Use drop-ins file in /etc/login.defs.d/ by teacup-on-rockingchair · Pull Request #14438 · ComplianceAsCode/content

teacup-on-rockingchair · 2026-02-23T08:40:21Z

Description:

Use drop-ins file in /etc/login.defs.d/

Rationale:

Use drop-ins file in /etc/login.defs.d/ for remediation code

openshift-ci · 2026-02-23T08:40:26Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2026-04-06T17:11:17Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs' differs.
--- oval:ssg-set_password_hashing_algorithm_logindefs:def:1
+++ oval:ssg-set_password_hashing_algorithm_logindefs:def:1
@@ -1,2 +1,2 @@
 criteria AND
-criterion oval:ssg-test_set_password_hashing_algorithm_logindefs:tst:1
+criterion oval:ssg-test_password_hashing_algorithm_logindefs:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs
@@ -7,6 +7,7 @@
 # Allow multiple algorithms, but choose the first one for remediation
 #
 var_password_hashing_algorithm="$(echo $var_password_hashing_algorithm | cut -d \| -f 1)"
+
 
 # Strip any search characters in the key arg so that the key can be replaced without
 # adding any search characters to the config file.

bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_min_rounds_logindefs
@@ -2,6 +2,8 @@
 if rpm --quiet -q kernel-core; then
 
 var_password_hashing_min_rounds_login_defs=''
+
+
 
 
 config_file=/etc/login.defs

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs
+++ xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs
@@ -2,6 +2,7 @@
 if rpm --quiet -q kernel-core && { rpm --quiet -q shadow-utils; }; then
 
 var_accounts_password_warn_age_login_defs=''
+
 
 # Strip any search characters in the key arg so that the key can be replaced without
 # adding any search characters to the config file.

bash remediation for rule 'xccdf_org.ssgproject.content_rule_ensure_logrotate_activated' differs.
--- xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
+++ xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
@@ -2,6 +2,8 @@
 if rpm --quiet -q kernel-core && { rpm --quiet -q logrotate; }; then
 
 LOGROTATE_CONF_FILE='/etc/logrotate.conf'
+
+
 
 
 if ! rpm -q --quiet "crontabs" ; then

teacup-on-rockingchair · 2026-04-27T07:46:55Z

@ComplianceAsCode/oracle-maintainers, @ComplianceAsCode/red-hatters, @ComplianceAsCode/ubuntu-maintainers can you please give this one a look

mpurg

Great addition! Ubuntu datastreams look ok except for one variable in the metadata.

Mab879 · 2026-04-27T17:35:05Z

+    contains: {{{ line_regex }}}
+    patterns:
+    - '*.defs'
+  register: _login_defs_has_parameter


I think we need to make this unique.

de9c02c 🙇 should handle it

Mab879 · 2026-04-27T17:35:52Z

+else
+    echo "PASS_WARN_AGE 0" >> {{{ login_defs_path }}}
+fi
+echo "PASS_WARN_AGE 7" >> {{{ login_defs_drop_in_path }}}


This file and greater_value_dropin.pass.sh appear to be same. Please double check.

de9c02c 🙇 should handle it

Mab879 · 2026-04-27T17:36:49Z


 {{{ ansible_instantiate_variables("var_password_hashing_min_rounds_login_defs") }}}

+{{% if product == 'sle16' %}}


Should this also include slmicro6

de9c02c 🙇 should handle it

Make sure on sle16 we use /etc to apply and verify compliance to the rule, while /usr/etc maight be use only in case /etc files do not exist

…config file if not present in /etc

… file if not present in /etc

Macro allows to check both dropin file in conf.d subdir or file directly in /etc

…p_in_path

…-in configuration

…ile and remediated in drop-in

Co-authored-by: Matthew Burket <m@tthewburket.com>

…ng_algorithm/set_password_hashing_algorithm_logindefs/oval/shared.xml Co-authored-by: Matthew Burket <m@tthewburket.com>

teacup-on-rockingchair added this to the 0.1.81 milestone Feb 23, 2026

teacup-on-rockingchair added Ansible Ansible remediation update. SLES SUSE Linux Enterprise Server product related. labels Feb 23, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Feb 23, 2026

teacup-on-rockingchair added OVAL OVAL update. Related to the systems assessments. Bash Bash remediation update. labels Feb 23, 2026

svet-se self-assigned this Mar 9, 2026

svet-se approved these changes Mar 9, 2026

View reviewed changes

teacup-on-rockingchair force-pushed the sle16_login_defs branch from 139bb2c to 785f08f Compare April 6, 2026 14:37

teacup-on-rockingchair force-pushed the sle16_login_defs branch from 4e56b60 to 2ebf750 Compare April 15, 2026 03:51

teacup-on-rockingchair marked this pull request as ready for review April 15, 2026 06:31

teacup-on-rockingchair requested review from a team, Mab879, jan-cerny, matusmarhefka and vojtapolasek as code owners April 15, 2026 06:31

openshift-ci Bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Apr 15, 2026

teacup-on-rockingchair mentioned this pull request Apr 27, 2026

SLE16 fix ensure_logrotate_activated to work with /etc configuration #14680

Draft

mpurg approved these changes Apr 27, 2026

View reviewed changes

Comment thread ...-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/oval/shared.xml Outdated

Mab879 requested changes Apr 27, 2026

View reviewed changes

openshift-ci Bot added the needs-rebase Used by openshift-ci bot. label Apr 28, 2026

teacup-on-rockingchair force-pushed the sle16_login_defs branch from a886d60 to d7a3c69 Compare April 28, 2026 11:11

teacup-on-rockingchair added 2 commits April 28, 2026 14:18

Fix ensure_logrotate_activated to work with /etc configuration

5f4b39c

Make sure on sle16 we use /etc to apply and verify compliance to the rule, while /usr/etc maight be use only in case /etc files do not exist

Use drop-ins file in /etc/login.defs.d/

d254f32

teacup-on-rockingchair and others added 12 commits April 28, 2026 14:18

Use new ansible macro ansible_copy_distro_defaults to create default …

5a16b0c

…config file if not present in /etc

Use new bash macro bash_copy_distro_defaults to create default config…

bb588bb

… file if not present in /etc

Use macro to check if external variable is set to value in a config file

6a35f2c

Macro allows to check both dropin file in conf.d subdir or file directly in /etc

Add tests for the new functionality

0e88997

Add missing definition of login_defs_defaults_path and login_defs_dro…

0b7392a

…p_in_path

Add variables to product_stability

3d77773

Make sure that both min and max rounds are set in either defs or drop…

027d7d8

…-in configuration

make sure configuration is checked both in defs file and in drop-in f…

c3e5b74

…ile and remediated in drop-in

Minor patches to the new ansible macros

4d02fc1

Update shared/macros/10-oval.jinja

e6cef0b

Co-authored-by: Matthew Burket <m@tthewburket.com>

Update linux_os/guide/system/accounts/accounts-pam/set_password_hashi…

406362e

…ng_algorithm/set_password_hashing_algorithm_logindefs/oval/shared.xml Co-authored-by: Matthew Burket <m@tthewburket.com>

Fix spacing in jinja macro

b354563

teacup-on-rockingchair force-pushed the sle16_login_defs branch from d7a3c69 to b354563 Compare April 28, 2026 11:19

openshift-ci Bot removed the needs-rebase Used by openshift-ci bot. label Apr 28, 2026

Code review fixes

de9c02c

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use drop-ins file in /etc/login.defs.d/#14438

Use drop-ins file in /etc/login.defs.d/#14438
teacup-on-rockingchair wants to merge 15 commits intoComplianceAsCode:masterfrom
teacup-on-rockingchair:sle16_login_defs

teacup-on-rockingchair commented Feb 23, 2026

Uh oh!

openshift-ci Bot commented Feb 23, 2026

Uh oh!

github-actions Bot commented Apr 6, 2026 •

edited

Loading

Uh oh!

teacup-on-rockingchair commented Apr 27, 2026

Uh oh!

mpurg left a comment

Uh oh!

Uh oh!

Uh oh!

Mab879 Apr 27, 2026

Uh oh!

teacup-on-rockingchair Apr 29, 2026

Uh oh!

Mab879 Apr 27, 2026

Uh oh!

teacup-on-rockingchair Apr 29, 2026

Uh oh!

Mab879 Apr 27, 2026

Uh oh!

teacup-on-rockingchair Apr 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants


		{{{ ansible_instantiate_variables("var_password_hashing_min_rounds_login_defs") }}}

		{{% if product == 'sle16' %}}

Conversation

teacup-on-rockingchair commented Feb 23, 2026

Description:

Rationale:

Uh oh!

openshift-ci Bot commented Feb 23, 2026

Uh oh!

github-actions Bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

teacup-on-rockingchair commented Apr 27, 2026

Uh oh!

mpurg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Mab879 Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

teacup-on-rockingchair Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Mab879 Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

teacup-on-rockingchair Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Mab879 Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

teacup-on-rockingchair Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Apr 6, 2026 •

edited

Loading