All;
I ran into a bug in the latest SSG for RHEL6 (0.1.21-2). There is definitely
an issue with the check for approved Ciphers. Initially the check passed
with no entry at all for Ciphers. I then placed a Cipher line with (1) valid
cipher: pass. Finally I put an entry in sshd_config with a bogus cipher:
passed. I just ran into this at the end of my workday today so I didn't get
much of a chance to analyze it. Plus I'm really just starting to dig into
the 'innards' of the content so I don't fully realize the connections of all
the various sections (rule/def/tst/obj/ste). I'm also pretty sure that some
of the other checks against sshd_config are off. The check for
'PermitRootLogin no' passed even though the file contains '#PermitRootLogin
yes' and typically the checks are looking for the presence of the target
string, not the absence of it.
Any input would be appreciated.
Thanks,
Les Kimmel
Systems Engineer, CSC
Show replies by date