From 76e89b525b7cee1f6d44b24ea1487ce727d1e6f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Mon, 14 Dec 2020 21:43:14 +0100
Subject: only fail AUTH-9230 if no _MAX_ROUNDS is defined
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 include/tests_authentication | 68 +++++++++++++++++++++++---------------------
 1 file changed, 35 insertions(+), 33 deletions(-)

(limited to 'include/tests_authentication')

diff --git a/include/tests_authentication b/include/tests_authentication
index b27e59c7..2a166848 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -360,42 +360,44 @@
     fi
     Register --test-no AUTH-9230 --preqs-met ${PREQS_MET} --root-only NO --weight L --network NO --category security --description "Check group password hashing rounds"
     if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: Checking SHA_CRYPT_MIN_ROUNDS option in ${ROOTDIR}etc/login.defs"
-        FIND=$(${GREPBINARY} "^SHA_CRYPT_MIN_ROUNDS" ${ROOTDIR}etc/login.defs | ${AWKBINARY} '{ if ($1=="SHA_CRYPT_MIN_ROUNDS") { print $2 } }')
-        if [ -z "${FIND}" -o "${FIND}" = "0" ]; then
-            LogText "Result: number of minimum rounds used by the encryption algorithm is not configured"
-            Display --indent 2 --text "- Checking minimum group password hashing rounds" --result "${STATUS_DISABLED}" --color YELLOW
-            ReportSuggestion "${TEST_NO}" "Configure minimum encryption algorithm rounds in /etc/login.defs"
+        SHA_CRYPT_MIN_ROUNDS_FIND=$(${GREPBINARY} "^SHA_CRYPT_MIN_ROUNDS" ${ROOTDIR}etc/login.defs | ${AWKBINARY} '{ if ($1=="SHA_CRYPT_MIN_ROUNDS") { print $2 } }')
+        SHA_CRYPT_MAX_ROUNDS_FIND=$(${GREPBINARY} "^SHA_CRYPT_MAX_ROUNDS" ${ROOTDIR}etc/login.defs | ${AWKBINARY} '{ if ($1=="SHA_CRYPT_MAX_ROUNDS") { print $2 } }')
+
+        if [ -z "${SHA_CRYPT_MIN_ROUNDS_FIND}" -o "${SHA_CRYPT_MIN_ROUNDS_FIND}" = "0" ] && [ -z "${SHA_CRYPT_MAX_ROUNDS_FIND}" -o "${SHA_CRYPT_MAX_ROUNDS_FIND}" = "0" ]; then
+            LogText "Result: number of rounds used by the encryption algorithm is not configured"
+            Display --indent 2 --text "- Checking group password hashing rounds" --result "${STATUS_DISABLED}" --color YELLOW
+            ReportSuggestion "${TEST_NO}" "Configure encryption algorithm rounds in /etc/login.defs"
             AddHP 0 2
-        elif [ "${FIND}" -lt 5000 ]; then
-            LogText "Result: low number of minimum encryption algorithm rounds found: ${FIND}"
-            PASSWORD_MINIMUM_ROUNDS=${FIND}
-            Display --indent 2 --text "- Group password hashing rounds (minimum)"  --result "${STATUS_SUGGESTION}" --color YELLOW
-            AddHP 1 2
-        else
-            LogText "Result: number of encryption algorithm rounds is ${FIND}"
-            PASSWORD_MINIMUM_ROUNDS=${FIND}
-            Display --indent 2 --text "- Group password hashing rounds (minimum)" --result CONFIGURED --color GREEN
-            AddHP 2 2
         fi
 
-        LogText "Test: Checking SHA_CRYPT_MAX_ROUNDS option in ${ROOTDIR}etc/login.defs"
-        FIND=$(${GREPBINARY} "^SHA_CRYPT_MAX_ROUNDS" ${ROOTDIR}etc/login.defs | ${AWKBINARY} '{ if ($1=="SHA_CRYPT_MAX_ROUNDS") { print $2 } }')
-        if [ -z "${FIND}" -o "${FIND}" = "0" ]; then
-            LogText "Result: number of maximum rounds used by the encryption algorithm is not configured"
-            Display --indent 2 --text "- Checking maximum group password hashing rounds" --result "${STATUS_DISABLED}" --color YELLOW
-            ReportSuggestion "${TEST_NO}" "Configure maximum encryption algorithm rounds in /etc/login.defs"
-            AddHP 0 2
-        elif [ "${FIND}" -lt 10000 ]; then
-            LogText "Result: low number of maximum encryption algorithm rounds found: ${FIND}"
-            PASSWORD_MINIMUM_ROUNDS=${FIND}
-            Display --indent 2 --text "- Group password hashing rounds (maximum)"  --result "${STATUS_SUGGESTION}" --color YELLOW
-            AddHP 1 2
-        else
-            LogText "Result: number of encryption algorithm rounds is ${FIND}"
-            PASSWORD_MINIMUM_ROUNDS=${FIND}
-            Display --indent 2 --text "- Group password hashing rounds (maximum)" --result CONFIGURED --color GREEN
-            AddHP 2 2
+        if [ -n "${SHA_CRYPT_MIN_ROUNDS_FIND}" ]; then
+            LogText "Test: Checking SHA_CRYPT_MIN_ROUNDS option in ${ROOTDIR}etc/login.defs"
+            if [ "${SHA_CRYPT_MIN_ROUNDS_FIND}" -lt 5000 ]; then
+                LogText "Result: low number of minimum encryption algorithm rounds found: ${SHA_CRYPT_MIN_ROUNDS_FIND}"
+                PASSWORD_MINIMUM_ROUNDS=${SHA_CRYPT_MIN_ROUNDS_FIND}
+                Display --indent 2 --text "- Group password hashing rounds (minimum)"  --result "${STATUS_SUGGESTION}" --color YELLOW
+                AddHP 1 2
+            else
+                LogText "Result: number of encryption algorithm rounds is ${SHA_CRYPT_MIN_ROUNDS_FIND}"
+                PASSWORD_MINIMUM_ROUNDS=${SHA_CRYPT_MIN_ROUNDS_FIND}
+                Display --indent 2 --text "- Group password hashing rounds (minimum)" --result CONFIGURED --color GREEN
+                AddHP 2 2
+            fi
+        fi
+
+        if [ -n "${SHA_CRYPT_MAX_ROUNDS_FIND}" ]; then
+            LogText "Test: Checking SHA_CRYPT_MAX_ROUNDS option in ${ROOTDIR}etc/login.defs"
+            if [ "${SHA_CRYPT_MAX_ROUNDS_FIND}" -lt 10000 ]; then
+                LogText "Result: low number of maximum encryption algorithm rounds found: ${SHA_CRYPT_MAX_ROUNDS_FIND}"
+                PASSWORD_MAXIMUM_ROUNDS=${SHA_CRYPT_MAX_ROUNDS_FIND}
+                Display --indent 2 --text "- Group password hashing rounds (maximum)"  --result "${STATUS_SUGGESTION}" --color YELLOW
+                AddHP 1 2
+            else
+                LogText "Result: number of encryption algorithm rounds is ${SHA_CRYPT_MAX_ROUNDS_FIND}"
+                PASSWORD_MAXIMUM_ROUNDS=${SHA_CRYPT_MAX_ROUNDS_FIND}
+                Display --indent 2 --text "- Group password hashing rounds (maximum)" --result CONFIGURED --color GREEN
+                AddHP 2 2
+            fi
         fi
     fi
 #
-- 
cgit v1.2.3