>From 5b9b39572e07e790f662beaad4e2c489ad357ed8 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 7 Sep 2013 12:31:43 -0400 Subject: [PATCH 10/13] remediation + OVAL for sshd_set_idle_timeout - Updated OVAL ID & filename to match XCCDF - filename --> filepath OVAL - Added remediation Remediation testing: [root@rhel6 checks]# ./testcheck.py sshd_set_idle_timeout.xml external_variable with id : sshd_idle_timeout_value Evaluating with OVAL tempfile : /tmp/sshd_set_idle_timeoutwIGOHz.xml Writing results to : /tmp/sshd_set_idle_timeoutwIGOHz.xml-results Definition oval:scap-security-guide.testing:def:168: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:125: false Evaluation done. [root@rhel6 checks]# cd - /var/www/html/scap-security-guide/RHEL6/input/fixes/bash [root@rhel6 bash]# bash sshd_set_idle_timeout.xml [root@rhel6 bash]# cd - /var/www/html/scap-security-guide/RHEL6/input/checks [root@rhel6 checks]# ./testcheck.py sshd_set_idle_timeout.xml external_variable with id : sshd_idle_timeout_value Evaluating with OVAL tempfile : /tmp/sshd_set_idle_timeoutM7RPBT.xml Writing results to : /tmp/sshd_set_idle_timeoutM7RPBT.xml-results Definition oval:scap-security-guide.testing:def:168: true Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:125: false Evaluation done. --- RHEL6/input/checks/sshd_idle_timeout.xml | 38 ---------------------- RHEL6/input/checks/sshd_set_idle_timeout.xml | 37 +++++++++++++++++++++ RHEL6/input/fixes/bash/sshd_set_idle_timeout.xml | 8 ++++ RHEL6/input/services/ssh.xml | 2 +- 4 files changed, 46 insertions(+), 39 deletions(-) delete mode 100644 RHEL6/input/checks/sshd_idle_timeout.xml create mode 100644 RHEL6/input/checks/sshd_set_idle_timeout.xml create mode 100644 RHEL6/input/fixes/bash/sshd_set_idle_timeout.xml diff --git a/RHEL6/input/checks/sshd_idle_timeout.xml b/RHEL6/input/checks/sshd_idle_timeout.xml deleted file mode 100644 index a75173e..0000000 --- a/RHEL6/input/checks/sshd_idle_timeout.xml +++ /dev/null @@ -1,38 +0,0 @@ - - - - Set OpenSSH Idle Timeout Interval - - Red Hat Enterprise Linux 6 - - The SSH idle timeout interval should be set to an - appropriate value. - - - - - - - - - - - - - /etc/ssh - sshd_config - ^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*$ - 1 - - - - - - diff --git a/RHEL6/input/checks/sshd_set_idle_timeout.xml b/RHEL6/input/checks/sshd_set_idle_timeout.xml new file mode 100644 index 0000000..5c5c0e3 --- /dev/null +++ b/RHEL6/input/checks/sshd_set_idle_timeout.xml @@ -0,0 +1,37 @@ + + + + Set OpenSSH Idle Timeout Interval + + Red Hat Enterprise Linux 6 + + The SSH idle timeout interval should be set to an + appropriate value. + + + + + + + + + + + + + /etc/ssh/sshd_config + ^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*$ + 1 + + + + + + diff --git a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.xml b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.xml new file mode 100644 index 0000000..0a2d226 --- /dev/null +++ b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.xml @@ -0,0 +1,8 @@ +source ./templates/support.sh +populate sshd_idle_timeout_value + +grep -q ^ClientAliveInterval /etc/ssh/sshd_config && \ + sed -i "s/ClientAliveInterval.*/ClientAliveInterval $sshd_idle_timeout_value/g" /etc/ssh/sshd_config +if ! [ $? -eq 0 ]; then + echo "ClientAliveInterval $sshd_idle_timeout_value" >> /etc/ssh/sshd_config +fi diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index 7ca27ae..1545b4f 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -168,7 +168,7 @@ guards against compromises one system leading trivially to compromises on another. - + -- 1.7.1