add new rule accounts_password_pam_pwquality_conf_retry

[vojtapolasek]

Description:

• move rules which are mostly using pam_pwquality to separate group
• create a new group for rules which strictly use /etc/security/pwquality.conf, this is owned by libpwquality
• extend the key_value_pair_in_file template to support using XCCDF variable as a value source
• update relevant macros

Rationale:

• new rule

Review Hints:

• add the rule accounts_password_pam_pwquality_conf_retry to some profile and run automatus tests

[Mab879]

Please update stable profiles.

[Mab879]

@vojtapolasek @ggbecker This PR needs a rebase.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New data stream is missing OVAL for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_enforce_root'.
New content has different text for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_retry'.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
@@ -233,12 +233,6 @@
 
 [reference]:
 A.11.SEC-RHEL3
-
-[reference]:
-RHEL-09-611010
-
-[reference]:
-SV-258091r1045185_rule
 
 [rationale]:
 Setting the password retry prompts that are permitted on a per-session basis to a low value

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_retry' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
@@ -4,7 +4,6 @@
   tags:
   - CCE-83569-4
   - CJIS-5.5.3
-  - DISA-STIG-RHEL-09-611010
   - NIST-800-53-AC-7(a)
   - NIST-800-53-CM-6(a)
   - NIST-800-53-IA-5(4)
@@ -30,7 +29,6 @@
   tags:
   - CCE-83569-4
   - CJIS-5.5.3
-  - DISA-STIG-RHEL-09-611010
   - NIST-800-53-AC-7(a)
   - NIST-800-53-CM-6(a)
   - NIST-800-53-IA-5(4)
@@ -50,7 +48,6 @@
   tags:
   - CCE-83569-4
   - CJIS-5.5.3
-  - DISA-STIG-RHEL-09-611010
   - NIST-800-53-AC-7(a)
   - NIST-800-53-CM-6(a)
   - NIST-800-53-IA-5(4)
@@ -244,7 +241,6 @@
   tags:
   - CCE-83569-4
   - CJIS-5.5.3
-  - DISA-STIG-RHEL-09-611010
   - NIST-800-53-AC-7(a)
   - NIST-800-53-CM-6(a)
   - NIST-800-53-IA-5(4)
@@ -264,7 +260,6 @@
   tags:
   - CCE-83569-4
   - CJIS-5.5.3
-  - DISA-STIG-RHEL-09-611010
   - NIST-800-53-AC-7(a)
   - NIST-800-53-CM-6(a)
   - NIST-800-53-IA-5(4)
@@ -458,13 +453,12 @@
   tags:
   - CCE-83569-4
   - CJIS-5.5.3
-  - DISA-STIG-RHEL-09-611010
-  - NIST-800-53-AC-7(a)
-  - NIST-800-53-CM-6(a)
-  - NIST-800-53-IA-5(4)
-  - accounts_password_pam_retry
-  - configure_strategy
-  - low_complexity
-  - medium_disruption
-  - medium_severity
-  - no_reboot_needed
+  - NIST-800-53-AC-7(a)
+  - NIST-800-53-CM-6(a)
+  - NIST-800-53-IA-5(4)
+  - accounts_password_pam_retry
+  - configure_strategy
+  - low_complexity
+  - medium_disruption
+  - medium_severity
+  - no_reboot_needed

[dodys]

hey @vojtapolasek, I believe the rebase didn't work well. For some reason it is including content from PR #12904 which is already merged into master.

[vojtapolasek]

Hello @dodys thanks for noticing. I fixed it.

[codeclimate]

Code Climate has analyzed commit 22ff4ba and detected 2 issues on this pull request.

Here's the issue category breakdown:

Category	Count
Duplication	2

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.