>From d7e7971bf4b7e8aae8f5f969361e7fcbadab735c Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 7 Sep 2013 12:19:33 -0400 Subject: [PATCH 09/13] OVAL + remediation: sshd_do_not_permit_user_env - Updated OVAL ID and filename to match XCCDF - filename -> filepath OVAL - Added remediation Remediation testing: [root@rhel6 checks]# vim /etc/ssh/sshd_config [root@rhel6 checks]# grep PermitUserEnvir /etc/ssh/sshd_config ; ./testcheck.py sshd_do_not_permit_user_env.xml PermitUserEnvironment yes Evaluating with OVAL tempfile : /tmp/sshd_do_not_permit_user_envSWoGgf.xml Writing results to : /tmp/sshd_do_not_permit_user_envSWoGgf.xml-results Definition oval:scap-security-guide.testing:def:165: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:125: false Evaluation done. [root@rhel6 checks]# bash ../fixes/bash/sshd_do_not_permit_user_env.sh [root@rhel6 checks]# grep PermitUserEnvir /etc/ssh/sshd_config ; ./testcheck.py sshd_do_not_permit_user_env.xml PermitUserEnvironment no Evaluating with OVAL tempfile : /tmp/sshd_do_not_permit_user_envo8hpvV.xml Writing results to : /tmp/sshd_do_not_permit_user_envo8hpvV.xml-results Definition oval:scap-security-guide.testing:def:165: true Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:125: false Evaluation done. --- RHEL6/input/checks/sshd_do_not_permit_user_env.xml | 29 +++++++++++++++++++ RHEL6/input/checks/sshd_no_user_envset.xml | 30 -------------------- .../fixes/bash/sshd_do_not_permit_user_env.sh | 5 +++ RHEL6/input/services/ssh.xml | 2 +- 4 files changed, 35 insertions(+), 31 deletions(-) create mode 100644 RHEL6/input/checks/sshd_do_not_permit_user_env.xml delete mode 100644 RHEL6/input/checks/sshd_no_user_envset.xml create mode 100644 RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh diff --git a/RHEL6/input/checks/sshd_do_not_permit_user_env.xml b/RHEL6/input/checks/sshd_do_not_permit_user_env.xml new file mode 100644 index 0000000..592c00a --- /dev/null +++ b/RHEL6/input/checks/sshd_do_not_permit_user_env.xml @@ -0,0 +1,29 @@ + + + + Do Not Allow Users to Set Environment Options + + Red Hat Enterprise Linux 6 + + PermitUserEnvironment should be disabled + + + + + + + + + + + + /etc/ssh/sshd_config + ^[\s]*(?i)PermitUserEnvironment[\s]+no[\s]*$ + 1 + + diff --git a/RHEL6/input/checks/sshd_no_user_envset.xml b/RHEL6/input/checks/sshd_no_user_envset.xml deleted file mode 100644 index ce128a9..0000000 --- a/RHEL6/input/checks/sshd_no_user_envset.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - Do Not Allow Users to Set Environment Options - - Red Hat Enterprise Linux 6 - - PermitUserEnvironment should be disabled - - - - - - - - - - - - /etc/ssh - sshd_config - ^[\s]*(?i)PermitUserEnvironment[\s]+no[\s]*$ - 1 - - diff --git a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh new file mode 100644 index 0000000..b886e3c --- /dev/null +++ b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh @@ -0,0 +1,5 @@ +grep -q ^PermitUserEnvironment /etc/ssh/sshd_config && \ + sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/g" /etc/ssh/sshd_config +if ! [ $? -eq 0 ]; then + echo "PermitUserEnvironment no" >> /etc/ssh/sshd_config +fi diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml index cb6459b..7ca27ae 100644 --- a/RHEL6/input/services/ssh.xml +++ b/RHEL6/input/services/ssh.xml @@ -335,7 +335,7 @@ SSH environment options potentially allow users to bypass access restriction in some configurations. - + -- 1.7.1