>From 9400a12ce6a17273065371450c38b089d4e059e6 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Thu, 23 Jan 2014 01:23:17 -0500 Subject: [PATCH 09/10] Moved sshd_use_approved_ciphers to shared/ - Tested on RHEL7, updated CPE - Symlinks - Added to rhel7 rht-ccp profile --- RHEL/6/input/checks/sshd_use_approved_ciphers.xml | 31 +---------------------- RHEL/7/input/checks/sshd_use_approved_ciphers.xml | 1 + RHEL/7/input/profiles/rht-ccp.xml | 2 -- scap-security-guide.spec | 2 ++ shared/oval/sshd_use_approved_ciphers.xml | 31 +++++++++++++++++++++++ 5 files changed, 35 insertions(+), 32 deletions(-) mode change 100644 => 120000 RHEL/6/input/checks/sshd_use_approved_ciphers.xml create mode 120000 RHEL/7/input/checks/sshd_use_approved_ciphers.xml create mode 100644 shared/oval/sshd_use_approved_ciphers.xml diff --git a/RHEL/6/input/checks/sshd_use_approved_ciphers.xml b/RHEL/6/input/checks/sshd_use_approved_ciphers.xml deleted file mode 100644 index 2ec19d0..0000000 --- a/RHEL/6/input/checks/sshd_use_approved_ciphers.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - Use Only Approved Ciphers - - Red Hat Enterprise Linux 6 - - Limit the ciphers to those which are FIPS-approved and only - use ciphers in counter (CTR) mode. - - - - - - - - - - - - /etc/ssh/sshd_config - ^[\s]*(?i)Ciphers(?-i)[\s]+aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc[\s]*$ - 1 - - diff --git a/RHEL/6/input/checks/sshd_use_approved_ciphers.xml b/RHEL/6/input/checks/sshd_use_approved_ciphers.xml new file mode 120000 index 0000000..03a2d6a --- /dev/null +++ b/RHEL/6/input/checks/sshd_use_approved_ciphers.xml @@ -0,0 +1 @@ +../../../../shared/oval/sshd_use_approved_ciphers.xml \ No newline at end of file diff --git a/RHEL/7/input/checks/sshd_use_approved_ciphers.xml b/RHEL/7/input/checks/sshd_use_approved_ciphers.xml new file mode 120000 index 0000000..03a2d6a --- /dev/null +++ b/RHEL/7/input/checks/sshd_use_approved_ciphers.xml @@ -0,0 +1 @@ +../../../../shared/oval/sshd_use_approved_ciphers.xml \ No newline at end of file diff --git a/RHEL/7/input/profiles/rht-ccp.xml b/RHEL/7/input/profiles/rht-ccp.xml index 7abca8a..a0e3598 100644 --- a/RHEL/7/input/profiles/rht-ccp.xml +++ b/RHEL/7/input/profiles/rht-ccp.xml @@ -133,7 +133,5 @@ SSH / REMOTE ACCESS CHECKS