Added a new rule accounts_password_set_warn_age_existing

[rumch-se]

Description:

• _A new SLE 12/15 rule _

Rationale:

• The rule covers CIS requirement 5.4.1.4 Ensure password expiration warning days is 7 or more (Automated). It can be extended to cover similar requirement for other vendors

[openshift-ci]

Hi @rumch-se. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

sle12 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[marcusburghardt]

Besides the comments, also rebase and resolve the conflict, please.

[rumch-se]

Hello @marcusburghardt

Thank you for your feedback.
I have made all proposed corrections
Have a nice day
Rumen

[marcusburghardt]

Also here, I believe the previous text was better. It was only necessary to change 7 by {{{ xccdf_value("var_accounts_password_warn_age_login_defs") }}}

[marcusburghardt]

Here was not updated in the last commit.

[marcusburghardt]

@rumch-se , did you note this comment from my first review? We already know the value of var_accounts_password_warn_age_login_defs at this point. So, we can inform the value itself instead of mentioning the variable name literally. If the user is reading this, he has to stop the flow and go to another place to consult the variable value. I believe this experience is improved by promptly providing the necessary information. This is also valid for the description.

[rumch-se]

Hello @marcusburghardt

The proposed changes were done.
Have a nice day
Rumen

[marcusburghardt]

There are still some small details pending from the last review.

[marcusburghardt]

Here was not updated in the last commit.

[rumch-se]

Hello @marcusburghardt

I hope that now the last commit is correct 3342b9b

Have a nice day
Rumen

[rumch-se]

Hello @marcusburghardt
With the last change in the .html guide we have
++
Configure non-compliant accounts, and give users time to come up with a secure password, warning them in advance about the expiration of their current password. The variable var_accounts_password_warn_age_login_defs=7, defines how many days the user's password will remain valid, and he/she will receive a warning notification about. The next command set ups this for not-compliant user's account:

$ sudo chage --warndays $var_accounts_password_warn_age_login_defs USER
++
Have a nice day
Rumen

[marcusburghardt]

{{{ xccdf_value

Hi @rumch-se , this approach of explicitly informing the variable name in the rule description and other sections is not wrong, but is not a practice in the project. I would recommend to keep this rule aligned to the project practices. It would also make the description shorter and easier to read, IMO.

Please, take a look in some examples of rules which uses a variable to dynamically render the description and other sections:

• https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml#L0-L1
• https://github.com/ComplianceAsCode/content/blob/master/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/rule.yml#L0-L1

[rumch-se]

Hello @marcusburghardt
I made the description part shorter. I used as an example the rule password_warn_age_login_defs
Have a nice day
Rumen

[codeclimate]

Code Climate has analyzed commit b02737e and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 51.7% (2.2% change).

View more on Code Climate.

[marcusburghardt]

Thanks for the rule @rumch-se .

[marcusburghardt]

Automatus CS8 and CS9 are failing because the rule is restricted to sle products in its prodtype parameter.

[marcusburghardt]

Overriding CODEOWNERS since a SUSE approver is not currently available.