hashing_min_rounds_login_defs }}
     path: /etc/login.defs

[Mab879]

Waving Automatus tests as they are only failing due missing tests.