|
2 | 2 | <definition class="compliance" id="{{{ _RULE_ID }}}" version="6">
|
3 | 3 | {{{ oval_metadata(DESCRIPTION, rule_title=rule_title) }}}
|
4 | 4 |
|
5 |
| - {{% if 'debian' in product or 'ubuntu' in product %}} |
| 5 | + {{% if 'debian' in product or 'ubuntu' in product or 'sle15' in product %}} |
6 | 6 |
|
7 | 7 | <criteria operator="AND" comment="Check the proper configuration of pam_faillock.so">
|
8 | 8 | <criteria operator="AND" comment="Check if pam_faillock.so is properly enabled">
|
|
126 | 126 | id="var_accounts_passwords_pam_faillock_{{{ PRM_NAME }}}_pam_faillock_auth_regex"
|
127 | 127 | datatype="string" version="2"
|
128 | 128 | comment="regex to identify pam_faillock.so entries in auth section of pam files">
|
129 |
| - {{% if 'debian' in product %}} |
| 129 | + {{% if 'debian' in product or 'sle15' in product %}} |
130 | 130 | <value>^\s*auth\s+required\s+pam_faillock\.so.*preauth.*[\s\S]*^\s*auth.*pam_unix\.so[\s\S]*^\s*auth\s+\[default=die\]\s+pam_faillock\.so\s+authfail[\s\S]*^\s*auth\s+sufficient\s+pam_faillock\.so\s+authsucc</value>
|
131 | 131 | {{% elif 'ubuntu' in product %}}
|
132 | 132 | <value>^\s*auth\s+(requisite|required)\s+pam_faillock\.so.*preauth.*[\s\S]*^\s*auth.*pam_unix\.so[\s\S]*^\s*auth\s+\[default=die\]\s+pam_faillock\.so\s+authfail</value>
|
|
141 | 141 | id="var_accounts_passwords_pam_faillock_{{{ PRM_NAME }}}_pam_faillock_account_regex"
|
142 | 142 | datatype="string" version="2"
|
143 | 143 | comment="regex to identify pam_faillock.so entry in account section of pam files">
|
144 |
| - {{% if 'debian' in product or 'ubuntu' in product %}} |
| 144 | + {{% if 'debian' in product or 'ubuntu' in product or 'sle15' in product %}} |
145 | 145 | <value>^\s*account\s+required\s+pam_faillock\.so\s*(#.*)?$</value>
|
146 | 146 | {{% elif 'openeuler' in product or 'kylinserver' in product %}}
|
147 | 147 | <value>^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_unix\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_faillock\.so</value>
|
|
0 commit comments