Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rule: sshd_include_crypto_policy, drop remediations, improve OVAL #13028

Merged
merged 1 commit into from
Feb 12, 2025
Merged

Rule: sshd_include_crypto_policy, drop remediations, improve OVAL #13028

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 0 additions & 12 deletions linux_os/guide/services/ssh/ssh_server/sshd_include_crypto_policy/ansible/shared.yml
View file
Open in desktop

This file was deleted.

5 changes: 0 additions & 5 deletions linux_os/guide/services/ssh/ssh_server/sshd_include_crypto_policy/bash/shared.sh
View file
Open in desktop

This file was deleted.

8 changes: 4 additions & 4 deletions linux_os/guide/services/ssh/ssh_server/sshd_include_crypto_policy/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,19 +14,19 @@

<ind:textfilecontent54_object id="obj_{{{ rule_id }}}_include_sshd_drop_in" version="1">
<ind:filepath operation="pattern match">/etc/ssh/sshd_config</ind:filepath>
<ind:pattern operation="pattern match">^Include /etc/ssh/sshd_config.d/\*.conf$</ind:pattern>
<ind:pattern operation="pattern match">^[ \t]*(?i)Include(?-i)[ \t]+/etc/ssh/sshd_config\.d/\*.conf$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>


<ind:textfilecontent54_test id="test_{{{ rule_id }}}_include_sshd_include_system_crypto"
comment="Ensure that drop in config files are included" version="1" check="all">
<ind:object object_ref="obj_{{{ rule_id }}}_include_sshd_drop_in"/>
<ind:object object_ref="obj_{{{ rule_id }}}_include_sshd_include_system_crypto"/>
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="obj_{{{ rule_id }}}_include_sshd_include_system_crypto" version="1">
<ind:filepath operation="pattern match">/etc/ssh/sshd_config</ind:filepath>
<ind:pattern operation="pattern match">^Include /etc/crypto-policies/back-ends/opensshserver\.config</ind:pattern>
<ind:filepath operation="pattern match">/etc/ssh/(sshd_config|sshd_config\.d/.*\.conf)</ind:filepath>
<ind:pattern operation="pattern match">^[ \t]*(?i)Include(?-i)[ \t]+/etc/crypto-policies/back-ends/opensshserver\.config$</ind:pattern>
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
8 changes: 5 additions & 3 deletions linux_os/guide/services/ssh/ssh_server/sshd_include_crypto_policy/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,8 +25,8 @@ references:
checktext: |-
Verify that RHEL 9 implements DOD-approved encryption ciphers for SSH connections.
Verify that the SSH configuration files include the path to the systemwide policy with the following command:
<pre>sudo grep -R Include /etc/ssh/sshd_config /etc/ssh/sshd_config.d/
<pre>sudo grep -R "Include /etc/ssh/sshd_config" /etc/ssh/sshd_config.d/

/etc/ssh/sshd_config:Include /etc/ssh/sshd_config.d/*.conf
/etc/ssh/sshd_config.d/50-redhat.conf:Include /etc/crypto-policies/back-ends/opensshserver.config</pre>
If "Include /etc/ssh/sshd_config.d/*.conf" or "Include /etc/crypto-policies/back-ends/opensshserver.config" are not included in the system sshd config or if the file "/etc/ssh/sshd_config.d/50-redhat.conf" is missing, this is a finding.
Expand All @@ -36,4 +36,6 @@ fixtext: |-
Reinstall OpenSSH server package contents with the following command:
<pre>sudo dnf -y remove openssh-server && sudo dnf -y install openssh-server</pre>

platform: not osbuild
warnings:
- general: |-
There is no automated remediation because recommended action could severely disrupt the system and might not be efficient in fixing the problem.
10 changes: 10 additions & 0 deletions linux_os/guide/services/ssh/ssh_server/sshd_include_crypto_policy/tests/confing.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
#!/bin/bash
# remediation = none
# platform = multi_platform_all

sed -i '/Include \/etc\/crypto-policies\/back-ends\/opensshserver.config/d' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf
echo "Include /etc/crypto-policies/back-ends/opensshserver.config" >> /etc/ssh/sshd_config

if ! grep -q "Include /etc/ssh/sshd_config.d/*.conf" /etc/ssh/sshd_config; then
echo "Include /etc/ssh/sshd_config.d/*.conf" >> /etc/ssh/sshd_config
fi
9 changes: 0 additions & 9 deletions linux_os/guide/services/ssh/ssh_server/sshd_include_crypto_policy/tests/default_pass.pass.sh
View file
Open in desktop

This file was deleted.

10 changes: 10 additions & 0 deletions linux_os/guide/services/ssh/ssh_server/sshd_include_crypto_policy/tests/drop_in.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
#!/bin/bash
# remediation = none
# platform = multi_platform_all

sed -i '/Include \/etc\/crypto-policies\/back-ends\/opensshserver.config/d' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf
echo "Include /etc/crypto-policies/back-ends/opensshserver.config" >> /etc/ssh/sshd_config.d/50-redhat.conf

if ! grep -q "Include /etc/ssh/sshd_config.d/*.conf" /etc/ssh/sshd_config; then
echo "Include /etc/ssh/sshd_config.d/*.conf" >> /etc/ssh/sshd_config
fi
11 changes: 4 additions & 7 deletions linux_os/guide/services/ssh/ssh_server/sshd_include_crypto_policy/tests/no_crypto.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,9 @@
#!/bin/bash
# remediation = none
# platform = multi_platform_all

# this is done because the remediation will reset the /etc/ssh/sshd_config file
# which is modified by Automatus so that root can log in.
# This prevents Automatus from logging in for final scan.
echo "PermitRootLogin yes" > /etc/ssh/sshd_config.d/99-automatus.conf

sed -i '/Include/d' /etc/ssh/sshd_config
sed -i '/Include \/etc\/crypto-policies\/back-ends\/opensshserver.config/d' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf

if ! grep -q "Include /etc/ssh/sshd_config.d/*.conf" /etc/ssh/sshd_config; then
echo "Include /etc/ssh/sshd_config.d/*.conf" >> /etc/ssh/ssh_config.d/50-redhat.conf
echo "Include /etc/ssh/sshd_config.d/*.conf" >> /etc/ssh/sshd_config
fi
11 changes: 4 additions & 7 deletions linux_os/guide/services/ssh/ssh_server/sshd_include_crypto_policy/tests/no_drop_in.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,9 @@
#!/bin/bash

# this is done because the remediation will reset the /etc/ssh/sshd_config file
# which is modified by Automatus so that root can log in.
# This prevents Automatus from logging in for final scan.
echo "PermitRootLogin yes" > /etc/ssh/sshd_config.d/99-automatus.conf
# remediation = none
# platform = multi_platform_all

sed -i '/Include/d' /etc/ssh/sshd_config

if ! grep -q "Include /etc/ssh/sshd_config.d/*.conf" /etc/ssh/sshd_config; then
echo "Include /etc/ssh/sshd_config.d/*.conf" >> /etc/ssh/ssh_config
if ! grep -q "Include /etc/crypto-policies/back-ends/opensshserver.config" /etc/ssh/sshd_config.d/*.conf /etc/ssh/sshd_config; then
echo "Include /etc/crypto-policies/back-ends/opensshserver.config" >> /etc/ssh/sshd_config.d/50-redhat.conf
fi
9 changes: 3 additions & 6 deletions linux_os/guide/services/ssh/ssh_server/sshd_include_crypto_policy/tests/no_includes.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,5 @@
#!/bin/bash
# remediation = none
# platform = multi_platform_all

# this is done because the remediation will reset the /etc/ssh/sshd_config file
# which is modified by Automatus so that root can log in.
# This prevents Automatus from logging in for final scan.
echo "PermitRootLogin yes" > /etc/ssh/sshd_config.d/99-automatus.conf

sed -i '/Include/d' /etc/ssh/sshd_config
sed -i '/Include/d' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf
Loading