The tests should ensure the options are disabled but the logic was reversed. The tests also allowed zero whitespace where sshd would not.
Signed-off-by: Kenneth Stailey kstailey.lists@gmail.com --- RHEL6/input/checks/sshd_no_user_envset.xml | 2 +- RHEL6/input/checks/sshd_permitemptypasswords_no.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/checks/sshd_no_user_envset.xml b/RHEL6/input/checks/sshd_no_user_envset.xml index a68d872..985395e 100644 --- a/RHEL6/input/checks/sshd_no_user_envset.xml +++ b/RHEL6/input/checks/sshd_no_user_envset.xml @@ -28,7 +28,7 @@ version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Uu][Ss][Ee][Rr][Ee][Nn][Vv][Ii][Rr][Oo][Nn][Mm][Ee][Nn][Tt][\s]*yes\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Uu][Ss][Ee][Rr][Ee][Nn][Vv][Ii][Rr][Oo][Nn][Mm][Ee][Nn][Tt][\s]+[Nn][Oo]\s*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group> diff --git a/RHEL6/input/checks/sshd_permitemptypasswords_no.xml b/RHEL6/input/checks/sshd_permitemptypasswords_no.xml index 29545b6..3795e4b 100644 --- a/RHEL6/input/checks/sshd_permitemptypasswords_no.xml +++ b/RHEL6/input/checks/sshd_permitemptypasswords_no.xml @@ -28,7 +28,7 @@ version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename> - <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Ee][Mm][Pp][Tt][Yy][Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd][Ss][\s]*yes\s*$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Ee][Mm][Pp][Tt][Yy][Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd][Ss][\s]+[Nn][Oo]\s*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group>
On 1/16/13 6:01 PM, Kenneth Stailey wrote:
The tests should ensure the options are disabled but the logic was reversed. The tests also allowed zero whitespace where sshd would not.
Signed-off-by: Kenneth Staileykstailey.lists@gmail.com
RHEL6/input/checks/sshd_no_user_envset.xml | 2 +- RHEL6/input/checks/sshd_permitemptypasswords_no.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/checks/sshd_no_user_envset.xml b/RHEL6/input/checks/sshd_no_user_envset.xml index a68d872..985395e 100644 --- a/RHEL6/input/checks/sshd_no_user_envset.xml +++ b/RHEL6/input/checks/sshd_no_user_envset.xml @@ -28,7 +28,7 @@ version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Uu][Ss][Ee][Rr][Ee][Nn][Vv][Ii][Rr][Oo][Nn][Mm][Ee][Nn][Tt][\s]*yes\s*$</ind:pattern>
- <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Uu][Ss][Ee][Rr][Ee][Nn][Vv][Ii][Rr][Oo][Nn][Mm][Ee][Nn][Tt][\s]+[Nn][Oo]\s*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object>
</def-group>
diff --git a/RHEL6/input/checks/sshd_permitemptypasswords_no.xml b/RHEL6/input/checks/sshd_permitemptypasswords_no.xml index 29545b6..3795e4b 100644 --- a/RHEL6/input/checks/sshd_permitemptypasswords_no.xml +++ b/RHEL6/input/checks/sshd_permitemptypasswords_no.xml @@ -28,7 +28,7 @@ version="1"> ind:path/etc/ssh</ind:path> ind:filenamesshd_config</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Ee][Mm][Pp][Tt][Yy][Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd][Ss][\s]*yes\s*$</ind:pattern>
- <ind:pattern operation="pattern match">^[\s]*[Pp][Ee][Rr][Mm][Ii][Tt][Ee][Mm][Pp][Tt][Yy][Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd][Ss][\s]+[Nn][Oo]\s*$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object>
</def-group>
--
Ack - please push (or indicate you need someone to do that for you).
Thank you for testing the OVAL code; incredibly needed and far overdue!
scap-security-guide@lists.fedorahosted.org