[RHEL6] Fix SSH remediation scripts to be case-insensitive
Current version of various SSH remediation scripts for RHEL-6 is searching (grep) and replacing (sed) particular /etc/ssh/sshd_config configuration file's option in case-sensitive manner (searching and replacing only strict matching exact case), therefore
having, e.g:
permitrootlogin yes
in /etc/ssh/sshd_config would end up (in current state) the 'PermitRootLogin no' string to be appended at the end of the file, but keep the root logins allowed (since first option present in /etc/ssh/sshd_config is honoured by sshd).
The proposal changes searches and replacements for various SSH daemon remediations to be case-insensitive, fixing this problem.
Please review.
Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
On 12/16/13, 11:34 AM, Jan Lieskovsky wrote:
[RHEL6] Fix SSH remediation scripts to be case-insensitive
Current version of various SSH remediation scripts for RHEL-6 is searching (grep) and replacing (sed) particular /etc/ssh/sshd_config configuration file's option in case-sensitive manner (searching and replacing only strict matching exact case), therefore
having, e.g:
permitrootlogin yes
in /etc/ssh/sshd_config would end up (in current state) the 'PermitRootLogin no' string to be appended at the end of the file, but keep the root logins allowed (since first option present in /etc/ssh/sshd_config is honoured by sshd).
The proposal changes searches and replacements for various SSH daemon remediations to be case-insensitive, fixing this problem.
Please review.
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
0001-RHEL6-Fix-SSH-remediation-scripts-to-be-case-insensi.patch
From 5033307ec5bc0759edcf455509b9208443356386 Mon Sep 17 00:00:00 2001 From: Jan Lieskovskyjlieskov@redhat.com Date: Mon, 16 Dec 2013 17:19:01 +0100 Subject: [PATCH] [RHEL6] Fix SSH remediation scripts to be case-insensitive
Signed-off-by: Jan Lieskovskyjlieskov@redhat.com
RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_disable_rhosts.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_disable_root_login.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_set_keepalive.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh | 4 ++-- 8 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh b/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh index f71fff1..c28fc77 100644 --- a/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh +++ b/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh @@ -1,5 +1,5 @@ -grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \
- sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g" /etc/ssh/sshd_config
+grep -qi ^PermitEmptyPasswords /etc/ssh/sshd_config && \
- sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/gI" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config fi
diff --git a/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh b/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh index 24d22db..e87e3c1 100644 --- a/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh +++ b/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh @@ -1,5 +1,5 @@ -grep -q ^IgnoreRhosts /etc/ssh/sshd_config && \
- sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/g" /etc/ssh/sshd_config
+grep -qi ^IgnoreRhosts /etc/ssh/sshd_config && \
- sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/gI" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "IgnoreRhosts yes" >> /etc/ssh/sshd_config fi
diff --git a/RHEL6/input/fixes/bash/sshd_disable_root_login.sh b/RHEL6/input/fixes/bash/sshd_disable_root_login.sh index ffd8262..e8b65aa 100644 --- a/RHEL6/input/fixes/bash/sshd_disable_root_login.sh +++ b/RHEL6/input/fixes/bash/sshd_disable_root_login.sh @@ -1,5 +1,5 @@ -grep -q ^PermitRootLogin /etc/ssh/sshd_config && \
- sed -i "s/PermitRootLogin.*/PermitRootLogin no/g" /etc/ssh/sshd_config
+grep -qi ^PermitRootLogin /etc/ssh/sshd_config && \
- sed -i "s/PermitRootLogin.*/PermitRootLogin no/gI" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "PermitRootLogin "no >> /etc/ssh/sshd_config fi
diff --git a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh index b886e3c..fb3f545 100644 --- a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh +++ b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh @@ -1,5 +1,5 @@ -grep -q ^PermitUserEnvironment /etc/ssh/sshd_config && \
- sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/g" /etc/ssh/sshd_config
+grep -qi ^PermitUserEnvironment /etc/ssh/sshd_config && \
- sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/gI" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "PermitUserEnvironment no" >> /etc/ssh/sshd_config fi
diff --git a/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh b/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh index b1ad28f..24a385b 100644 --- a/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh +++ b/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh @@ -1,5 +1,5 @@ -grep -q ^Banner /etc/ssh/sshd_config && \
- sed -i "s/Banner.*/Banner /etc/issue/g" /etc/ssh/sshd_config
+grep -qi ^Banner /etc/ssh/sshd_config && \
- sed -i "s/Banner.*/Banner /etc/issue/gI" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "Banner /etc/issue" >> /etc/ssh/sshd_config fi
diff --git a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh index 0a2d226..c491057 100644 --- a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh +++ b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh @@ -1,8 +1,8 @@ source ./templates/support.sh populate sshd_idle_timeout_value
-grep -q ^ClientAliveInterval /etc/ssh/sshd_config && \
- sed -i "s/ClientAliveInterval.*/ClientAliveInterval $sshd_idle_timeout_value/g" /etc/ssh/sshd_config
+grep -qi ^ClientAliveInterval /etc/ssh/sshd_config && \
- sed -i "s/ClientAliveInterval.*/ClientAliveInterval $sshd_idle_timeout_value/gI" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "ClientAliveInterval $sshd_idle_timeout_value" >> /etc/ssh/sshd_config fi
diff --git a/RHEL6/input/fixes/bash/sshd_set_keepalive.sh b/RHEL6/input/fixes/bash/sshd_set_keepalive.sh index d54ba21..17b83ec 100644 --- a/RHEL6/input/fixes/bash/sshd_set_keepalive.sh +++ b/RHEL6/input/fixes/bash/sshd_set_keepalive.sh @@ -1,5 +1,5 @@ -grep -q ^ClientAliveCountMax /etc/ssh/sshd_config && \
- sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/g" /etc/ssh/sshd_config
+grep -qi ^ClientAliveCountMax /etc/ssh/sshd_config && \
- sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/gI" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "ClientAliveCountMax 0" >> /etc/ssh/sshd_config fi
diff --git a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh index a00eb95..264553f 100644 --- a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh +++ b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh @@ -1,5 +1,5 @@ -grep -q ^Ciphers /etc/ssh/sshd_config && \
- sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/g" /etc/ssh/sshd_config
+grep -qi ^Ciphers /etc/ssh/sshd_config && \
- sed -i "s/Ciphers.*/Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/gI" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc" >> /etc/ssh/sshd_config fi
-- 1.8.3.1
Ack (+thank you!)
----- Original Message -----
From: "Shawn Wells" shawn@redhat.com To: scap-security-guide@lists.fedorahosted.org Sent: Monday, December 16, 2013 5:41:50 PM Subject: Re: [PATCH] [RHEL6] Fix SSH remediation scripts to be case-insensitive
On 12/16/13, 11:34 AM, Jan Lieskovsky wrote:
[RHEL6] Fix SSH remediation scripts to be case-insensitive
Current version of various SSH remediation scripts for RHEL-6 is searching (grep) and replacing (sed) particular /etc/ssh/sshd_config configuration file's option in case-sensitive manner (searching and replacing only strict matching exact case), therefore
having, e.g:
permitrootlogin yes
in /etc/ssh/sshd_config would end up (in current state) the 'PermitRootLogin no' string to be appended at the end of the file, but keep the root logins allowed (since first option present in /etc/ssh/sshd_config is honoured by sshd).
The proposal changes searches and replacements for various SSH daemon remediations to be case-insensitive, fixing this problem.
Please review.
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Technologies Team
0001-RHEL6-Fix-SSH-remediation-scripts-to-be-case-insensi.patch From 5033307ec5bc0759edcf455509b9208443356386 Mon Sep 17 00:00:00 2001 From: Jan Lieskovsky jlieskov@redhat.com Date: Mon, 16 Dec 2013 17:19:01 +0100 Subject: [PATCH] [RHEL6] Fix SSH remediation scripts to be case-insensitive
Signed-off-by: Jan Lieskovsky jlieskov@redhat.com --- RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_disable_rhosts.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_disable_root_login.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_set_keepalive.sh | 4 ++-- RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh | 4 ++-- 8 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh b/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh index f71fff1..c28fc77 100644 --- a/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh +++ b/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh @@ -1,5 +1,5 @@ -grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \
- sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g"
/etc/ssh/sshd_config +grep -qi ^PermitEmptyPasswords /etc/ssh/sshd_config && \
- sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/gI"
/etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config fi diff --git a/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh b/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh index 24d22db..e87e3c1 100644 --- a/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh +++ b/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh @@ -1,5 +1,5 @@ -grep -q ^IgnoreRhosts /etc/ssh/sshd_config && \
- sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/g" /etc/ssh/sshd_config
+grep -qi ^IgnoreRhosts /etc/ssh/sshd_config && \
- sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/gI" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then echo "IgnoreRhosts yes" >> /etc/ssh/sshd_config fi diff --git a/RHEL6/input/fixes/bash/sshd_disable_root_login.sh b/RHEL6/input/fixes/bash/sshd_disable_root_login.sh index ffd8262..e8b65aa 100644 --- a/RHEL6/input/fixes/bash/sshd_disable_root_login.sh +++ b/RHEL6/input/fixes/bash/sshd_disable_root_login.sh @@ -1,5 +1,5 @@ -grep -q ^PermitRootLogin /etc/ssh/sshd_config && \
- sed -i "s/PermitRootLogin.*/PermitRootLogin no/g" /etc/ssh/sshd_config
+grep -qi ^PermitRootLogin /etc/ssh/sshd_config && \
- sed -i "s/PermitRootLogin.*/PermitRootLogin no/gI" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then echo "PermitRootLogin "no >> /etc/ssh/sshd_config fi diff --git a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh index b886e3c..fb3f545 100644 --- a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh +++ b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh @@ -1,5 +1,5 @@ -grep -q ^PermitUserEnvironment /etc/ssh/sshd_config && \
- sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/g"
/etc/ssh/sshd_config +grep -qi ^PermitUserEnvironment /etc/ssh/sshd_config && \
- sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/gI"
/etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "PermitUserEnvironment no" >> /etc/ssh/sshd_config fi diff --git a/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh b/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh index b1ad28f..24a385b 100644 --- a/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh +++ b/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh @@ -1,5 +1,5 @@ -grep -q ^Banner /etc/ssh/sshd_config && \
- sed -i "s/Banner.*/Banner /etc/issue/g" /etc/ssh/sshd_config
+grep -qi ^Banner /etc/ssh/sshd_config && \
- sed -i "s/Banner.*/Banner /etc/issue/gI" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then echo "Banner /etc/issue" >> /etc/ssh/sshd_config fi diff --git a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh index 0a2d226..c491057 100644 --- a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh +++ b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh @@ -1,8 +1,8 @@ source ./templates/support.sh populate sshd_idle_timeout_value
-grep -q ^ClientAliveInterval /etc/ssh/sshd_config && \
- sed -i "s/ClientAliveInterval.*/ClientAliveInterval
$sshd_idle_timeout_value/g" /etc/ssh/sshd_config +grep -qi ^ClientAliveInterval /etc/ssh/sshd_config && \
- sed -i "s/ClientAliveInterval.*/ClientAliveInterval
$sshd_idle_timeout_value/gI" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "ClientAliveInterval $sshd_idle_timeout_value" >> /etc/ssh/sshd_config fi diff --git a/RHEL6/input/fixes/bash/sshd_set_keepalive.sh b/RHEL6/input/fixes/bash/sshd_set_keepalive.sh index d54ba21..17b83ec 100644 --- a/RHEL6/input/fixes/bash/sshd_set_keepalive.sh +++ b/RHEL6/input/fixes/bash/sshd_set_keepalive.sh @@ -1,5 +1,5 @@ -grep -q ^ClientAliveCountMax /etc/ssh/sshd_config && \
- sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/g"
/etc/ssh/sshd_config +grep -qi ^ClientAliveCountMax /etc/ssh/sshd_config && \
- sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/gI"
/etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "ClientAliveCountMax 0" >> /etc/ssh/sshd_config fi diff --git a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh index a00eb95..264553f 100644 --- a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh +++ b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh @@ -1,5 +1,5 @@ -grep -q ^Ciphers /etc/ssh/sshd_config && \
- sed -i "s/Ciphers.*/Ciphers
aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/g" /etc/ssh/sshd_config +grep -qi ^Ciphers /etc/ssh/sshd_config && \
- sed -i "s/Ciphers.*/Ciphers
aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/gI" /etc/ssh/sshd_config if ! [ $? -eq 0 ]; then echo "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc" >> /etc/ssh/sshd_config fi -- 1.8.3.1
Ack (+thank you!)
Noticed another (sub)case when remediation would fail. In cases like:
\t+PermitRootLogin.*
current implementation, when performing the search if directive is already present in sshd config, doesn't take possibility of prefix / head whitescape (other than space itself) being present.
Filed upstream ticket for this: https://fedorahosted.org/scap-security-guide/ticket/430
and will include fix for this in the current process of moving sshd related remediations to /shared infrastructure [*].
Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Technologies Team
[*] That ticket is just for me not to need to keep it in the head (and possibly not to forget about it during / after Christmas break).
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide@lists.fedorahosted.org