scap-security-guide May 2014

scap-security-guide@lists.fedorahosted.org

31 participants
60 discussions

NIST 800-53 identifiers
by Kordell, Luke T 30 Aug '14

30 Aug '14

Hello, I noticed that the majority of the rule definitions now have NIST 800-53 identifiers or an empty set of quotes where an identifier will be added. Is there a way to get the already-added identifiers to show-up on the .html scan results? At the moment all I can see is the CCE number. Thanks, Luke K

5 6

[PATCH 2/2] [RHEL/6, RHEL/7, Fedora] Drop Requires on openscap-utils. Add a note into manual pages regarding that.
by Jan Lieskovsky 03 Jun '14

03 Jun '14

6 9

[PATCH] [RHEL/6, RHEL/7, shared] Finish logrotate_rotate_all_files => ensure_logrotate_activated transition. Replace ensure_logrotate_activated unknown test stub with actual OVAL check implementation.
by Jan Lieskovsky 02 Jun '14

02 Jun '14

The change: [1] https://git.fedorahosted.org/cgit/scap-security-guide.git/commit/?id=d2f99b… attempted to replace "logrotate_rotate_all_files" OVAL check with "ensure_logrotate_activated" OVAL check, but failed (to do so in all locations): scap-security-guide]$ grep -rHn "logrotate_rotate_all_files" * RHEL/6/input/system/logging.xml:377:<oval id="logrotate_rotate_all_files" /> RHEL/7/input/system/logging.xml:377:<oval id="logrotate_rotate_all_files" /> resulting into the following new 'make validate' / verify-input-references.py error message to appear: Invalid OVAL definition referenced by XCCDF Rule: ensure_logrotate_activated Fix that by referencing the new OVAL check name in RHEL/{6,7}/input/system/logging.xml files too. Besides that the original RHEL/6/input/checks/ensure_logrotate_activated.xml OVAL check was implemented just as unknown OVAL test stub. Replace that stub definition with actual implementation based on guide.html content, move it to shared, and create links for RHEL/6 and RHEL/7. The proposal has been tested on RHEL/6 & RHEL/7 - rpm package builds properly, make validate warning disappeared & the check seems to be working properly on both of the products. Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[PATCH] [RHEL/6] Start using package_rsh_removed OVAL check [RHEL/7] Define new XCCDF rule package_rsh_removed [shared] Move the RHEL-6 specific check to be shared one
by Jan Lieskovsky 02 Jun '14

02 Jun '14

Proposed patch adds (previously missing) package_rsh_removed XCCDF reference to already existing OVAL check with same name. Also defines the same XCCDF rule for RHEL-7. Yet moves the original RHEL-6 specific package_rsh_removed OVAL check to be shared one. Change has been tested on RHEL/6 & RHEL/7, rpms build correctly, underlying rule seems to work as expected (on both products). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[PATCH] [RHEL/6] [RHEL/7] [shared] When checking for static IP address configuration in network scripts allow BOOTPROTO to match also "none" (since that's what system-config-network / nm-connection-editor do when creating static IP connection)
by Jan Lieskovsky 02 Jun '14

02 Jun '14

As noted in: [1] https://github.com/cobbler/cobbler/issues/361 [2] https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux… BOOTPROTO variable in /etc/sysconfig/network-scripts can have just one of (none|bootp|dhcp) values. Initscripts knowns also only these three: [3] https://git.fedorahosted.org/cgit/initscripts.git/tree/sysconfig.txt meaning when 'bootp' or 'dhcp' options are used, the DHCP client is run on the device. Any other option is dealt with / considered to mean static configuration. When system-config-network / system-config-network-tui / nm-connection-editor creates new connection with static IP configuration, it uses BOOTPROTO=none in the particular /etc/sysconfig/network-scripts/ifcfg-conn-name script (can be verified by creating sample connection). Based on bug: [4] https://bugzilla.redhat.com/show_bug.cgi?id=528068 and resulting patch: [5] http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=c31b3e… NetworkManager (starting from NetworkManager-0.7.996-5.git20091021.fc12) treats BOOTPROTO=static as an alias for BOOTPROTO=none (doesn't complain when 'static' is used as BOOTPROTO specification). But since RHEL-6 Deployment guide [2] and initscripts code [3] know / suggest use of 'none', enhance the sysconfig_networking_bootproto_ifcfg OVAL check to allow test success also in case 'none' is used as BOOTPROTO specification (since that actually is what is used, when new static IP using connection is created e.g. via system-config-network or nm-connection-editor). Besides that (support also for 'none' in BOOTPROTO specification), the patch starts to recommend to use 'none' on appropriate places (RHEL/6, RHEL/7 XCCDF rules description, stig reference) & moves originally RHEL-6 specific sysconfig_networking_bootproto_ifcfg OVAL check to be shared one. The change has been tested on both of RHEL/6 & RHEL/7, rpm(s) build correctly, the change seems to be working as expected (on both products). Please review. Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team

2 2

[PATCH 01/01] Several changes in sshd_* fixes (ignore previous)
by Rui Pedro Bernardino 29 May '14

29 May '14

From: Rui Bernardino <rui-p-bernardino(a)telecom.pt> Signed-off-by: Rui Bernardino <rui-p-bernardino(a)telecom.pt> --- Fedora/input/fixes/bash/sshd_disable_rhosts.sh | 1 + .../fixes/bash/sshd_do_not_permit_user_env.sh | 1 + .../input/fixes/bash/sshd_enable_warning_banner.sh | 1 + .../input/fixes/bash/sshd_use_approved_ciphers.sh | 1 + .../fixes/bash/sshd_disable_empty_passwords.sh | 6 +-- RHEL/6/input/fixes/bash/sshd_disable_rhosts.sh | 6 +-- RHEL/6/input/fixes/bash/sshd_disable_root_login.sh | 6 +-- .../fixes/bash/sshd_do_not_permit_user_env.sh | 6 +-- .../input/fixes/bash/sshd_enable_warning_banner.sh | 6 +-- RHEL/6/input/fixes/bash/sshd_set_idle_timeout.sh | 9 +--- RHEL/6/input/fixes/bash/sshd_set_keepalive.sh | 6 +-- .../input/fixes/bash/sshd_use_approved_ciphers.sh | 6 +-- .../fixes/bash/sshd_disable_empty_passwords.sh | 6 +-- RHEL/7/input/fixes/bash/sshd_disable_rhosts.sh | 6 +-- RHEL/7/input/fixes/bash/sshd_disable_root_login.sh | 6 +-- .../fixes/bash/sshd_do_not_permit_user_env.sh | 6 +-- .../input/fixes/bash/sshd_enable_warning_banner.sh | 6 +-- RHEL/7/input/fixes/bash/sshd_set_idle_timeout.sh | 9 +--- RHEL/7/input/fixes/bash/sshd_set_keepalive.sh | 6 +-- .../input/fixes/bash/sshd_use_approved_ciphers.sh | 6 +-- shared/fixes/bash/sshd_disable_empty_passwords.sh | 42 ++++++++------- shared/fixes/bash/sshd_disable_rhosts.sh | 57 ++++++++++++++++++++ shared/fixes/bash/sshd_disable_root_login.sh | 42 ++++++++------- shared/fixes/bash/sshd_do_not_permit_user_env.sh | 57 ++++++++++++++++++++ shared/fixes/bash/sshd_enable_warning_banner.sh | 57 ++++++++++++++++++++ shared/fixes/bash/sshd_set_idle_timeout.sh | 43 ++++++++------- shared/fixes/bash/sshd_set_keepalive.sh | 42 ++++++++------- shared/fixes/bash/sshd_use_approved_ciphers.sh | 57 ++++++++++++++++++++ 28 files changed, 337 insertions(+), 166 deletions(-) create mode 120000 Fedora/input/fixes/bash/sshd_disable_rhosts.sh create mode 120000 Fedora/input/fixes/bash/sshd_do_not_permit_user_env.sh create mode 120000 Fedora/input/fixes/bash/sshd_enable_warning_banner.sh create mode 120000 Fedora/input/fixes/bash/sshd_use_approved_ciphers.sh mode change 100644 => 120000 RHEL/6/input/fixes/bash/sshd_disable_empty_passwords.sh mode change 100644 => 120000 RHEL/6/input/fixes/bash/sshd_disable_rhosts.sh mode change 100644 => 120000 RHEL/6/input/fixes/bash/sshd_disable_root_login.sh mode change 100644 => 120000 RHEL/6/input/fixes/bash/sshd_do_not_permit_user_env.sh mode change 100644 => 120000 RHEL/6/input/fixes/bash/sshd_enable_warning_banner.sh mode change 100644 => 120000 RHEL/6/input/fixes/bash/sshd_set_idle_timeout.sh mode change 100644 => 120000 RHEL/6/input/fixes/bash/sshd_set_keepalive.sh mode change 100644 => 120000 RHEL/6/input/fixes/bash/sshd_use_approved_ciphers.sh mode change 100644 => 120000 RHEL/7/input/fixes/bash/sshd_disable_empty_passwords.sh mode change 100644 => 120000 RHEL/7/input/fixes/bash/sshd_disable_rhosts.sh mode change 100644 => 120000 RHEL/7/input/fixes/bash/sshd_disable_root_login.sh mode change 100644 => 120000 RHEL/7/input/fixes/bash/sshd_do_not_permit_user_env.sh mode change 100644 => 120000 RHEL/7/input/fixes/bash/sshd_enable_warning_banner.sh mode change 100644 => 120000 RHEL/7/input/fixes/bash/sshd_set_idle_timeout.sh mode change 100644 => 120000 RHEL/7/input/fixes/bash/sshd_set_keepalive.sh mode change 100644 => 120000 RHEL/7/input/fixes/bash/sshd_use_approved_ciphers.sh create mode 100755 shared/fixes/bash/sshd_disable_rhosts.sh create mode 100755 shared/fixes/bash/sshd_do_not_permit_user_env.sh create mode 100755 shared/fixes/bash/sshd_enable_warning_banner.sh create mode 100755 shared/fixes/bash/sshd_use_approved_ciphers.sh diff --git a/Fedora/input/fixes/bash/sshd_disable_rhosts.sh b/Fedora/input/fixes/bash/sshd_disable_rhosts.sh new file mode 120000 index 0000000..94579fe --- /dev/null +++ b/Fedora/input/fixes/bash/sshd_disable_rhosts.sh @@ -0,0 +1 @@ +../../../../shared/fixes/bash/sshd_disable_rhosts.sh \ No newline at end of file diff --git a/Fedora/input/fixes/bash/sshd_do_not_permit_user_env.sh b/Fedora/input/fixes/bash/sshd_do_not_permit_user_env.sh new file mode 120000 index 0000000..1e39646 --- /dev/null +++ b/Fedora/input/fixes/bash/sshd_do_not_permit_user_env.sh @@ -0,0 +1 @@ +../../../../shared/fixes/bash/sshd_do_not_permit_user_env.sh \ No newline at end of file diff --git a/Fedora/input/fixes/bash/sshd_enable_warning_banner.sh b/Fedora/input/fixes/bash/sshd_enable_warning_banner.sh new file mode 120000 index 0000000..a7707eb --- /dev/null +++ b/Fedora/input/fixes/bash/sshd_enable_warning_banner.sh @@ -0,0 +1 @@ +../../../../shared/fixes/bash/sshd_enable_warning_banner.sh \ No newline at end of file diff --git a/Fedora/input/fixes/bash/sshd_use_approved_ciphers.sh b/Fedora/input/fixes/bash/sshd_use_approved_ciphers.sh new file mode 120000 index 0000000..dfec454 --- /dev/null +++ b/Fedora/input/fixes/bash/sshd_use_approved_ciphers.sh @@ -0,0 +1 @@ +../../../../shared/fixes/bash/sshd_use_approved_ciphers.sh \ No newline at end of file diff --git a/RHEL/6/input/fixes/bash/sshd_disable_empty_passwords.sh b/RHEL/6/input/fixes/bash/sshd_disable_empty_passwords.sh deleted file mode 100644 index f71fff1..0000000 --- a/RHEL/6/input/fixes/bash/sshd_disable_empty_passwords.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \ - sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/6/input/fixes/bash/sshd_disable_empty_passwords.sh b/RHEL/6/input/fixes/bash/sshd_disable_empty_passwords.sh new file mode 120000 index 0000000..802aa84 --- /dev/null +++ b/RHEL/6/input/fixes/bash/sshd_disable_empty_passwords.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_disable_empty_passwords.sh \ No newline at end of file diff --git a/RHEL/6/input/fixes/bash/sshd_disable_rhosts.sh b/RHEL/6/input/fixes/bash/sshd_disable_rhosts.sh deleted file mode 100644 index 24d22db..0000000 --- a/RHEL/6/input/fixes/bash/sshd_disable_rhosts.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -q ^IgnoreRhosts /etc/ssh/sshd_config && \ - sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/g" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "IgnoreRhosts yes" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/6/input/fixes/bash/sshd_disable_rhosts.sh b/RHEL/6/input/fixes/bash/sshd_disable_rhosts.sh new file mode 120000 index 0000000..8c5c07c --- /dev/null +++ b/RHEL/6/input/fixes/bash/sshd_disable_rhosts.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_disable_rhosts.sh \ No newline at end of file diff --git a/RHEL/6/input/fixes/bash/sshd_disable_root_login.sh b/RHEL/6/input/fixes/bash/sshd_disable_root_login.sh deleted file mode 100644 index ffd8262..0000000 --- a/RHEL/6/input/fixes/bash/sshd_disable_root_login.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -q ^PermitRootLogin /etc/ssh/sshd_config && \ - sed -i "s/PermitRootLogin.*/PermitRootLogin no/g" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "PermitRootLogin "no >> /etc/ssh/sshd_config -fi diff --git a/RHEL/6/input/fixes/bash/sshd_disable_root_login.sh b/RHEL/6/input/fixes/bash/sshd_disable_root_login.sh new file mode 120000 index 0000000..928937f --- /dev/null +++ b/RHEL/6/input/fixes/bash/sshd_disable_root_login.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_disable_root_login.sh \ No newline at end of file diff --git a/RHEL/6/input/fixes/bash/sshd_do_not_permit_user_env.sh b/RHEL/6/input/fixes/bash/sshd_do_not_permit_user_env.sh deleted file mode 100644 index b886e3c..0000000 --- a/RHEL/6/input/fixes/bash/sshd_do_not_permit_user_env.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -q ^PermitUserEnvironment /etc/ssh/sshd_config && \ - sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/g" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "PermitUserEnvironment no" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/6/input/fixes/bash/sshd_do_not_permit_user_env.sh b/RHEL/6/input/fixes/bash/sshd_do_not_permit_user_env.sh new file mode 120000 index 0000000..fef5614 --- /dev/null +++ b/RHEL/6/input/fixes/bash/sshd_do_not_permit_user_env.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_do_not_permit_user_env.sh \ No newline at end of file diff --git a/RHEL/6/input/fixes/bash/sshd_enable_warning_banner.sh b/RHEL/6/input/fixes/bash/sshd_enable_warning_banner.sh deleted file mode 100644 index b1ad28f..0000000 --- a/RHEL/6/input/fixes/bash/sshd_enable_warning_banner.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -q ^Banner /etc/ssh/sshd_config && \ - sed -i "s/Banner.*/Banner \/etc\/issue/g" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "Banner /etc/issue" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/6/input/fixes/bash/sshd_enable_warning_banner.sh b/RHEL/6/input/fixes/bash/sshd_enable_warning_banner.sh new file mode 120000 index 0000000..7fbbfc8 --- /dev/null +++ b/RHEL/6/input/fixes/bash/sshd_enable_warning_banner.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_enable_warning_banner.sh \ No newline at end of file diff --git a/RHEL/6/input/fixes/bash/sshd_set_idle_timeout.sh b/RHEL/6/input/fixes/bash/sshd_set_idle_timeout.sh deleted file mode 100644 index 0a2d226..0000000 --- a/RHEL/6/input/fixes/bash/sshd_set_idle_timeout.sh +++ /dev/null @@ -1,8 +0,0 @@ -source ./templates/support.sh -populate sshd_idle_timeout_value - -grep -q ^ClientAliveInterval /etc/ssh/sshd_config && \ - sed -i "s/ClientAliveInterval.*/ClientAliveInterval $sshd_idle_timeout_value/g" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "ClientAliveInterval $sshd_idle_timeout_value" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/6/input/fixes/bash/sshd_set_idle_timeout.sh b/RHEL/6/input/fixes/bash/sshd_set_idle_timeout.sh new file mode 120000 index 0000000..308dbb3 --- /dev/null +++ b/RHEL/6/input/fixes/bash/sshd_set_idle_timeout.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_set_idle_timeout.sh \ No newline at end of file diff --git a/RHEL/6/input/fixes/bash/sshd_set_keepalive.sh b/RHEL/6/input/fixes/bash/sshd_set_keepalive.sh deleted file mode 100644 index d54ba21..0000000 --- a/RHEL/6/input/fixes/bash/sshd_set_keepalive.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -q ^ClientAliveCountMax /etc/ssh/sshd_config && \ - sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/g" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "ClientAliveCountMax 0" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/6/input/fixes/bash/sshd_set_keepalive.sh b/RHEL/6/input/fixes/bash/sshd_set_keepalive.sh new file mode 120000 index 0000000..d01ccd3 --- /dev/null +++ b/RHEL/6/input/fixes/bash/sshd_set_keepalive.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_set_keepalive.sh \ No newline at end of file diff --git a/RHEL/6/input/fixes/bash/sshd_use_approved_ciphers.sh b/RHEL/6/input/fixes/bash/sshd_use_approved_ciphers.sh deleted file mode 100644 index a00eb95..0000000 --- a/RHEL/6/input/fixes/bash/sshd_use_approved_ciphers.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -q ^Ciphers /etc/ssh/sshd_config && \ - sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/g" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/6/input/fixes/bash/sshd_use_approved_ciphers.sh b/RHEL/6/input/fixes/bash/sshd_use_approved_ciphers.sh new file mode 120000 index 0000000..5dc9592 --- /dev/null +++ b/RHEL/6/input/fixes/bash/sshd_use_approved_ciphers.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_use_approved_ciphers.sh \ No newline at end of file diff --git a/RHEL/7/input/fixes/bash/sshd_disable_empty_passwords.sh b/RHEL/7/input/fixes/bash/sshd_disable_empty_passwords.sh deleted file mode 100644 index c28fc77..0000000 --- a/RHEL/7/input/fixes/bash/sshd_disable_empty_passwords.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -qi ^PermitEmptyPasswords /etc/ssh/sshd_config && \ - sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/gI" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/7/input/fixes/bash/sshd_disable_empty_passwords.sh b/RHEL/7/input/fixes/bash/sshd_disable_empty_passwords.sh new file mode 120000 index 0000000..802aa84 --- /dev/null +++ b/RHEL/7/input/fixes/bash/sshd_disable_empty_passwords.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_disable_empty_passwords.sh \ No newline at end of file diff --git a/RHEL/7/input/fixes/bash/sshd_disable_rhosts.sh b/RHEL/7/input/fixes/bash/sshd_disable_rhosts.sh deleted file mode 100644 index e87e3c1..0000000 --- a/RHEL/7/input/fixes/bash/sshd_disable_rhosts.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -qi ^IgnoreRhosts /etc/ssh/sshd_config && \ - sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/gI" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "IgnoreRhosts yes" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/7/input/fixes/bash/sshd_disable_rhosts.sh b/RHEL/7/input/fixes/bash/sshd_disable_rhosts.sh new file mode 120000 index 0000000..8c5c07c --- /dev/null +++ b/RHEL/7/input/fixes/bash/sshd_disable_rhosts.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_disable_rhosts.sh \ No newline at end of file diff --git a/RHEL/7/input/fixes/bash/sshd_disable_root_login.sh b/RHEL/7/input/fixes/bash/sshd_disable_root_login.sh deleted file mode 100644 index e8b65aa..0000000 --- a/RHEL/7/input/fixes/bash/sshd_disable_root_login.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -qi ^PermitRootLogin /etc/ssh/sshd_config && \ - sed -i "s/PermitRootLogin.*/PermitRootLogin no/gI" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "PermitRootLogin "no >> /etc/ssh/sshd_config -fi diff --git a/RHEL/7/input/fixes/bash/sshd_disable_root_login.sh b/RHEL/7/input/fixes/bash/sshd_disable_root_login.sh new file mode 120000 index 0000000..928937f --- /dev/null +++ b/RHEL/7/input/fixes/bash/sshd_disable_root_login.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_disable_root_login.sh \ No newline at end of file diff --git a/RHEL/7/input/fixes/bash/sshd_do_not_permit_user_env.sh b/RHEL/7/input/fixes/bash/sshd_do_not_permit_user_env.sh deleted file mode 100644 index fb3f545..0000000 --- a/RHEL/7/input/fixes/bash/sshd_do_not_permit_user_env.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -qi ^PermitUserEnvironment /etc/ssh/sshd_config && \ - sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/gI" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "PermitUserEnvironment no" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/7/input/fixes/bash/sshd_do_not_permit_user_env.sh b/RHEL/7/input/fixes/bash/sshd_do_not_permit_user_env.sh new file mode 120000 index 0000000..fef5614 --- /dev/null +++ b/RHEL/7/input/fixes/bash/sshd_do_not_permit_user_env.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_do_not_permit_user_env.sh \ No newline at end of file diff --git a/RHEL/7/input/fixes/bash/sshd_enable_warning_banner.sh b/RHEL/7/input/fixes/bash/sshd_enable_warning_banner.sh deleted file mode 100644 index 24a385b..0000000 --- a/RHEL/7/input/fixes/bash/sshd_enable_warning_banner.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -qi ^Banner /etc/ssh/sshd_config && \ - sed -i "s/Banner.*/Banner \/etc\/issue/gI" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "Banner /etc/issue" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/7/input/fixes/bash/sshd_enable_warning_banner.sh b/RHEL/7/input/fixes/bash/sshd_enable_warning_banner.sh new file mode 120000 index 0000000..7fbbfc8 --- /dev/null +++ b/RHEL/7/input/fixes/bash/sshd_enable_warning_banner.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_enable_warning_banner.sh \ No newline at end of file diff --git a/RHEL/7/input/fixes/bash/sshd_set_idle_timeout.sh b/RHEL/7/input/fixes/bash/sshd_set_idle_timeout.sh deleted file mode 100644 index c491057..0000000 --- a/RHEL/7/input/fixes/bash/sshd_set_idle_timeout.sh +++ /dev/null @@ -1,8 +0,0 @@ -source ./templates/support.sh -populate sshd_idle_timeout_value - -grep -qi ^ClientAliveInterval /etc/ssh/sshd_config && \ - sed -i "s/ClientAliveInterval.*/ClientAliveInterval $sshd_idle_timeout_value/gI" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "ClientAliveInterval $sshd_idle_timeout_value" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/7/input/fixes/bash/sshd_set_idle_timeout.sh b/RHEL/7/input/fixes/bash/sshd_set_idle_timeout.sh new file mode 120000 index 0000000..308dbb3 --- /dev/null +++ b/RHEL/7/input/fixes/bash/sshd_set_idle_timeout.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_set_idle_timeout.sh \ No newline at end of file diff --git a/RHEL/7/input/fixes/bash/sshd_set_keepalive.sh b/RHEL/7/input/fixes/bash/sshd_set_keepalive.sh deleted file mode 100644 index 17b83ec..0000000 --- a/RHEL/7/input/fixes/bash/sshd_set_keepalive.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -qi ^ClientAliveCountMax /etc/ssh/sshd_config && \ - sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/gI" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "ClientAliveCountMax 0" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/7/input/fixes/bash/sshd_set_keepalive.sh b/RHEL/7/input/fixes/bash/sshd_set_keepalive.sh new file mode 120000 index 0000000..d01ccd3 --- /dev/null +++ b/RHEL/7/input/fixes/bash/sshd_set_keepalive.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_set_keepalive.sh \ No newline at end of file diff --git a/RHEL/7/input/fixes/bash/sshd_use_approved_ciphers.sh b/RHEL/7/input/fixes/bash/sshd_use_approved_ciphers.sh deleted file mode 100644 index 264553f..0000000 --- a/RHEL/7/input/fixes/bash/sshd_use_approved_ciphers.sh +++ /dev/null @@ -1,5 +0,0 @@ -grep -qi ^Ciphers /etc/ssh/sshd_config && \ - sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/gI" /etc/ssh/sshd_config -if ! [ $? -eq 0 ]; then - echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc" >> /etc/ssh/sshd_config -fi diff --git a/RHEL/7/input/fixes/bash/sshd_use_approved_ciphers.sh b/RHEL/7/input/fixes/bash/sshd_use_approved_ciphers.sh new file mode 120000 index 0000000..5dc9592 --- /dev/null +++ b/RHEL/7/input/fixes/bash/sshd_use_approved_ciphers.sh @@ -0,0 +1 @@ +../../../../../shared/fixes/bash/sshd_use_approved_ciphers.sh \ No newline at end of file diff --git a/shared/fixes/bash/sshd_disable_empty_passwords.sh b/shared/fixes/bash/sshd_disable_empty_passwords.sh index 0a5adfa..d075ec3 100755 --- a/shared/fixes/bash/sshd_disable_empty_passwords.sh +++ b/shared/fixes/bash/sshd_disable_empty_passwords.sh @@ -1,55 +1,57 @@ SSHD_CONFIG='/etc/ssh/sshd_config' +TOKEN='PermitEmptyPasswords' +VALUE='no' # Obtain line number of first uncommented case-insensitive occurrence of Match # block directive (possibly prefixed with whitespace) present in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n '/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG) # Obtain line number of first uncommented case-insensitive occurence of -# PermitEmptyPasswords directive (possibly prefixed with whitespace) present in +# Banner directive (possibly prefixed with whitespace) present in # $SSHD_CONFIG -FIRST_PERMIT_EMPTY_PASSWORDS=$(sed -n '/^[[:space:]]*PermitEmptyPasswords[^\n]*/I{=;q}' $SSHD_CONFIG) +FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" $SSHD_CONFIG) # Case: Match block directive not present in $SSHD_CONFIG if [ -z "$FIRST_MATCH_BLOCK" ] then - # Case: PermitEmptyPasswords directive not present in $SSHD_CONFIG yet - if [ -z "$FIRST_PERMIT_EMPTY_PASSWORDS" ] + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] then - # Append 'PermitEmptyPasswords no' at the end of $SSHD_CONFIG - echo -e "\nPermitEmptyPasswords no" >> $SSHD_CONFIG + # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG + echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG - # Case: PermitEmptyPasswords directive present in $SSHD_CONFIG already + # Case: Banner directive present in $SSHD_CONFIG already else # Replace first uncommented case-insensitive occurrence - # of PermitEmptyPasswords directive - sed -i "$FIRST_PERMIT_EMPTY_PASSWORDS s/^[[:space:]]*PermitEmptyPasswords.*$/PermitEmptyPasswords no/I" $SSHD_CONFIG + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG fi # Case: Match block directive present in $SSHD_CONFIG else - # Case: PermitEmptyPasswords directive not present in $SSHD_CONFIG yet - if [ -z "$FIRST_PERMIT_EMPTY_PASSWORDS" ] + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] then - # Prepend 'PermitEmptyPasswords no' before first uncommented + # Prepend 'TOKEN VALUE' before first uncommented # case-insensitive occurrence of Match block directive - sed -i "$FIRST_MATCH_BLOCK s/^$[[:space:]]*Match[^\n]*$/PermitEmptyPasswords no\n\1/I" $SSHD_CONFIG + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG - # Case: PermitEmptyPasswords directive present in $SSHD_CONFIG and placed + # Case: Banner directive present in $SSHD_CONFIG and placed # before first Match block directive - elif [ "$FIRST_PERMIT_EMPTY_PASSWORDS" -lt "$FIRST_MATCH_BLOCK" ] + elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ] then # Replace first uncommented case-insensitive occurrence - # of PermitEmptyPasswords directive - sed -i "$FIRST_PERMIT_EMPTY_PASSWORDS s/^[[:space:]]*PermitEmptyPasswords.*$/PermitEmptyPasswords no/I" $SSHD_CONFIG + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG - # Case: PermitEmptyPasswords directive present in $SSHD_CONFIG and placed + # Case: Banner directive present in $SSHD_CONFIG and placed # after first Match block directive else - # Prepend 'PermitEmptyPasswords no' before first uncommented + # Prepend 'TOKEN VALUE' before first uncommented # case-insensitive occurrence of Match block directive - sed -i "$FIRST_MATCH_BLOCK s/^$[[:space:]]*Match[^\n]*$/PermitEmptyPasswords no\n\1/I" $SSHD_CONFIG + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG fi fi diff --git a/shared/fixes/bash/sshd_disable_rhosts.sh b/shared/fixes/bash/sshd_disable_rhosts.sh new file mode 100755 index 0000000..4e78e71 --- /dev/null +++ b/shared/fixes/bash/sshd_disable_rhosts.sh @@ -0,0 +1,57 @@ + +SSHD_CONFIG='/etc/ssh/sshd_config' +TOKEN='IgnoreRhosts' +VALUE='yes' + +# Obtain line number of first uncommented case-insensitive occurrence +of Match # block directive (possibly prefixed with whitespace) present +in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n +'/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG) + +# Obtain line number of first uncommented case-insensitive occurence of +# Banner directive (possibly prefixed with whitespace) present in # +$SSHD_CONFIG FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" +$SSHD_CONFIG) + +# Case: Match block directive not present in $SSHD_CONFIG if [ -z +"$FIRST_MATCH_BLOCK" ] then + + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] + then + # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG + echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG already + else + # Replace first uncommented case-insensitive occurrence + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN $VALUE|I" $SSHD_CONFIG + fi + +# Case: Match block directive present in $SSHD_CONFIG else + + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] + then + # Prepend 'TOKEN VALUE' before first uncommented + # case-insensitive occurrence of Match block directive + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG and placed + # before first Match block directive + elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ] + then + # Replace first uncommented case-insensitive occurrence + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG and placed + # after first Match block directive + else + # Prepend 'TOKEN VALUE' before first uncommented + # case-insensitive occurrence of Match block directive + sed -i "$FIRST_MATCH_BLOCK s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG + fi +fi diff --git a/shared/fixes/bash/sshd_disable_root_login.sh b/shared/fixes/bash/sshd_disable_root_login.sh index 5b05d53..1e1af5f 100755 --- a/shared/fixes/bash/sshd_disable_root_login.sh +++ b/shared/fixes/bash/sshd_disable_root_login.sh @@ -1,55 +1,57 @@ SSHD_CONFIG='/etc/ssh/sshd_config' +TOKEN='PermitRootLogin' +VALUE='no' # Obtain line number of first uncommented case-insensitive occurrence of Match # block directive (possibly prefixed with whitespace) present in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n '/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG) # Obtain line number of first uncommented case-insensitive occurence of -# PermitRootLogin directive (possibly prefixed with whitespace) present in +# Banner directive (possibly prefixed with whitespace) present in # $SSHD_CONFIG -FIRST_PERMIT_ROOT_LOGIN=$(sed -n '/^[[:space:]]*PermitRootLogin[^\n]*/I{=;q}' $SSHD_CONFIG) +FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" $SSHD_CONFIG) # Case: Match block directive not present in $SSHD_CONFIG if [ -z "$FIRST_MATCH_BLOCK" ] then - # Case: PermitRootLogin directive not present in $SSHD_CONFIG yet - if [ -z "$FIRST_PERMIT_ROOT_LOGIN" ] + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] then - # Append 'PermitRootLogin no' at the end of $SSHD_CONFIG - echo -e "\nPermitRootLogin no" >> $SSHD_CONFIG + # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG + echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG - # Case: PermitRootLogin directive present in $SSHD_CONFIG already + # Case: Banner directive present in $SSHD_CONFIG already else # Replace first uncommented case-insensitive occurrence - # of PermitRootLogin directive - sed -i "$FIRST_PERMIT_ROOT_LOGIN s/^[[:space:]]*PermitRootLogin.*$/PermitRootLogin no/I" $SSHD_CONFIG + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG fi # Case: Match block directive present in $SSHD_CONFIG else - # Case: PermitRootLogin directive not present in $SSHD_CONFIG yet - if [ -z "$FIRST_PERMIT_ROOT_LOGIN" ] + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] then - # Prepend 'PermitRootLogin no' before first uncommented + # Prepend 'TOKEN VALUE' before first uncommented # case-insensitive occurrence of Match block directive - sed -i "$FIRST_MATCH_BLOCK s/^$[[:space:]]*Match[^\n]*$/PermitRootLogin no\n\1/I" $SSHD_CONFIG + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG - # Case: PermitRootLogin directive present in $SSHD_CONFIG and placed + # Case: Banner directive present in $SSHD_CONFIG and placed # before first Match block directive - elif [ "$FIRST_PERMIT_ROOT_LOGIN" -lt "$FIRST_MATCH_BLOCK" ] + elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ] then # Replace first uncommented case-insensitive occurrence - # of PermitRootLogin directive - sed -i "$FIRST_PERMIT_ROOT_LOGIN s/^[[:space:]]*PermitRootLogin.*$/PermitRootLogin no/I" $SSHD_CONFIG + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG - # Case: PermitRootLogin directive present in $SSHD_CONFIG and placed + # Case: Banner directive present in $SSHD_CONFIG and placed # after first Match block directive else - # Prepend 'PermitRootLogin no' before first uncommented + # Prepend 'TOKEN VALUE' before first uncommented # case-insensitive occurrence of Match block directive - sed -i "$FIRST_MATCH_BLOCK s/^$[[:space:]]*Match[^\n]*$/PermitRootLogin no\n\1/I" $SSHD_CONFIG + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG fi fi diff --git a/shared/fixes/bash/sshd_do_not_permit_user_env.sh b/shared/fixes/bash/sshd_do_not_permit_user_env.sh new file mode 100755 index 0000000..5b1467b --- /dev/null +++ b/shared/fixes/bash/sshd_do_not_permit_user_env.sh @@ -0,0 +1,57 @@ + +SSHD_CONFIG='/etc/ssh/sshd_config' +TOKEN='PermitUserEnvironment' +VALUE='no' + +# Obtain line number of first uncommented case-insensitive occurrence +of Match # block directive (possibly prefixed with whitespace) present +in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n +'/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG) + +# Obtain line number of first uncommented case-insensitive occurence of +# Banner directive (possibly prefixed with whitespace) present in # +$SSHD_CONFIG FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" +$SSHD_CONFIG) + +# Case: Match block directive not present in $SSHD_CONFIG if [ -z +"$FIRST_MATCH_BLOCK" ] then + + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] + then + # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG + echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG already + else + # Replace first uncommented case-insensitive occurrence + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN $VALUE|I" $SSHD_CONFIG + fi + +# Case: Match block directive present in $SSHD_CONFIG else + + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] + then + # Prepend 'TOKEN VALUE' before first uncommented + # case-insensitive occurrence of Match block directive + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG and placed + # before first Match block directive + elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ] + then + # Replace first uncommented case-insensitive occurrence + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG and placed + # after first Match block directive + else + # Prepend 'TOKEN VALUE' before first uncommented + # case-insensitive occurrence of Match block directive + sed -i "$FIRST_MATCH_BLOCK s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG + fi +fi diff --git a/shared/fixes/bash/sshd_enable_warning_banner.sh b/shared/fixes/bash/sshd_enable_warning_banner.sh new file mode 100755 index 0000000..10da269 --- /dev/null +++ b/shared/fixes/bash/sshd_enable_warning_banner.sh @@ -0,0 +1,57 @@ + +SSHD_CONFIG='/etc/ssh/sshd_config' +TOKEN='Banner' +VALUE='/etc/issue' + +# Obtain line number of first uncommented case-insensitive occurrence +of Match # block directive (possibly prefixed with whitespace) present +in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n +'/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG) + +# Obtain line number of first uncommented case-insensitive occurence of +# Banner directive (possibly prefixed with whitespace) present in # +$SSHD_CONFIG FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" +$SSHD_CONFIG) + +# Case: Match block directive not present in $SSHD_CONFIG if [ -z +"$FIRST_MATCH_BLOCK" ] then + + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] + then + # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG + echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG already + else + # Replace first uncommented case-insensitive occurrence + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN $VALUE|I" $SSHD_CONFIG + fi + +# Case: Match block directive present in $SSHD_CONFIG else + + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] + then + # Prepend 'TOKEN VALUE' before first uncommented + # case-insensitive occurrence of Match block directive + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG and placed + # before first Match block directive + elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ] + then + # Replace first uncommented case-insensitive occurrence + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG and placed + # after first Match block directive + else + # Prepend 'TOKEN VALUE' before first uncommented + # case-insensitive occurrence of Match block directive + sed -i "$FIRST_MATCH_BLOCK s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG + fi +fi diff --git a/shared/fixes/bash/sshd_set_idle_timeout.sh b/shared/fixes/bash/sshd_set_idle_timeout.sh index 306476c..f83a4ad 100755 --- a/shared/fixes/bash/sshd_set_idle_timeout.sh +++ b/shared/fixes/bash/sshd_set_idle_timeout.sh @@ -1,57 +1,60 @@ + source ./templates/support.sh populate sshd_idle_timeout_value SSHD_CONFIG='/etc/ssh/sshd_config' +TOKEN='ClientAliveInterval' +VALUE="$sshd_idle_timeout_value" # Obtain line number of first uncommented case-insensitive occurrence of Match # block directive (possibly prefixed with whitespace) present in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n '/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG) # Obtain line number of first uncommented case-insensitive occurence of -# ClientAliveInterval directive (possibly prefixed with whitespace) present in +# Banner directive (possibly prefixed with whitespace) present in # $SSHD_CONFIG -FIRST_CLIENT_ALIVE_INTERVAL=$(sed -n '/^[[:space:]]*ClientAliveInterval[^\n]*/I{=;q}' $SSHD_CONFIG) +FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" $SSHD_CONFIG) # Case: Match block directive not present in $SSHD_CONFIG if [ -z "$FIRST_MATCH_BLOCK" ] then - # Case: ClientAliveInterval directive not present in $SSHD_CONFIG yet - if [ -z "$FIRST_CLIENT_ALIVE_INTERVAL" ] + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] then - # Append 'ClientAliveInterval $sshd_idle_timeout_value' at the end of $SSHD_CONFIG - echo -e "\nClientAliveInterval $sshd_idle_timeout_value" >> $SSHD_CONFIG + # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG + echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG - # Case: ClientAliveInterval directive present in $SSHD_CONFIG already + # Case: Banner directive present in $SSHD_CONFIG already else # Replace first uncommented case-insensitive occurrence - # of ClientAliveInterval directive - sed -i "$FIRST_CLIENT_ALIVE_INTERVAL s/^[[:space:]]*ClientAliveInterval.*$/ClientAliveInterval $sshd_idle_timeout_value/I" $SSHD_CONFIG + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG fi # Case: Match block directive present in $SSHD_CONFIG else - # Case: ClientAliveInterval directive not present in $SSHD_CONFIG yet - if [ -z "$FIRST_CLIENT_ALIVE_INTERVAL" ] + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] then - # Prepend 'ClientAliveInterval $sshd_idle_timeout_value' before first uncommented + # Prepend 'TOKEN VALUE' before first uncommented # case-insensitive occurrence of Match block directive - sed -i "$FIRST_MATCH_BLOCK s/^$[[:space:]]*Match[^\n]*$/ClientAliveInterval $sshd_idle_timeout_value\n\1/I" $SSHD_CONFIG + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG - # Case: ClientAliveInterval directive present in $SSHD_CONFIG and placed + # Case: Banner directive present in $SSHD_CONFIG and placed # before first Match block directive - elif [ "$FIRST_CLIENT_ALIVE_INTERVAL" -lt "$FIRST_MATCH_BLOCK" ] + elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ] then # Replace first uncommented case-insensitive occurrence - # of ClientAliveInterval directive - sed -i "$FIRST_CLIENT_ALIVE_INTERVAL s/^[[:space:]]*ClientAliveInterval.*$/ClientAliveInterval $sshd_idle_timeout_value/I" $SSHD_CONFIG + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG - # Case: ClientAliveInterval directive present in $SSHD_CONFIG and placed + # Case: Banner directive present in $SSHD_CONFIG and placed # after first Match block directive else - # Prepend 'ClientAliveInterval $sshd_idle_timeout_value' before first uncommented + # Prepend 'TOKEN VALUE' before first uncommented # case-insensitive occurrence of Match block directive - sed -i "$FIRST_MATCH_BLOCK s/^$[[:space:]]*Match[^\n]*$/ClientAliveInterval $sshd_idle_timeout_value\n\1/I" $SSHD_CONFIG + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG fi fi diff --git a/shared/fixes/bash/sshd_set_keepalive.sh b/shared/fixes/bash/sshd_set_keepalive.sh index 35754da..ec359e0 100755 --- a/shared/fixes/bash/sshd_set_keepalive.sh +++ b/shared/fixes/bash/sshd_set_keepalive.sh @@ -1,55 +1,57 @@ SSHD_CONFIG='/etc/ssh/sshd_config' +TOKEN='ClientAliveCountMax' +VALUE='0' # Obtain line number of first uncommented case-insensitive occurrence of Match # block directive (possibly prefixed with whitespace) present in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n '/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG) # Obtain line number of first uncommented case-insensitive occurence of -# ClientAliveCountMax directive (possibly prefixed with whitespace) present in +# Banner directive (possibly prefixed with whitespace) present in # $SSHD_CONFIG -FIRST_CLIENT_ALIVE_COUNT_MAX=$(sed -n '/^[[:space:]]*ClientAliveCountMax[^\n]*/I{=;q}' $SSHD_CONFIG) +FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" $SSHD_CONFIG) # Case: Match block directive not present in $SSHD_CONFIG if [ -z "$FIRST_MATCH_BLOCK" ] then - # Case: ClientAliveCountMax directive not present in $SSHD_CONFIG yet - if [ -z "$FIRST_CLIENT_ALIVE_COUNT_MAX" ] + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] then - # Append 'ClientAliveCountMax 0' at the end of $SSHD_CONFIG - echo -e "\nClientAliveCountMax 0" >> $SSHD_CONFIG + # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG + echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG - # Case: ClientAliveCountMax directive present in $SSHD_CONFIG already + # Case: Banner directive present in $SSHD_CONFIG already else # Replace first uncommented case-insensitive occurrence - # of ClientAliveCountMax directive - sed -i "$FIRST_CLIENT_ALIVE_COUNT_MAX s/^[[:space:]]*ClientAliveCountMax.*$/ClientAliveCountMax 0/I" $SSHD_CONFIG + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG fi # Case: Match block directive present in $SSHD_CONFIG else - # Case: ClientAliveCountMax directive not present in $SSHD_CONFIG yet - if [ -z "$FIRST_CLIENT_ALIVE_COUNT_MAX" ] + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] then - # Prepend 'ClientAliveCountMax 0' before first uncommented + # Prepend 'TOKEN VALUE' before first uncommented # case-insensitive occurrence of Match block directive - sed -i "$FIRST_MATCH_BLOCK s/^$[[:space:]]*Match[^\n]*$/ClientAliveCountMax 0\n\1/I" $SSHD_CONFIG + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG - # Case: ClientAliveCountMax directive present in $SSHD_CONFIG and placed + # Case: Banner directive present in $SSHD_CONFIG and placed # before first Match block directive - elif [ "$FIRST_CLIENT_ALIVE_COUNT_MAX" -lt "$FIRST_MATCH_BLOCK" ] + elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ] then # Replace first uncommented case-insensitive occurrence - # of ClientAliveCountMax directive - sed -i "$FIRST_CLIENT_ALIVE_COUNT_MAX s/^[[:space:]]*ClientAliveCountMax.*$/ClientAliveCountMax 0/I" $SSHD_CONFIG + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG - # Case: ClientAliveCountMax directive present in $SSHD_CONFIG and placed + # Case: Banner directive present in $SSHD_CONFIG and placed # after first Match block directive else - # Prepend 'ClientAliveCountMax 0' before first uncommented + # Prepend 'TOKEN VALUE' before first uncommented # case-insensitive occurrence of Match block directive - sed -i "$FIRST_MATCH_BLOCK s/^$[[:space:]]*Match[^\n]*$/ClientAliveCountMax 0\n\1/I" $SSHD_CONFIG + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG fi fi diff --git a/shared/fixes/bash/sshd_use_approved_ciphers.sh b/shared/fixes/bash/sshd_use_approved_ciphers.sh new file mode 100755 index 0000000..8f37363 --- /dev/null +++ b/shared/fixes/bash/sshd_use_approved_ciphers.sh @@ -0,0 +1,57 @@ + +SSHD_CONFIG='/etc/ssh/sshd_config' +TOKEN='Ciphers' +VALUE='aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc' + +# Obtain line number of first uncommented case-insensitive occurrence +of Match # block directive (possibly prefixed with whitespace) present +in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n +'/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG) + +# Obtain line number of first uncommented case-insensitive occurence of +# Banner directive (possibly prefixed with whitespace) present in # +$SSHD_CONFIG FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" +$SSHD_CONFIG) + +# Case: Match block directive not present in $SSHD_CONFIG if [ -z +"$FIRST_MATCH_BLOCK" ] then + + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] + then + # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG + echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG already + else + # Replace first uncommented case-insensitive occurrence + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN $VALUE|I" $SSHD_CONFIG + fi + +# Case: Match block directive present in $SSHD_CONFIG else + + # Case: Banner directive not present in $SSHD_CONFIG yet + if [ -z "$FIRST_TOKEN" ] + then + # Prepend 'TOKEN VALUE' before first uncommented + # case-insensitive occurrence of Match block directive + sed -i "$FIRST_MATCH_BLOCK + s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG and placed + # before first Match block directive + elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ] + then + # Replace first uncommented case-insensitive occurrence + # of Banner directive + sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN + $VALUE|I" $SSHD_CONFIG + + # Case: Banner directive present in $SSHD_CONFIG and placed + # after first Match block directive + else + # Prepend 'TOKEN VALUE' before first uncommented + # case-insensitive occurrence of Match block directive + sed -i "$FIRST_MATCH_BLOCK s|^$[[:space:]]*Match[^\n]*$|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG + fi +fi -- 1.7.1

2 2

OpenSCAP Error: Conversion of the string "-" to an integer (64 bits) failed: Invalid argument [oval_cmp.c:113]
by Jackson, George C III CTR DISA PEO-MA (US) 29 May '14

29 May '14

Hi all, I've seen reference to this on this and other lists but no acceptable resolution. Per documentation, I downloaded and installed the following: openscap-content-1.0.8-1.el6_5.noarch perl-Pod-Escapes-1.04-136.el6.x86_64 openscap-1.0.8-1.el6_5.x86_64 scap-security-guide-0.1-16.el6.noarch openscap-utils-1.0.8-1.el6_5.x86_64 python-lxml-2.2.3-1.1.el6.x86_64 Using the command in the User Guide, after running: oscap xccdf eval --profile stig-rhel6-server-upstream \ --results /tmp/`hostname`-ssg-results.xml \ --report /tmp/`hostname`-ssg-results.html \ --cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml \ /usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml I get valid output for about 225 CCE checks but then error out with: OpenSCAP Error: Conversion of the string "-" to an integer (64 bits) failed: Invalid argument [oval_cmp.c:113] I can confirm this is coming from the check for disabling coredumps in the limits.conf file by having replacing * - core 0 with * hard core 0 which resulted in: OpenSCAP Error: Conversion of the string "hard" to an integer (64 bits) failed: Invalid argument [oval_cmp.c:113] I went back and downloaded the scap-security-guide 0.5 source and compiled/installed. The doc says rhel6-xccdf-scap-security-guide.xml and rhel6-oval-scap-security-guide.xml would be produced from the make but I didn't find any. I did find the ssg xccdf and cpe files from scap-security-guide/RHEL6/dist/content so used those and got: Profile "stig-rhel6-server-upstream" was not found. Re-running again with server and stig-server profiles instead gave: OpenSCAP Error: Selector ID(ensure_logrotate_activated) does not exist in Benchmark. [xccdf_policy.c:1904] after running a few valid checks. Am I missing a step somewhere? Thanks, George Jackson

5 8

scap-workbench 0.8.8 in EPEL6
by Martin Preisler 29 May '14

29 May '14

Hi, there is a new build waiting to be tested in EPEL6. See https://admin.fedoraproject.org/updates/scap-workbench-0.8.8-1.el6 To test this build: 1) Make sure you have EPEL6 repositories enabled 2) # yum install --enablerepo=updates-testing scap-workbench Karma would be greatly appreciated! -- Martin Preisler

2 1

[PATCH 01/01] - Replaced the sshd_* fix scripts by a 'Match' aware version - Linked all sshd_* to the shared fixes
by Rui Pedro Bernardino 28 May '14

28 May '14

1 0

[PATCH 1/2] [RHEL/6] Add upstream STIG for RHEL 6 Server profile disclaimer into the scap-security-guide manual page and also into dedicated file under the package's /doc directory.
by Jan Lieskovsky 28 May '14

28 May '14

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide May 2014