Hi all,
The remediation won't work if it appends the new option to the end of file AND there are 'Match' rules (from sshd_config's: "If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.").
Although commented, 'Match' rules are in the default sshd_config.
For example, for "sshd_enable_warning_banner.sh", my suggestion would be: ================================== grep -q ^Banner /etc/ssh/sshd_config && \ sed -i "s/Banner.*/Banner /etc/issue/g" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then ed -s /etc/ssh/sshd_config <<'EOF' /Match/ ?^[A-Z]? + i Banner /etc/issue . w q EOF fi ================================== This will add a new line, after the last keyword before the first 'Match' block (including comments). I'm ashamed to say I couldn't do it with 'sed' :(
Does it sound reasonable?
Thanks
-- Rui Pedro Bernardino CTE2/Tecnologias e Desenvolvimento PT Inovação
On 10/3/13 10:08 AM, Rui Pedro Bernardino wrote:
Hi all,
The remediation won't work if it appends the new option to the end of file AND there are 'Match' rules (from sshd_config's: "If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.").
Although commented, 'Match' rules are in the default sshd_config.
For example, for "sshd_enable_warning_banner.sh", my suggestion would be:
grep -q ^Banner /etc/ssh/sshd_config && \ sed -i "s/Banner.*/Banner /etc/issue/g" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then ed -s /etc/ssh/sshd_config <<'EOF' /Match/ ?^[A-Z]?
i Banner /etc/issue . w q EOF fi ================================== This will add a new line, after the last keyword before the first 'Match' block (including comments). I'm ashamed to say I couldn't do it with 'sed':(
Does it sound reasonable?
This situation *should* be taken care of. Are you experiencing something different than the situation below?
1) Testing file with no Banner value set:
[shawn@SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config #Banner none
[shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_bannerzkgnCU.xml Writing results to : /tmp/sshd_enable_warning_bannerzkgnCU.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: false Evaluation done.
[shawn@SSG-RHEL6 checks]$ sudo bash ../fixes/bash/sshd_enable_warning_banner.sh [shawn@SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config #Banner none Banner /etc/issue
[shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_banner43kR1V.xml Writing results to : /tmp/sshd_enable_warning_banner43kR1V.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: true Evaluation done.
2) Testing if incorrect Banner value set
[shawn@SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config #Banner none Banner /totally/wrong/path
[shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_banneryFifQw.xml Writing results to : /tmp/sshd_enable_warning_banneryFifQw.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: false Evaluation done.
[shawn@SSG-RHEL6 checks]$ sudo bash ../fixes/bash/sshd_enable_warning_banner.sh [shawn@SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config #Banner /etc/issue Banner /etc/issue
[shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_bannervMyGwb.xml Writing results to : /tmp/sshd_enable_warning_bannervMyGwb.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: true Evaluation done.
Hi,
I have exactly the same results but that’s not the point. This is what I get on a system without a ‘Banner’ but with a 'Match' group: [root@seis64 ~]# ssh localhost root@localhost's password: [root@seis64 ~]# sshd_enable_warning_banner.sh [root@seis64 ~]# /etc/init.d/sshd restart Stopping sshd: [ OK ] Starting sshd: [ OK ] [root@seis64 ~]# ssh localhost root@localhost's password:
Still no banner.
This is because the ‘Banner’ was appended to the end of sshd_config and got ‘absorved’ by the Match rules (that use anything following 'Match' until EOF or another 'Match'): [root@seis64 ~]# tail -5 /etc/ssh/sshd_config # Rules for sftponly group Match group sftponly X11Forwarding no AllowTcpForwarding no Banner /etc/issue
This applies to all SSG's sshd_config fixes. Note not all configuration primitives are acceptable on the “Match” blocks, meaning starting sshd will fail.
Bottom line, new primitives must be inserted *before* Match blocks.
Regards
-- Rui Pedro Bernardino CTE2/Tecnologias e Desenvolvimento PT Inovação
From: scap-security-guide-bounces@lists.fedorahosted.org [mailto:scap-security-guide-bounces@lists.fedorahosted.org] On Behalf Of Shawn Wells Sent: sexta-feira, 4 de Outubro de 2013 04:17 To: scap-security-guide@lists.fedorahosted.org Subject: Re: Remediations involving sshd_config
On 10/3/13 10:08 AM, Rui Pedro Bernardino wrote: Hi all,
The remediation won't work if it appends the new option to the end of file AND there are 'Match' rules (from sshd_config's: "If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file.").
Although commented, 'Match' rules are in the default sshd_config.
For example, for "sshd_enable_warning_banner.sh", my suggestion would be: ================================== grep -q ^Banner /etc/ssh/sshd_config && \ sed -i "s/Banner.*/Banner /etc/issue/g" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then ed -s /etc/ssh/sshd_config <<'EOF' /Match/ ?^[A-Z]? + i Banner /etc/issue . w q EOF fi ================================== This will add a new line, after the last keyword before the first 'Match' block (including comments). I'm ashamed to say I couldn't do it with 'sed' :(
Does it sound reasonable?
This situation *should* be taken care of. Are you experiencing something different than the situation below?
1) Testing file with no Banner value set:
[shawn@SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config #Banner none
[shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_bannerzkgnCU.xml Writing results to : /tmp/sshd_enable_warning_bannerzkgnCU.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: false Evaluation done.
[shawn@SSG-RHEL6 checks]$ sudo bash ../fixes/bash/sshd_enable_warning_banner.sh [shawn@SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config #Banner none Banner /etc/issue
[shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_banner43kR1V.xml Writing results to : /tmp/sshd_enable_warning_banner43kR1V.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: true Evaluation done.
2) Testing if incorrect Banner value set
[shawn@SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config #Banner none Banner /totally/wrong/path
[shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_banneryFifQw.xml Writing results to : /tmp/sshd_enable_warning_banneryFifQw.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: false Evaluation done.
[shawn@SSG-RHEL6 checks]$ sudo bash ../fixes/bash/sshd_enable_warning_banner.sh [shawn@SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config #Banner /etc/issue Banner /etc/issue
[shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_bannervMyGwb.xml Writing results to : /tmp/sshd_enable_warning_bannervMyGwb.xml-results Definition oval:scap-security-guide.testing:def:129: false Definition oval:scap-security-guide.testing:def:127: false Definition oval:scap-security-guide.testing:def:126: true Evaluation done.
On 10/4/13 3:52 AM, Rui Pedro Bernardino wrote:
Hi,
I have exactly the same results but that’s not the point. This is what I get on a system without a ‘Banner’ but with a 'Match' group: [root@seis64 ~]# ssh localhost root@localhost's password: [root@seis64 ~]# sshd_enable_warning_banner.sh [root@seis64 ~]# /etc/init.d/sshd restart Stopping sshd: [ OK ] Starting sshd: [ OK ] [root@seis64 ~]# ssh localhost root@localhost's password:
Still no banner.
This is because the ‘Banner’ was appended to the end of sshd_config and got ‘absorved’ by the Match rules (that use anything following 'Match' until EOF or another 'Match'): [root@seis64 ~]# tail -5 /etc/ssh/sshd_config # Rules for sftponly group Match group sftponly X11Forwarding no AllowTcpForwarding no Banner /etc/issue
This applies to all SSG's sshd_config fixes. Note not all configuration primitives are acceptable on the “Match” blocks, meaning starting sshd will fail.
Bottom line, new primitives must be inserted*before* Match blocks.
Ah, yes, I see what you're talking about now. How's this?
# Attempt to adjust value, should string be present grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \ sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then # string not present, check for Match stanza grep -q ^Match /etc/ssh/sshd_config && \ sed '0,/.*Match.*/s/.*Match*./PermitEmptyPasswords no\n&/' /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then # Match stanza not present, add to bottom of /etc/ssh/sshd_config echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config fi fi
.... there has to be some easier / less fugly way through sed or awk... anyone?
# Attempt to adjust value, should string be present grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \ sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then # string not present, check for Match stanza grep -q ^Match /etc/ssh/sshd_config && \ sed '0,/.*Match.*/s/.*Match*./PermitEmptyPasswords no\n&/' /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then # Match stanza not present, add to bottom of /etc/ssh/sshd_config echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config fi fi
- sed '0,/.*Match.*/s/.*Match*./PermitEmptyPasswords no\n&/' /etc/ssh/sshd_config + sed -i '0,/.*Match.*/s/.*Match*./PermitEmptyPasswords no\n&/' /etc/ssh/sshd_config
Sorry I don't have a great cleanup of that, but gotta add the '-i' :)
scap-security-guide@lists.fedorahosted.org