[PATCH] added new macro for SSH checks (rough wording for now), and used it
Jeffrey Blank
blank at eclipse.ncsc.mil
Thu Sep 27 13:49:41 UTC 2012
Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
RHEL6/input/services/ssh.xml | 15 +++++++++++++++
RHEL6/transforms/shorthand2xccdf.xslt | 21 ++++++++++++++++++++-
2 files changed, 35 insertions(+), 1 deletions(-)
diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index d60e499..9bbab3a 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -205,6 +205,9 @@ To ensure that this behavior is disabled, add or correct the
following line:
<pre>IgnoreRhosts yes</pre>
</description>
+<ocil>
+<sshd-check-macro option="IgnoreRhosts" value="yes" default="yes" />
+</ocil>
<rationale>
SSH trust relationships mean that a compromise on one host
can allow an attacker to move trivially to other hosts.
@@ -226,6 +229,9 @@ To disable host-based authentication, add or correct the
following line:
<pre>HostbasedAuthentication no</pre>
</description>
+<ocil>
+<sshd-check-macro option="HostbasedAuthentication" value="no" default="yes" />
+</ocil>
<rationale>
SSH trust relationships mean that a compromise on one host
can allow an attacker to move trivially to other hosts.
@@ -242,6 +248,9 @@ system directly over a network.
To disable root login via SSH, add or correct the following line:
<pre>PermitRootLogin no</pre>
</description>
+<ocil>
+<sshd-check-macro option="PermitRootLogin" value="no" default="no" />
+</ocil>
<rationale>
Permitting direct root login reduces auditable information about who ran
privileged commands on the system
@@ -261,6 +270,9 @@ empty passwords, add or correct the following line:
Any accounts with empty passwords should be disabled immediately, and PAM configuration
should prevent users from being able to assign themselves empty passwords.
</description>
+<ocil>
+<sshd-check-macro option="PermitEmptyPasswords" value="no" default="yes" />
+</ocil>
<rationale>
Configuring this setting for the SSH daemon provides additional assurance that
remote login via SSH will require a password,
@@ -279,6 +291,9 @@ across the system, add or correct the following line in <tt>/etc/ssh/sshd_config
Another section contains information on how to create an
appropriate system-wide warning banner.
</description>
+<ocil>
+<sshd-check-macro option="Banner" value="/etc/issue" default="no" />
+</ocil>
<rationale>
Although unlikely to dissuade a serious attacker, the warning message
reinforces policy awareness during the logon process. Alternatively,
diff --git a/RHEL6/transforms/shorthand2xccdf.xslt b/RHEL6/transforms/shorthand2xccdf.xslt
index e046709..8511fd2 100644
--- a/RHEL6/transforms/shorthand2xccdf.xslt
+++ b/RHEL6/transforms/shorthand2xccdf.xslt
@@ -45,7 +45,9 @@ exclude-result-prefixes="xccdf xhtml">
<xsl:apply-templates select="ref"/>
<xsl:apply-templates select="rationale"/>
<xsl:apply-templates select="ident"/>
- <xsl:apply-templates select="node()[not(self::title|self::description|self::warning|self::ref|self::rationale|self::ident)]"/>
+ <!-- order oval (shorthand tag) first, to indicate to tools to prefer its automated checks -->
+ <xsl:apply-templates select="oval"/>
+ <xsl:apply-templates select="node()[not(self::title|self::description|self::warning|self::ref|self::rationale|self::ident|self::oval)]"/>
</xsl:copy>
</xsl:template>
@@ -197,6 +199,7 @@ exclude-result-prefixes="xccdf xhtml">
<xsl:if test="package-check-macro">the package is installed</xsl:if>
<xsl:if test="module-disable-check-macro">no line is returned</xsl:if>
<xsl:if test="audit-syscall-check-macro">no line is returned</xsl:if>
+ <xsl:if test="sshd-check-macro">the required value is not set</xsl:if>
</xsl:attribute>
<!-- add clause if explicitly specified (and also override any above) -->
@@ -367,6 +370,22 @@ If the system is configured to audit this activity, it will return a line.
</xsl:template>
+ <xsl:template match="sshd-check-macro">
+ <!-- could also do this with sshd -T to test live configuration -->
+ To determine how the SSH daemon's
+ <xhtml:code><xsl:value-of select="@option"/></xhtml:code>
+ option is set, run the following command:
+ <xhtml:pre xml:space="preserve"># grep -i <xsl:value-of select="@option"/> /etc/ssh/sshd_config</xhtml:pre>
+ <xsl:if test="@default='yes'">
+ If no line, a commented line, or a line indicating the value
+ <xhtml:code><xsl:value-of select="@value"/></xhtml:code> is returned, then the required value is set.
+ </xsl:if>
+ <xsl:if test="@default='no' or @default=''">
+ If a line indicating <xsl:value-of select="@value"/> is returned, then the required value is set.
+ </xsl:if>
+ </xsl:template>
+
+
<!-- CORRECTING TERRIBLE ABUSE OF NAMESPACES BELOW -->
<!-- (expanding xhtml tags back into the xhtml namespace) -->
<xsl:template match="br">
--
1.7.1
More information about the scap-security-guide
mailing list