> 240 /etc/ssh/sshd_config Banner
> The OVAL check was definitely working on my system when I
> last tested it. I'm able to reproduce...
>
> [root@rhel6 checks]# cat /etc/issue
> You are accessing a U.S. Government (USG) Information System
> (IS) that is provided for USG-authorized use only. By using
> this IS (which includes any device attached to this IS), you
> consent to the following conditions:
> -The USG routinely intercepts and monitors communications on
> this IS for purposes including, but not limited to,
> penetration testing, COMSEC monitoring, network operations
> and defense, personnel misconduct (PM), law enforcement (LE),
> and counterintelligence (CI) investigations.
> -At any time, the USG may inspect and seize data stored on
> this IS.
> -Communications using, or data stored on, this IS are not
> private, are subject to routine monitoring, interception, and
> search, and may be disclosed or used for any USG-authorized
> purpose.
> -This IS includes security measures (e.g., authentication and
> access controls) to protect USG interests -- not for your
> personal benefit or privacy.
> -Notwithstanding the above, using this IS does not constitute
> consent to PM, LE or CI investigative searching or monitoring
> of the content of privileged communications, or work product,
> related to personal representation or services by attorneys,
> psychotherapists, or clergy, and their assistants. Such
> communications and work product are private and confidential.
> See User Agreement for details.
>
> [root@rhel6 checks]# ./testcheck.py sshd_banner_set.xml
> Evaluating with OVAL tempfile : /tmp/sshd_banner_setXKCJxI.xml
> Writing results to : /tmp/sshd_banner_setXKCJxI.xml-results
> Definition oval:scap-security-guide.testing:def:193: false
> Definition oval:scap-security-guide.testing:def:191: false
> Definition oval:scap-security-guide.testing:def:190: false
> Evaluation done.
>
> Maura, do you want to take a stab at this (noticed your
> signoff on the OVAL)?
>
> FWIW, if I used the USGCB banner everything worked OK.
>
The ONLY thing the check is doing is checking that the line 'Banner
/etc/issue' exists in /etc/ssh/sshd_config or that sshd is disabled. It
doesn't care about the content of /etc/issue at all. I have no idea why
it's failing for both of you guys. Full check is below my signature for
comparison.
- Maura Dailey
<def-group>
<definition class="compliance" id="sshd_banner_set"
version="1">
<metadata>
<title>Enable a Warning Banner</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
<description>SSH warning banner should be enabled (and
dependencies are
met)</description>
<reference source="MED" ref_id="20130813"
ref_url="test_attestation" />
</metadata>
<criteria comment="SSH is not being used or conditions are met"
operator="OR">
<extend_definition comment="sshd service is disabled"
definition_ref="service_sshd_disabled" />
<criterion comment="Check Banner in /etc/ssh/sshd_config"
test_ref="test_sshd_banner_set" />
</criteria>
</definition>
<ind:textfilecontent54_test check="all"
check_existence="all_exist"
comment="Tests the value of the Banner[\s]+/etc/issue setting in the
/etc/ssh/sshd_config file"
id="test_sshd_banner_set" version="1">
<ind:object object_ref="obj_sshd_banner_set" />
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_sshd_banner_set"
version="1">
<ind:path>/etc/ssh</ind:path>
<ind:filename>sshd_config</ind:filename>
<ind:pattern operation="pattern
match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>