----- Original Message -----
From: "Shawn Wells" <shawn(a)redhat.com>
To: scap-security-guide(a)lists.fedorahosted.org
Sent: Monday, December 16, 2013 5:41:50 PM
Subject: Re: [PATCH] [RHEL6] Fix SSH remediation scripts to be case-insensitive
On 12/16/13, 11:34 AM, Jan Lieskovsky wrote:
[RHEL6] Fix SSH remediation scripts to be case-insensitive
Current version of various SSH remediation scripts for RHEL-6
is searching (grep) and replacing (sed) particular /etc/ssh/sshd_config
configuration file's option in case-sensitive manner (searching
and replacing only strict matching exact case), therefore
having, e.g:
permitrootlogin yes
in /etc/ssh/sshd_config would end up (in current state) the 'PermitRootLogin
no'
string to be appended at the end of the file, but keep the
root logins allowed (since first option present in /etc/ssh/sshd_config
is honoured by sshd).
The proposal changes searches and replacements for various SSH daemon
remediations to be case-insensitive, fixing this problem.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
0001-RHEL6-Fix-SSH-remediation-scripts-to-be-case-insensi.patch
From 5033307ec5bc0759edcf455509b9208443356386 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <jlieskov(a)redhat.com> Date: Mon, 16 Dec 2013 17:19:01
+0100
Subject: [PATCH] [RHEL6] Fix SSH remediation scripts to be case-insensitive
Signed-off-by: Jan Lieskovsky <jlieskov(a)redhat.com> ---
RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh | 4 ++--
RHEL6/input/fixes/bash/sshd_disable_rhosts.sh | 4 ++--
RHEL6/input/fixes/bash/sshd_disable_root_login.sh | 4 ++--
RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh | 4 ++--
RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh | 4 ++--
RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh | 4 ++--
RHEL6/input/fixes/bash/sshd_set_keepalive.sh | 4 ++--
RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh | 4 ++--
8 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
b/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
index f71fff1..c28fc77 100644
--- a/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
+++ b/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
@@ -1,5 +1,5 @@
-grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \
- sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g"
/etc/ssh/sshd_config
+grep -qi ^PermitEmptyPasswords /etc/ssh/sshd_config && \
+ sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/gI"
/etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config
fi
diff --git a/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
b/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
index 24d22db..e87e3c1 100644
--- a/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
+++ b/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
@@ -1,5 +1,5 @@
-grep -q ^IgnoreRhosts /etc/ssh/sshd_config && \
- sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/g" /etc/ssh/sshd_config
+grep -qi ^IgnoreRhosts /etc/ssh/sshd_config && \
+ sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/gI" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
echo "IgnoreRhosts yes" >> /etc/ssh/sshd_config
fi
diff --git a/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
b/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
index ffd8262..e8b65aa 100644
--- a/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
+++ b/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
@@ -1,5 +1,5 @@
-grep -q ^PermitRootLogin /etc/ssh/sshd_config && \
- sed -i "s/PermitRootLogin.*/PermitRootLogin no/g" /etc/ssh/sshd_config
+grep -qi ^PermitRootLogin /etc/ssh/sshd_config && \
+ sed -i "s/PermitRootLogin.*/PermitRootLogin no/gI" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
echo "PermitRootLogin "no >> /etc/ssh/sshd_config
fi
diff --git a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
index b886e3c..fb3f545 100644
--- a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
+++ b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
@@ -1,5 +1,5 @@
-grep -q ^PermitUserEnvironment /etc/ssh/sshd_config && \
- sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/g"
/etc/ssh/sshd_config
+grep -qi ^PermitUserEnvironment /etc/ssh/sshd_config && \
+ sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/gI"
/etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
echo "PermitUserEnvironment no" >> /etc/ssh/sshd_config
fi
diff --git a/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
b/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
index b1ad28f..24a385b 100644
--- a/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
+++ b/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
@@ -1,5 +1,5 @@
-grep -q ^Banner /etc/ssh/sshd_config && \
- sed -i "s/Banner.*/Banner \/etc\/issue/g" /etc/ssh/sshd_config
+grep -qi ^Banner /etc/ssh/sshd_config && \
+ sed -i "s/Banner.*/Banner \/etc\/issue/gI" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
echo "Banner /etc/issue" >> /etc/ssh/sshd_config
fi
diff --git a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
index 0a2d226..c491057 100644
--- a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
+++ b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
@@ -1,8 +1,8 @@
source ./templates/support.sh
populate sshd_idle_timeout_value
-grep -q ^ClientAliveInterval /etc/ssh/sshd_config && \
- sed -i "s/ClientAliveInterval.*/ClientAliveInterval
$sshd_idle_timeout_value/g" /etc/ssh/sshd_config
+grep -qi ^ClientAliveInterval /etc/ssh/sshd_config && \
+ sed -i "s/ClientAliveInterval.*/ClientAliveInterval
$sshd_idle_timeout_value/gI" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
echo "ClientAliveInterval $sshd_idle_timeout_value" >>
/etc/ssh/sshd_config
fi
diff --git a/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
b/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
index d54ba21..17b83ec 100644
--- a/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
+++ b/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
@@ -1,5 +1,5 @@
-grep -q ^ClientAliveCountMax /etc/ssh/sshd_config && \
- sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/g"
/etc/ssh/sshd_config
+grep -qi ^ClientAliveCountMax /etc/ssh/sshd_config && \
+ sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/gI"
/etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
echo "ClientAliveCountMax 0" >> /etc/ssh/sshd_config
fi
diff --git a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
index a00eb95..264553f 100644
--- a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
+++ b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
@@ -1,5 +1,5 @@
-grep -q ^Ciphers /etc/ssh/sshd_config && \
- sed -i "s/Ciphers.*/Ciphers
aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/g"
/etc/ssh/sshd_config
+grep -qi ^Ciphers /etc/ssh/sshd_config && \
+ sed -i "s/Ciphers.*/Ciphers
aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/gI"
/etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
echo "Ciphers
aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc"
>> /etc/ssh/sshd_config
fi
--
1.8.3.1
Ack (+thank you!)
Noticed another (sub)case when remediation would fail. In cases like:
\t+PermitRootLogin.*
current implementation, when performing the search if directive is already present
in sshd config, doesn't take possibility of prefix / head whitescape (other than
space itself) being present.
Filed upstream ticket for this:
https://fedorahosted.org/scap-security-guide/ticket/430
and will include fix for this in the current process of moving sshd related remediations
to /shared infrastructure [*].
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
[*] That ticket is just for me not to need to keep it in the head (and
possibly not to forget about it during / after Christmas break).
_______________________________________________
scap-security-guide mailing list
scap-security-guide(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide