From d24d4501ade05beb43b1c8cee168d4d539b905e8 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov@redhat.com>
Date: Thu, 19 Dec 2013 14:38:46 +0100
Subject: [PATCH] [Shared] Add shared remediation script for sshd disable root
 login rule

Signed-off-by: Jan Lieskovsky <jlieskov@redhat.com>
---
 Fedora/input/fixes/bash/sshd_disable_root_login.sh |  1 +
 Fedora/scap-security-guide.spec                    |  7 ++-
 shared/fixes/bash/sshd_disable_root_login.sh       | 55 ++++++++++++++++++++++
 3 files changed, 61 insertions(+), 2 deletions(-)
 create mode 120000 Fedora/input/fixes/bash/sshd_disable_root_login.sh
 create mode 100755 shared/fixes/bash/sshd_disable_root_login.sh

diff --git a/Fedora/input/fixes/bash/sshd_disable_root_login.sh b/Fedora/input/fixes/bash/sshd_disable_root_login.sh
new file mode 120000
index 0000000..fcd7168
--- /dev/null
+++ b/Fedora/input/fixes/bash/sshd_disable_root_login.sh
@@ -0,0 +1 @@
+../../../../shared/fixes/bash/sshd_disable_root_login.sh
\ No newline at end of file
diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
index e29fa1c..15deb4a 100644
--- a/Fedora/scap-security-guide.spec
+++ b/Fedora/scap-security-guide.spec
@@ -5,7 +5,7 @@
 # file one level up - in the main scap-security-guide directory (instead of
 # this one).
 
-%global	fedorassgversion	4.rc14
+%global	fedorassgversion	4.rc15
 
 Name:		scap-security-guide
 Version:	0.1.%{fedorassgversion}
@@ -54,7 +54,10 @@ cp -a Fedora/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man
 %doc Fedora/LICENSE Fedora/output/ssg-fedora-guide.html
 
 %changelog
-* Mon Dec 16 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.4-rc14-1
+* Thu Dec 19 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.4.rc15-1
+- Shared remediation for sshd disable root login
+
+* Mon Dec 16 2013 Jan iankko Lieskovsky <jlieskov@redhat.com> 0.1.4.rc14-1
 - OVAL check for sshd disable root login
 - Fix typo in OVAL check for sshd disable empty passwords
 
diff --git a/shared/fixes/bash/sshd_disable_root_login.sh b/shared/fixes/bash/sshd_disable_root_login.sh
new file mode 100755
index 0000000..5b05d53
--- /dev/null
+++ b/shared/fixes/bash/sshd_disable_root_login.sh
@@ -0,0 +1,55 @@
+
+SSHD_CONFIG='/etc/ssh/sshd_config'
+
+# Obtain line number of first uncommented case-insensitive occurrence of Match
+# block directive (possibly prefixed with whitespace) present in $SSHD_CONFIG
+FIRST_MATCH_BLOCK=$(sed -n '/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG)
+
+# Obtain line number of first uncommented case-insensitive occurence of
+# PermitRootLogin directive (possibly prefixed with whitespace) present in
+# $SSHD_CONFIG
+FIRST_PERMIT_ROOT_LOGIN=$(sed -n '/^[[:space:]]*PermitRootLogin[^\n]*/I{=;q}' $SSHD_CONFIG)
+
+# Case: Match block directive not present in $SSHD_CONFIG
+if [ -z "$FIRST_MATCH_BLOCK" ]
+then
+
+    # Case: PermitRootLogin directive not present in $SSHD_CONFIG yet
+    if [ -z "$FIRST_PERMIT_ROOT_LOGIN" ]
+    then
+        # Append 'PermitRootLogin no' at the end of $SSHD_CONFIG
+        echo -e "\nPermitRootLogin no" >> $SSHD_CONFIG
+
+    # Case: PermitRootLogin directive present in $SSHD_CONFIG already
+    else
+        # Replace first uncommented case-insensitive occurrence
+        # of PermitRootLogin directive
+        sed -i "$FIRST_PERMIT_ROOT_LOGIN s/^[[:space:]]*PermitRootLogin.*$/PermitRootLogin no/I" $SSHD_CONFIG
+    fi
+
+# Case: Match block directive present in $SSHD_CONFIG
+else
+
+    # Case: PermitRootLogin directive not present in $SSHD_CONFIG yet
+    if [ -z "$FIRST_PERMIT_ROOT_LOGIN" ]
+    then
+        # Prepend 'PermitRootLogin no' before first uncommented
+        # case-insensitive occurrence of Match block directive
+        sed -i "$FIRST_MATCH_BLOCK s/^\([[:space:]]*Match[^\n]*\)/PermitRootLogin no\n\1/I" $SSHD_CONFIG
+
+    # Case: PermitRootLogin directive present in $SSHD_CONFIG and placed
+    #       before first Match block directive
+    elif [ "$FIRST_PERMIT_ROOT_LOGIN" -lt "$FIRST_MATCH_BLOCK" ]
+    then
+        # Replace first uncommented case-insensitive occurrence
+        # of PermitRootLogin directive
+        sed -i "$FIRST_PERMIT_ROOT_LOGIN s/^[[:space:]]*PermitRootLogin.*$/PermitRootLogin no/I" $SSHD_CONFIG
+
+    # Case: PermitRootLogin directive present in $SSHD_CONFIG and placed
+    # after first Match block directive
+    else
+         # Prepend 'PermitRootLogin no' before first uncommented
+         # case-insensitive occurrence of Match block directive
+         sed -i "$FIRST_MATCH_BLOCK s/^\([[:space:]]*Match[^\n]*\)/PermitRootLogin no\n\1/I" $SSHD_CONFIG
+    fi
+fi
-- 
1.8.3.1

