Rule: sshd_include_crypto_policy, drop remediations, improve OVAL

[evgenyz]

Description:

• We are dropping all remediations for now, as the recommended one is questionable.
• OVAL now recognizes Include directive in any drop-in file, in case-insensitive and tolerant to different separators way.
• Dropping the not osbuild platform as well.

Rationale:

• Current remediation causes a lot of troubles and most likely not efficient: Fix ssh include cryptopolicy #12931.
• We should not force the location of the Include directive in the check, any drop-in file is OK.
• Platform is not needed if the rule does not try to remediate the system in a barbaric way.

[evgenyz]

Not creating backport until we all agree on the changeset.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy'.
--- xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy
+++ xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy
@@ -7,6 +7,9 @@
 In order to accomplish this the SSHD configuration should include the configuration file provided by the system crypto policy.
 The following line should be present in /etc/ssh/sshd_config or in a file included by this file (a file within the /etc/ssh/sshd_config.d directory):
 Include /etc/crypto-policies/back-ends/opensshserver.config
+
+[warning]:
+There is no automated remediation because recommended action could severely disrupt the system and might not be efficient in fixing the problem.
 
 [reference]:
 CCI-001453

New data stream is missing bash remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy'.
New data stream is missing ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy'.
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy'
--- xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy
+++ xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy
@@ -1 +1 @@
-oval:ssg-installed_env_is_osbuild:def:1
+

[Mab879]

I wondering if we should have some sort of failing Automatus test to make sure the rule works.

[evgenyz]

I wondering if we should have some sort of failing Automatus test to make sure the rule works.

Fair enough, got too far. Reinstated all tests but without extra workarounds and with fixes (ssh -> sshd etc).

Edit: GH is a bit slow on updating PRs today.

[vojtapolasek]

Thank you for the PR @evgenyz .
Please see my comments.
Additionaly, I would like to ask you to add a warning to rule.yml stating that the rule does not have a remediation and giving some reason for that.
You can see an example of warning in sshd_set_idle_timeout.
Categories of warnings are shown here: https://complianceascode.readthedocs.io/en/latest/manual/developer/04_style_guide.html#rule-sections

[codeclimate]

Code Climate has analyzed commit 93b1b5f and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

[vojtapolasek]

Looks good now. Thank you.

[vojtapolasek]

Merging. Failing automatus checks happen because the rule is currently only in RHEL 9 datastream.