Use drop-ins file in /etc/login.defs.d/ by teacup-on-rockingchair · Pull Request #14438 · ComplianceAsCode/content

teacup-on-rockingchair · 2026-02-23T08:40:21Z

Description:

Use drop-ins file in /etc/login.defs.d/

Rationale:

Use drop-ins file in /etc/login.defs.d/ for remediation code

openshift-ci · 2026-02-23T08:40:26Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2026-04-06T17:11:17Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs' differs.
--- oval:ssg-set_password_hashing_algorithm_logindefs:def:1
+++ oval:ssg-set_password_hashing_algorithm_logindefs:def:1
@@ -1,2 +1,2 @@
 criteria AND
-criterion oval:ssg-test_set_password_hashing_algorithm_logindefs:tst:1
+criterion oval:ssg-test_password_hashing_algorithm_logindefs:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs
@@ -7,6 +7,7 @@
 # Allow multiple algorithms, but choose the first one for remediation
 #
 var_password_hashing_algorithm="$(echo $var_password_hashing_algorithm | cut -d \| -f 1)"
+
 
 # Strip any search characters in the key arg so that the key can be replaced without
 # adding any search characters to the config file.

bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs
@@ -2,6 +2,8 @@
 if rpm --quiet -q kernel-core; then
 
 var_password_hashing_min_rounds_login_defs=''
+
+
 
 
 config_file=/etc/login.defs

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs
+++ xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs
@@ -2,6 +2,7 @@
 if rpm --quiet -q kernel-core && { rpm --quiet -q shadow-utils; }; then
 
 var_accounts_password_warn_age_login_defs=''
+
 
 # Strip any search characters in the key arg so that the key can be replaced without
 # adding any search characters to the config file.

bash remediation for rule 'xccdf_org.ssgproject.content_rule_ensure_logrotate_activated' differs.
--- xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
+++ xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
@@ -2,6 +2,8 @@
 if rpm --quiet -q kernel-core && { rpm --quiet -q logrotate; }; then
 
 LOGROTATE_CONF_FILE='/etc/logrotate.conf'
+
+
 
 
 if ! rpm -q --quiet "crontabs" ; then

teacup-on-rockingchair · 2026-04-27T07:46:55Z

@ComplianceAsCode/oracle-maintainers, @ComplianceAsCode/red-hatters, @ComplianceAsCode/ubuntu-maintainers can you please give this one a look

mpurg

Great addition! Ubuntu datastreams look ok except for one variable in the metadata.

Mab879 · 2026-04-27T17:35:05Z

+    contains: {{{ line_regex }}}
+    patterns:
+    - '*.defs'
+  register: _login_defs_has_parameter


I think we need to make this unique.

de9c02c 🙇 should handle it

Mab879 · 2026-04-27T17:35:52Z

+else
+    echo "PASS_WARN_AGE 0" >> {{{ login_defs_path }}}
+fi
+echo "PASS_WARN_AGE 7" >> {{{ login_defs_drop_in_path }}}


This file and greater_value_dropin.pass.sh appear to be same. Please double check.

de9c02c 🙇 should handle it

Mab879 · 2026-04-27T17:36:49Z


 {{{ ansible_instantiate_variables("var_password_hashing_min_rounds_login_defs") }}}

+{{% if product == 'sle16' %}}


Should this also include slmicro6

de9c02c 🙇 should handle it

Make sure on sle16 we use /etc to apply and verify compliance to the rule, while /usr/etc maight be use only in case /etc files do not exist

…config file if not present in /etc

… file if not present in /etc

Macro allows to check both dropin file in conf.d subdir or file directly in /etc

…p_in_path

…-in configuration

…ile and remediated in drop-in

Co-authored-by: Matthew Burket <m@tthewburket.com>

…ng_algorithm/set_password_hashing_algorithm_logindefs/oval/shared.xml Co-authored-by: Matthew Burket <m@tthewburket.com>

…ng_algorithm/set_password_hashing_min_rounds_logindefs/ansible/shared.yml Co-authored-by: Matthew Burket <m@tthewburket.com>

openshift-ci · 2026-05-01T16:56:32Z

@teacup-on-rockingchair: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	`16676bc`	link	true	`/test e2e-aws-openshift-node-compliance`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Mab879

Approving, leaving open for a SUSE maintainer to review as well.

teacup-on-rockingchair added this to the 0.1.81 milestone Feb 23, 2026

teacup-on-rockingchair added Ansible Ansible remediation update. SLES SUSE Linux Enterprise Server product related. labels Feb 23, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Feb 23, 2026

teacup-on-rockingchair added OVAL OVAL update. Related to the systems assessments. Bash Bash remediation update. labels Feb 23, 2026

svet-se self-assigned this Mar 9, 2026

svet-se approved these changes Mar 9, 2026

View reviewed changes

teacup-on-rockingchair force-pushed the sle16_login_defs branch from 139bb2c to 785f08f Compare April 6, 2026 14:37

teacup-on-rockingchair force-pushed the sle16_login_defs branch from 4e56b60 to 2ebf750 Compare April 15, 2026 03:51

teacup-on-rockingchair marked this pull request as ready for review April 15, 2026 06:31

teacup-on-rockingchair requested review from a team, Mab879, jan-cerny, matusmarhefka and vojtapolasek as code owners April 15, 2026 06:31

openshift-ci Bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Apr 15, 2026

teacup-on-rockingchair mentioned this pull request Apr 27, 2026

SLE16 fix ensure_logrotate_activated to work with /etc configuration #14680

Draft

mpurg approved these changes Apr 27, 2026

View reviewed changes

Comment thread ...-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/oval/shared.xml Outdated

Mab879 requested changes Apr 27, 2026

View reviewed changes

openshift-ci Bot added the needs-rebase Used by openshift-ci bot. label Apr 28, 2026

teacup-on-rockingchair force-pushed the sle16_login_defs branch from a886d60 to d7a3c69 Compare April 28, 2026 11:11

teacup-on-rockingchair added 2 commits April 28, 2026 14:18

Fix ensure_logrotate_activated to work with /etc configuration

5f4b39c

Make sure on sle16 we use /etc to apply and verify compliance to the rule, while /usr/etc maight be use only in case /etc files do not exist

Use drop-ins file in /etc/login.defs.d/

d254f32

teacup-on-rockingchair and others added 12 commits April 28, 2026 14:18

Use new ansible macro ansible_copy_distro_defaults to create default …

5a16b0c

…config file if not present in /etc

Use new bash macro bash_copy_distro_defaults to create default config…

bb588bb

… file if not present in /etc

Use macro to check if external variable is set to value in a config file

6a35f2c

Macro allows to check both dropin file in conf.d subdir or file directly in /etc

Add tests for the new functionality

0e88997

Add missing definition of login_defs_defaults_path and login_defs_dro…

0b7392a

…p_in_path

Add variables to product_stability

3d77773

Make sure that both min and max rounds are set in either defs or drop…

027d7d8

…-in configuration

make sure configuration is checked both in defs file and in drop-in f…

c3e5b74

…ile and remediated in drop-in

Minor patches to the new ansible macros

4d02fc1

Update shared/macros/10-oval.jinja

e6cef0b

Co-authored-by: Matthew Burket <m@tthewburket.com>

Update linux_os/guide/system/accounts/accounts-pam/set_password_hashi…

406362e

…ng_algorithm/set_password_hashing_algorithm_logindefs/oval/shared.xml Co-authored-by: Matthew Burket <m@tthewburket.com>

Fix spacing in jinja macro

b354563

teacup-on-rockingchair force-pushed the sle16_login_defs branch from d7a3c69 to b354563 Compare April 28, 2026 11:19

openshift-ci Bot removed the needs-rebase Used by openshift-ci bot. label Apr 28, 2026

Code review fixes

de9c02c

teacup-on-rockingchair requested a review from Mab879 May 1, 2026 06:04

Mab879 requested changes May 1, 2026

View reviewed changes

Comment thread .../set_password_hashing_algorithm/set_password_hashing_min_rounds_logindefs/ansible/shared.yml Outdated

Update linux_os/guide/system/accounts/accounts-pam/set_password_hashi…

16676bc

…ng_algorithm/set_password_hashing_min_rounds_logindefs/ansible/shared.yml Co-authored-by: Matthew Burket <m@tthewburket.com>

Mab879 approved these changes May 1, 2026

View reviewed changes


		{{{ ansible_instantiate_variables("var_password_hashing_min_rounds_login_defs") }}}

		{{% if product == 'sle16' %}}

Conversation

teacup-on-rockingchair commented Feb 23, 2026

Description:

Rationale:

Uh oh!

openshift-ci Bot commented Feb 23, 2026

Uh oh!

github-actions Bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

teacup-on-rockingchair commented Apr 27, 2026

Uh oh!

mpurg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Mab879 Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

teacup-on-rockingchair Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Mab879 Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

teacup-on-rockingchair Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Mab879 Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

teacup-on-rockingchair Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

openshift-ci Bot commented May 1, 2026

Uh oh!

Mab879 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Apr 6, 2026 •

edited

Loading