There are a few things I did here. The first was to rewrite the regex to use (?i) for case insensitive matching. The second was to make the checks and the language in the comments uniform and run everything through tidy. The third was to test all the checks and add the test_attestation reference to each.
- Maura Dailey
Maura Dailey (1): Making SSH checks uniform and hopefully adding case insensitive matches properly
RHEL6/input/checks/sshd_banner_set.xml | 24 +++++++-------- RHEL6/input/checks/sshd_clientalivecountmax.xml | 32 ++++++++----------- .../input/checks/sshd_hostbasedauthentication.xml | 19 ++++++++---- RHEL6/input/checks/sshd_idle_timeout.xml | 30 ++++++++++-------- RHEL6/input/checks/sshd_no_user_envset.xml | 24 ++++++-------- .../input/checks/sshd_permitemptypasswords_no.xml | 24 +++++++-------- RHEL6/input/checks/sshd_permitrootlogin_no.xml | 24 +++++++-------- RHEL6/input/checks/sshd_protocol_2.xml | 17 +++++++--- RHEL6/input/checks/sshd_rsh_emulation_disabled.xml | 24 +++++++-------- RHEL6/input/checks/sshd_use_approved_ciphers.xml | 28 ++++++++++------- 10 files changed, 126 insertions(+), 120 deletions(-)
Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil --- RHEL6/input/checks/sshd_banner_set.xml | 24 +++++++-------- RHEL6/input/checks/sshd_clientalivecountmax.xml | 32 ++++++++----------- .../input/checks/sshd_hostbasedauthentication.xml | 19 ++++++++---- RHEL6/input/checks/sshd_idle_timeout.xml | 30 ++++++++++-------- RHEL6/input/checks/sshd_no_user_envset.xml | 24 ++++++-------- .../input/checks/sshd_permitemptypasswords_no.xml | 24 +++++++-------- RHEL6/input/checks/sshd_permitrootlogin_no.xml | 24 +++++++-------- RHEL6/input/checks/sshd_protocol_2.xml | 17 +++++++--- RHEL6/input/checks/sshd_rsh_emulation_disabled.xml | 24 +++++++-------- RHEL6/input/checks/sshd_use_approved_ciphers.xml | 28 ++++++++++------- 10 files changed, 126 insertions(+), 120 deletions(-)
diff --git a/RHEL6/input/checks/sshd_banner_set.xml b/RHEL6/input/checks/sshd_banner_set.xml index 73ca063..fca2781 100644 --- a/RHEL6/input/checks/sshd_banner_set.xml +++ b/RHEL6/input/checks/sshd_banner_set.xml @@ -1,33 +1,31 @@ <def-group> - <definition class="compliance" - id="sshd_banner_set" version="1"> + <definition class="compliance" id="sshd_banner_set" version="1"> <metadata> <title>Enable a Warning Banner</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>SSH warning banner should be enabled (and - dependencies are met)</description> + <description>SSH warning banner should be enabled (and dependencies are + met)</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> <criteria comment="SSH is not being used or conditions are met" operator="OR"> <extend_definition comment="sshd service is disabled" definition_ref="service_sshd_disabled" /> - <criterion comment="Conditions are satisfied" - test_ref="test_20245" /> + <criterion comment="Check Banner in /etc/ssh/sshd_config" + test_ref="test_sshd_banner_set" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the Banner[\s]+/etc/issue setting in the /etc/ssh/sshd_config file" - id="test_20245" version="1"> - <ind:object object_ref="obj_20245" /> + id="test_sshd_banner_set" version="1"> + <ind:object object_ref="obj_sshd_banner_set" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20245" - version="1"> + <ind:textfilecontent54_object id="obj_sshd_banner_set" version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*Banner[\s]+/etc/issue$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sshd_clientalivecountmax.xml b/RHEL6/input/checks/sshd_clientalivecountmax.xml index 1aedbf5..22ba8e9 100644 --- a/RHEL6/input/checks/sshd_clientalivecountmax.xml +++ b/RHEL6/input/checks/sshd_clientalivecountmax.xml @@ -1,39 +1,35 @@ <def-group> - <definition class="compliance" - id="sshd_clientalivecountmax" version="1"> + <definition class="compliance" id="sshd_clientalivecountmax" version="1"> <metadata> <title>Set ClientAliveCountMax for User Logins</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The SSH ClientAliveCountMax should be set to an - appropriate value (and dependencies are met)</description> + <description>The SSH ClientAliveCountMax should be set to an appropriate + value (and dependencies are met)</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> <criteria comment="SSH is not being used or conditions are met" operator="OR"> <extend_definition comment="sshd service is disabled" definition_ref="service_sshd_disabled" /> - <criterion comment="check ClientAliveCountMax in /etc/ssh/sshd_config" - test_ref="test_20240" /> + <criterion comment="Check ClientAliveCountMax in /etc/ssh/sshd_config" + test_ref="test_sshd_clientalivecountmax" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file" - id="test_20240" version="1"> - <ind:object object_ref="obj_20240" /> - <ind:state state_ref="state_20240" /> + id="test_sshd_clientalivecountmax" version="1"> + <ind:object object_ref="obj_sshd_clientalivecountmax" /> + <ind:state state_ref="state_sshd_clientalivecountmax" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_state id="state_20240" - version="1"> - <ind:subexpression datatype="int" operation="equals"> - 0</ind:subexpression> + <ind:textfilecontent54_state id="state_sshd_clientalivecountmax" version="1"> + <ind:subexpression datatype="int" operation="equals">0</ind:subexpression> </ind:textfilecontent54_state> - <ind:textfilecontent54_object id="obj_20240" - version="1"> + <ind:textfilecontent54_object id="obj_sshd_clientalivecountmax" version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*ClientAliveCountMax[\s]*([\d]+)</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sshd_hostbasedauthentication.xml b/RHEL6/input/checks/sshd_hostbasedauthentication.xml index 1b5901b..f3143e7 100644 --- a/RHEL6/input/checks/sshd_hostbasedauthentication.xml +++ b/RHEL6/input/checks/sshd_hostbasedauthentication.xml @@ -6,18 +6,25 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>SSH host-based authentication should be disabled.</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> - <criteria comment="SSH is not being used or conditions are met" operator="OR"> - <extend_definition comment="sshd service is disabled" definition_ref="service_sshd_disabled" /> - <criterion comment="Conditions are satisfied" test_ref="test_sshd_hostbasedauthentication" /> + <criteria comment="SSH is not being used or conditions are met" + operator="OR"> + <extend_definition comment="sshd service is disabled" + definition_ref="service_sshd_disabled" /> + <criterion comment="Check HostbasedAuthentication in /etc/ssh/sshd_config" + test_ref="test_sshd_hostbasedauthentication" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="sshd HostbasedAuthentication" id="test_sshd_hostbasedauthentication" version="1"> + <ind:textfilecontent54_test check="all" check_existence="none_exist" + comment="sshd HostbasedAuthentication" id="test_sshd_hostbasedauthentication" + version="1"> <ind:object object_ref="object_sshd_hostbasedauthentication" /> </ind:textfilecontent54_test> <ind:textfilecontent54_object id="object_sshd_hostbasedauthentication" version="1"> - ind:filepath/etc/ssh/sshd_config</ind:filepath> - <ind:pattern operation="pattern match">^\s*HostbasedAuthentication\s+yes\s*$</ind:pattern> + ind:path/etc/ssh</ind:path> + ind:filenamesshd_config</ind:filename> + <ind:pattern operation="pattern match">^[\s]*(?i)HostbasedAuthentication[\s]+yes[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sshd_idle_timeout.xml b/RHEL6/input/checks/sshd_idle_timeout.xml index 984c630..a75173e 100644 --- a/RHEL6/input/checks/sshd_idle_timeout.xml +++ b/RHEL6/input/checks/sshd_idle_timeout.xml @@ -7,28 +7,32 @@ </affected> <description>The SSH idle timeout interval should be set to an appropriate value.</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> - <criteria comment="sshd service disabled or timeout set" operator="OR"> - <extend_definition comment="sshd service is disabled" definition_ref="service_sshd_disabled" /> - <criterion comment="check ClientAliveInterval in /etc/ssh/sshd_config" test_ref="test_sshd_idle_timeout" /> + <criteria comment="SSH is not being used or conditions are met" + operator="OR"> + <extend_definition comment="sshd service is disabled" + definition_ref="service_sshd_disabled" /> + <criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config" + test_ref="test_sshd_idle_timeout" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="timeout is configured" id="test_sshd_idle_timeout" version="1"> + <ind:textfilecontent54_test check="all" check_existence="all_exist" + comment="timeout is configured" id="test_sshd_idle_timeout" version="1"> <ind:object object_ref="object_sshd_idle_timeout" /> <ind:state state_ref="state_timeout_value" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="object_sshd_idle_timeout" version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename> - <ind:pattern operation="pattern match">^\s*ClientAliveInterval\s+(\d+)\s*$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> + <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> - - <ind:textfilecontent54_state comment="ClientAliveInterval in seconds" id="state_timeout_value" version="1"> - <ind:subexpression datatype="int" operation="equals" var_check="all" var_ref="sshd_idle_timeout_value" /> + <ind:textfilecontent54_state comment="ClientAliveInterval in seconds" + id="state_timeout_value" version="1"> + <ind:subexpression datatype="int" operation="equals" var_check="all" + var_ref="sshd_idle_timeout_value" /> </ind:textfilecontent54_state> - - <external_variable comment="timeout value" datatype="int" id="sshd_idle_timeout_value" version="1" /> + <external_variable comment="timeout value" datatype="int" + id="sshd_idle_timeout_value" version="1" /> </def-group> diff --git a/RHEL6/input/checks/sshd_no_user_envset.xml b/RHEL6/input/checks/sshd_no_user_envset.xml index 985395e..ce128a9 100644 --- a/RHEL6/input/checks/sshd_no_user_envset.xml +++ b/RHEL6/input/checks/sshd_no_user_envset.xml @@ -1,34 +1,30 @@ <def-group> - <definition class="compliance" - id="sshd_no_user_envset" version="1"> + <definition class="compliance" id="sshd_no_user_envset" version="1"> <metadata> <title>Do Not Allow Users to Set Environment Options</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>PermitUserEnvironment should be - disabled</description> + <description>PermitUserEnvironment should be disabled</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> <criteria comment="SSH is not being used or conditions are met" operator="OR"> <extend_definition comment="sshd service is disabled" definition_ref="service_sshd_disabled" /> - <criterion comment="Check value of PermitUserEnvironment in /etc/ssh/sshd_config" - negate="true" - test_ref="test_202455" /> + <criterion comment="Check PermitUserEnvironment in /etc/ssh/sshd_config" + negate="true" test_ref="test_sshd_no_user_envset" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check value of PermitUserEnvironment in /etc/ssh/sshd_config" - id="test_202455" version="1"> - <ind:object object_ref="obj_202455" /> + id="test_sshd_no_user_envset" version="1"> + <ind:object object_ref="obj_sshd_no_user_envset" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_202455" - version="1"> + <ind:textfilecontent54_object id="obj_sshd_no_user_envset" version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Uu][Ss][Ee][Rr][Ee][Nn][Vv][Ii][Rr][Oo][Nn][Mm][Ee][Nn][Tt][\s]+[Nn][Oo]\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*(?i)PermitUserEnvironment[\s]+no[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sshd_permitemptypasswords_no.xml b/RHEL6/input/checks/sshd_permitemptypasswords_no.xml index 3795e4b..a2abe9b 100644 --- a/RHEL6/input/checks/sshd_permitemptypasswords_no.xml +++ b/RHEL6/input/checks/sshd_permitemptypasswords_no.xml @@ -1,34 +1,32 @@ <def-group> - <definition class="compliance" - id="sshd_permitemptypasswords_no" version="1"> + <definition class="compliance" id="sshd_permitemptypasswords_no" version="1"> <metadata> <title>Disable Empty Passwords</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Remote connections from accounts with empty - passwords should be disabled (and dependencies are - met)</description> + <description>Remote connections from accounts with empty passwords should + be disabled (and dependencies are met)</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> <criteria comment="SSH is not being used or conditions are met" operator="OR"> <extend_definition comment="sshd service is disabled" definition_ref="service_sshd_disabled" /> - <criterion comment="Conditions are satisfied" negate="true" - test_ref="test_20244" /> + <criterion comment="Check PermitEmptyPasswords in /etc/ssh/sshd_config" + negate="true" test_ref="test_sshd_permitemptypasswords_no" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the PermitEmptyPasswords[\s]*(<:nocomment:>*) setting in the /etc/ssh/sshd_config file" - id="test_20244" version="1"> - <ind:object object_ref="obj_20244" /> + id="test_sshd_permitemptypasswords_no" version="1"> + <ind:object object_ref="obj_sshd_permitemptypasswords_no" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20244" + <ind:textfilecontent54_object id="obj_sshd_permitemptypasswords_no" version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Ee][Mm][Pp][Tt][Yy][Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd][Ss][\s]+[Nn][Oo]\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*(?i)PermitEmptyPasswords[\s]+no[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sshd_permitrootlogin_no.xml b/RHEL6/input/checks/sshd_permitrootlogin_no.xml index d3c5f79..37f255f 100644 --- a/RHEL6/input/checks/sshd_permitrootlogin_no.xml +++ b/RHEL6/input/checks/sshd_permitrootlogin_no.xml @@ -1,33 +1,31 @@ <def-group> - <definition class="compliance" - id="sshd_permitrootlogin_no" version="1"> + <definition class="compliance" id="sshd_permitrootlogin_no" version="1"> <metadata> <title>Disable root Login via SSH</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Root login via SSH should be disabled (and - dependencies are met)</description> + <description>Root login via SSH should be disabled (and dependencies are + met)</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> <criteria comment="SSH is not being used or conditions are met" operator="OR"> <extend_definition comment="sshd service is disabled" definition_ref="service_sshd_disabled" /> - <criterion comment="Conditions are satisfied" - test_ref="test_20243" /> + <criterion comment="Check PermitRootLogin in /etc/ssh/sshd_config" + test_ref="test_sshd_permitrootlogin_no" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the PermitRootLogin[\s]*(<:nocomment:>*) setting in the /etc/ssh/sshd_config file" - id="test_20243" version="1"> - <ind:object object_ref="obj_20243" /> + id="test_sshd_permitrootlogin_no" version="1"> + <ind:object object_ref="obj_sshd_permitrootlogin_no" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20243" - version="1"> + <ind:textfilecontent54_object id="obj_sshd_permitrootlogin_no" version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Rr][Oo][Oo][Tt][Ll][Oo][Gg][Ii][Nn][\s]*yes</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*(?i)PermitRootLogin[\s]+yes[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sshd_protocol_2.xml b/RHEL6/input/checks/sshd_protocol_2.xml index 635b936..16785da 100644 --- a/RHEL6/input/checks/sshd_protocol_2.xml +++ b/RHEL6/input/checks/sshd_protocol_2.xml @@ -6,18 +6,25 @@ <platform>Red Hat Enterprise Linux 6</platform> </affected> <description>The OpenSSH daemon should be running protocol 2.</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> <criteria comment="SSH is not being used or conditions are met" operator="OR"> - <extend_definition comment="rpm package openssh-server removed" definition_ref="package_openssh-server_removed" /> - <criterion comment="/etc/ssh/sshd_config configured for protocol 2" test_ref="test_sshd_protocol_2" /> + <extend_definition comment="sshd service is disabled" + definition_ref="service_sshd_disabled" /> + <extend_definition comment="rpm package openssh-server removed" + definition_ref="package_openssh-server_removed" /> + <criterion comment="Check Protocol in /etc/ssh/sshd_config" + test_ref="test_sshd_protocol_2" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="sshd uses protocol 2" id="test_sshd_protocol_2" version="1"> + <ind:textfilecontent54_test check="all" check_existence="all_exist" + comment="sshd uses protocol 2" id="test_sshd_protocol_2" version="1"> <ind:object object_ref="object_sshd_protocol_2" /> </ind:textfilecontent54_test> <ind:textfilecontent54_object id="object_sshd_protocol_2" version="2"> - ind:filepath/etc/ssh/sshd_config</ind:filepath> - <ind:pattern operation="pattern match">^\s*Protocol\s+2\s*$</ind:pattern> + ind:path/etc/ssh</ind:path> + ind:filenamesshd_config</ind:filename> + <ind:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sshd_rsh_emulation_disabled.xml b/RHEL6/input/checks/sshd_rsh_emulation_disabled.xml index 0d85a16..fb15c10 100644 --- a/RHEL6/input/checks/sshd_rsh_emulation_disabled.xml +++ b/RHEL6/input/checks/sshd_rsh_emulation_disabled.xml @@ -1,34 +1,32 @@ <def-group> - <definition class="compliance" - id="sshd_rsh_emulation_disabled" version="1"> + <definition class="compliance" id="sshd_rsh_emulation_disabled" version="1"> <metadata> <title>Disable .rhosts Files</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Emulation of the rsh command through the ssh - server should be disabled (and dependencies are - met)</description> + <description>Emulation of the rsh command through the ssh server should + be disabled (and dependencies are met)</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> <criteria comment="SSH is not being used or conditions are met" operator="OR"> <extend_definition comment="sshd service is disabled" definition_ref="service_sshd_disabled" /> - <criterion comment="Conditions are satisfied" - test_ref="test_20241" /> + <criterion comment="Check IgnoreRhosts in /etc/ssh/sshd_config" + test_ref="test_sshd_rsh_emulation_disabled" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the IgnoreRhosts[\s]*(<:nocomment:>*) setting in the /etc/ssh/sshd_config file" - id="test_20241" version="1"> - <ind:object object_ref="obj_20241" /> + id="test_sshd_rsh_emulation_disabled" version="1"> + <ind:object object_ref="obj_sshd_rsh_emulation_disabled" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20241" + <ind:textfilecontent54_object id="obj_sshd_rsh_emulation_disabled" version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*[Ii][Gg][Nn][Oo][Rr][Ee][Rr][Hh][Oo][Ss][Tt][Ss][\s]*no\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*(?i)IgnoreRhosts[\s]+no[\s]*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sshd_use_approved_ciphers.xml b/RHEL6/input/checks/sshd_use_approved_ciphers.xml index 1807d56..b6fc498 100644 --- a/RHEL6/input/checks/sshd_use_approved_ciphers.xml +++ b/RHEL6/input/checks/sshd_use_approved_ciphers.xml @@ -5,23 +5,27 @@ <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Limit the ciphers to those which are FIPS-approved and - only use ciphers in counter (CTR) mode.</description> + <description>Limit the ciphers to those which are FIPS-approved and only + use ciphers in counter (CTR) mode.</description> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" /> </metadata> - <criteria comment="SSH is not being used or conditions are met" operator="OR"> - <!-- <extend_definition comment="sshd service is disabled" definition_ref="service_sshd_disabled" /> --> - <criterion comment="check ClientAliveInterval in /etc/ssh/sshd_config" test_ref="test_20251" /> + <criteria comment="SSH is not being used or conditions are met" + operator="OR"> + <extend_definition comment="sshd service is disabled" + definition_ref="service_sshd_disabled" /> + <criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config" + test_ref="test_sshd_use_approved_ciphers" /> </criteria> </definition> - - <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Ciphers setting in the /etc/ssh/sshd_config file" id="test_20251" version="1"> - <ind:object object_ref="obj_20251" /> + <ind:textfilecontent54_test check="all" check_existence="all_exist" + comment="tests the value of Ciphers setting in the /etc/ssh/sshd_config file" + id="test_sshd_use_approved_ciphers" version="1"> + <ind:object object_ref="obj_sshd_use_approved_ciphers" /> </ind:textfilecontent54_test> - - <ind:textfilecontent54_object id="obj_20251" version="1"> + <ind:textfilecontent54_object id="obj_sshd_use_approved_ciphers" version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename> - <ind:pattern operation="pattern match">^\s*Ciphers\s*aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc\s*$</ind:pattern> - <ind:instance datatype="int">1</ind:instance> + <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc[\s]*$</ind:pattern> + <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group>
Fantastic, please push.
Thanks!
On 08/13/2013 02:26 PM, Maura Dailey wrote:
There are a few things I did here. The first was to rewrite the regex to use (?i) for case insensitive matching. The second was to make the checks and the language in the comments uniform and run everything through tidy. The third was to test all the checks and add the test_attestation reference to each.
- Maura Dailey
Maura Dailey (1): Making SSH checks uniform and hopefully adding case insensitive matches properly
RHEL6/input/checks/sshd_banner_set.xml | 24 +++++++-------- RHEL6/input/checks/sshd_clientalivecountmax.xml | 32 ++++++++----------- .../input/checks/sshd_hostbasedauthentication.xml | 19 ++++++++---- RHEL6/input/checks/sshd_idle_timeout.xml | 30 ++++++++++-------- RHEL6/input/checks/sshd_no_user_envset.xml | 24 ++++++-------- .../input/checks/sshd_permitemptypasswords_no.xml | 24 +++++++-------- RHEL6/input/checks/sshd_permitrootlogin_no.xml | 24 +++++++-------- RHEL6/input/checks/sshd_protocol_2.xml | 17 +++++++--- RHEL6/input/checks/sshd_rsh_emulation_disabled.xml | 24 +++++++-------- RHEL6/input/checks/sshd_use_approved_ciphers.xml | 28 ++++++++++------- 10 files changed, 126 insertions(+), 120 deletions(-)
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org