Control 5.3.3.2.3 `Ensure password complexity is configured` fails because of wrong values that are used

[DianaMariaDDM]

Describe the Issue
This control was failing for the following reasons:

Expected Behavior
minclass should be set to 4 and ocredit should be set to -1

Actual Behavior
ocredit is being set to 0 and minclass is being set to 3, which causes the failure in the assessment!

Control(s) Affected

• Control 5.3.3.2.3

Environment (please complete the following information):

• branch being used: [e.g. devel]

Possible Solution
The solution will be provided in a PR.

[uk-bolly]

hi @DianaMariaDDM

Thank you for the Issue and PR as always your feedback is highly important and really helps us to continue improving the ansible-lockdown content.

Just working this this particular issue, i'm trying to work out the scanner you are using as we do see many false positives or scanners being far too brittle in their checks meaning that do not match the CIS documentation.
For the documentation on this release it states the following:

• minclass = N
• dcredit = N # Value should be either 0 or a number proceeded by a minus (-
) symbol
• ucredit = -1 # Value should be either 0 or a number proceeded by a minus (-)
symbol
• ocredit = -1 # Value should be either 0 or a number proceeded by a minus (-)
symbol
• lcredit = -1 # Value should be either 0 or a number proceeded by a minus (-)
symbol

While i can see how this has occurred, these numbers are able to be overridden by the consumers so that they match their own site policies and requirements, so long as they fall in with requirements of the benchmark.

Happy to discuss this further on discord is thats easier?

Thanks as always

uk-bolly

[uk-bolly]

hi @DianaMariaDDM

As im working my way through the issues, wondering if you are able to let us know the scanner you are using? I don't believe there is anything to be fixed on this issue and there could potentially be different values on all scanners.

Kindest regards

uk-bolly

[DianaMariaDDM]

Hello,

Alright, I see what you mean. Indeed, I get the same information you quoted from the documentation, but the check still fails when those values are used. I use the CIS-CAT Assessor version 4.56.0.

[uk-bolly]

Hello,

Alright, I see what you mean. Indeed, I get the same information you quoted from the documentation, but the check still fails when those values are used. I use the CIS-CAT Assessor version 4.56.0.

Hi @DianaMariaDDM

Any chance you could show us how they fail and what they are failing on? Id be keen to see what its checking and why it fails even if the values match their own documentation. It could be a bug on their end f course but keen to see why it is failing if you are changing the values?

Many thanks

uk-bolly