The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
#!/bin/bash
# Reconstructed from oval:mil.disa.stig.solaris11:def:46
# The system must prevent the use of dictionary words for passwords.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# Check in /etc/default/passwd that DICTIONLIST is set to /usr/share/lib/dict/words.
# textfilecontent54_object (textfilecontent54_test)
test_1() {
(sed -En 's/^\s*DICTIONLIST=(\S*)\s*$/\1/p' '/etc/default/passwd') | grep -qxF '/usr/share/lib/dict/words'
}
# Check in /etc/default/passwd that DICTIONDBDIR is set to /var/passwd.
# textfilecontent54_object (textfilecontent54_test)
test_2() {
(sed -En 's/^\s*DICTIONDBDIR=(\S*)\s*$/\1/p' '/etc/default/passwd') | grep -qxF '/var/passwd'
}
# Check to make sure that /usr/share/lib/dict/words exists and is not empty.
# file_object (file_test)
test_3() {
[ "$(stat -c '%s' '/usr/share/lib/dict/words')" -gt 0 ]
}
# Check to make sure that pw_dict.hwm exists in the path specified by DICTONDBDIR and is not empty.
# file_object (file_test)
test_4() {
[ "$(stat -c '%s' '/var/passwd/pw_dict.hwm')" -gt 0 ]
}
# Check to make sure that pw_dict.pwd exists in the path specified by DICTONDBDIR and is not empty.
# file_object (file_test)
test_5() {
[ "$(stat -c '%s' '/var/passwd/pw_dict.pwd')" -gt 0 ]
}
# Check to make sure that pw_dict.pwi exists in the path specified by DICTONDBDIR and is not empty.
# file_object (file_test)
test_6() {
[ "$(stat -c '%s' '/var/passwd/pw_dict.pwi')" -gt 0 ]
}
# Check to make sure that authtok_check.lock exists in the path specified by DICTONDBDIR.
# file_object (file_test)
test_7() {
test -e '/var/passwd/authtok_check.lock' &>/dev/null
}
if ( test_1 && test_2 && test_3 && test_4 && test_5 && test_6 && test_7 ); then
echo "PASS"
else
echo "FAIL"
fi Assessment Script Powered by AISandbox-executed
A standalone Shell script to assess this control automatically. Review before running it in your environment.
Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.
#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.solaris11:def:46
if [ ! -f "/etc/default/passwd" ]; then echo "PASS"; exit 0; fi
if grep -q "^\\s*DICTIONLIST=\\S*\\s*$" /etc/default/passwd && grep -q "/usr/share/lib/dict/words" /etc/default/passwd; then :; else echo "FAIL"; exit 1; fi
if [ ! -f "/etc/default/passwd" ]; then echo "PASS"; exit 0; fi
if grep -q "^\\s*DICTIONDBDIR=\\S*\\s*$" /etc/default/passwd && grep -q "/var/passwd" /etc/default/passwd; then :; else echo "FAIL"; exit 1; fi
if [ ! -s "/usr/share/lib/dict/words" ]; then echo "PASS"; exit 0; fi
if [ -s "/var/passwd/pw_dict.hwm" ]; then :; else echo "FAIL"; exit 1; fi
if [ -s "/var/passwd/pw_dict.pwd" ]; then :; else echo "FAIL"; exit 1; fi
echo "PASS"; exit 0