[PATCH] [RHEL6] Fix SSH remediation scripts to be case-insensitive

Jan Lieskovsky jlieskov at redhat.com
Thu Dec 19 14:41:22 UTC 2013


----- Original Message -----
> From: "Shawn Wells" <shawn at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org
> Sent: Monday, December 16, 2013 5:41:50 PM
> Subject: Re: [PATCH] [RHEL6] Fix SSH remediation scripts to be case-insensitive
> 
> On 12/16/13, 11:34 AM, Jan Lieskovsky wrote:
> 
> 
> 
> [RHEL6] Fix SSH remediation scripts to be case-insensitive
> 
> Current version of various SSH remediation scripts for RHEL-6
> is searching (grep) and replacing (sed) particular /etc/ssh/sshd_config
> configuration file's option in case-sensitive manner (searching
> and replacing only strict matching exact case), therefore
> 
> having, e.g:
> 
> permitrootlogin yes
> 
> in /etc/ssh/sshd_config would end up (in current state) the 'PermitRootLogin
> no'
> string to be appended at the end of the file, but keep the
> root logins allowed (since first option present in /etc/ssh/sshd_config
> is honoured by sshd).
> 
> The proposal changes searches and replacements for various SSH daemon
> remediations to be case-insensitive, fixing this problem.
> 
> Please review.
> 
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
> 
> 0001-RHEL6-Fix-SSH-remediation-scripts-to-be-case-insensi.patch
> From 5033307ec5bc0759edcf455509b9208443356386 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky <jlieskov at redhat.com> Date: Mon, 16 Dec 2013 17:19:01
> +0100
> Subject: [PATCH] [RHEL6] Fix SSH remediation scripts to be case-insensitive
> 
> Signed-off-by: Jan Lieskovsky <jlieskov at redhat.com> ---
>  RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh | 4 ++--
>  RHEL6/input/fixes/bash/sshd_disable_rhosts.sh          | 4 ++--
>  RHEL6/input/fixes/bash/sshd_disable_root_login.sh      | 4 ++--
>  RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh  | 4 ++--
>  RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh   | 4 ++--
>  RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh        | 4 ++--
>  RHEL6/input/fixes/bash/sshd_set_keepalive.sh           | 4 ++--
>  RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh    | 4 ++--
>  8 files changed, 16 insertions(+), 16 deletions(-)
> 
> diff --git a/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
> b/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
> index f71fff1..c28fc77 100644
> --- a/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
> +++ b/RHEL6/input/fixes/bash/sshd_disable_empty_passwords.sh
> @@ -1,5 +1,5 @@
> -grep -q ^PermitEmptyPasswords /etc/ssh/sshd_config && \
> -  sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/g"
> /etc/ssh/sshd_config
> +grep -qi ^PermitEmptyPasswords /etc/ssh/sshd_config && \
> +  sed -i "s/PermitEmptyPasswords.*/PermitEmptyPasswords no/gI"
> /etc/ssh/sshd_config
>  if ! [ $? -eq 0 ]; then
>      echo "PermitEmptyPasswords no" >> /etc/ssh/sshd_config
>  fi
> diff --git a/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
> b/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
> index 24d22db..e87e3c1 100644
> --- a/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
> +++ b/RHEL6/input/fixes/bash/sshd_disable_rhosts.sh
> @@ -1,5 +1,5 @@
> -grep -q ^IgnoreRhosts /etc/ssh/sshd_config && \
> -  sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/g" /etc/ssh/sshd_config
> +grep -qi ^IgnoreRhosts /etc/ssh/sshd_config && \
> +  sed -i "s/IgnoreRhosts.*/IgnoreRhosts yes/gI" /etc/ssh/sshd_config
>  if ! [ $? -eq 0 ]; then
>      echo "IgnoreRhosts yes" >> /etc/ssh/sshd_config
>  fi
> diff --git a/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
> b/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
> index ffd8262..e8b65aa 100644
> --- a/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
> +++ b/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
> @@ -1,5 +1,5 @@
> -grep -q ^PermitRootLogin /etc/ssh/sshd_config && \
> -  sed -i "s/PermitRootLogin.*/PermitRootLogin no/g" /etc/ssh/sshd_config
> +grep -qi ^PermitRootLogin /etc/ssh/sshd_config && \
> +  sed -i "s/PermitRootLogin.*/PermitRootLogin no/gI" /etc/ssh/sshd_config
>  if ! [ $? -eq 0 ]; then
>      echo "PermitRootLogin "no >> /etc/ssh/sshd_config
>  fi
> diff --git a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
> b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
> index b886e3c..fb3f545 100644
> --- a/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
> +++ b/RHEL6/input/fixes/bash/sshd_do_not_permit_user_env.sh
> @@ -1,5 +1,5 @@
> -grep -q ^PermitUserEnvironment /etc/ssh/sshd_config && \
> -  sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/g"
> /etc/ssh/sshd_config
> +grep -qi ^PermitUserEnvironment /etc/ssh/sshd_config && \
> +  sed -i "s/PermitUserEnvironment.*/PermitUserEnvironment no/gI"
> /etc/ssh/sshd_config
>  if ! [ $? -eq 0 ]; then
>      echo "PermitUserEnvironment no" >> /etc/ssh/sshd_config
>  fi
> diff --git a/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
> b/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
> index b1ad28f..24a385b 100644
> --- a/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
> +++ b/RHEL6/input/fixes/bash/sshd_enable_warning_banner.sh
> @@ -1,5 +1,5 @@
> -grep -q ^Banner /etc/ssh/sshd_config && \
> -  sed -i "s/Banner.*/Banner \/etc\/issue/g" /etc/ssh/sshd_config
> +grep -qi ^Banner /etc/ssh/sshd_config && \
> +  sed -i "s/Banner.*/Banner \/etc\/issue/gI" /etc/ssh/sshd_config
>  if ! [ $? -eq 0 ]; then
>      echo "Banner /etc/issue" >> /etc/ssh/sshd_config
>  fi
> diff --git a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
> b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
> index 0a2d226..c491057 100644
> --- a/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
> +++ b/RHEL6/input/fixes/bash/sshd_set_idle_timeout.sh
> @@ -1,8 +1,8 @@
>  source ./templates/support.sh
>  populate sshd_idle_timeout_value
>  
> -grep -q ^ClientAliveInterval /etc/ssh/sshd_config && \
> -  sed -i "s/ClientAliveInterval.*/ClientAliveInterval
> $sshd_idle_timeout_value/g" /etc/ssh/sshd_config
> +grep -qi ^ClientAliveInterval /etc/ssh/sshd_config && \
> +  sed -i "s/ClientAliveInterval.*/ClientAliveInterval
> $sshd_idle_timeout_value/gI" /etc/ssh/sshd_config
>  if ! [ $? -eq 0 ]; then
>      echo "ClientAliveInterval $sshd_idle_timeout_value" >>
>      /etc/ssh/sshd_config
>  fi
> diff --git a/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
> b/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
> index d54ba21..17b83ec 100644
> --- a/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
> +++ b/RHEL6/input/fixes/bash/sshd_set_keepalive.sh
> @@ -1,5 +1,5 @@
> -grep -q ^ClientAliveCountMax /etc/ssh/sshd_config && \
> -  sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/g"
> /etc/ssh/sshd_config
> +grep -qi ^ClientAliveCountMax /etc/ssh/sshd_config && \
> +  sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/gI"
> /etc/ssh/sshd_config
>  if ! [ $? -eq 0 ]; then
>      echo "ClientAliveCountMax 0" >> /etc/ssh/sshd_config
>  fi
> diff --git a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
> b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
> index a00eb95..264553f 100644
> --- a/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
> +++ b/RHEL6/input/fixes/bash/sshd_use_approved_ciphers.sh
> @@ -1,5 +1,5 @@
> -grep -q ^Ciphers /etc/ssh/sshd_config && \
> -  sed -i "s/Ciphers.*/Ciphers
> aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/g"
> /etc/ssh/sshd_config
> +grep -qi ^Ciphers /etc/ssh/sshd_config && \
> +  sed -i "s/Ciphers.*/Ciphers
> aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc/gI"
> /etc/ssh/sshd_config
>  if ! [ $? -eq 0 ]; then
>      echo "Ciphers
>      aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc"
>      >> /etc/ssh/sshd_config
>  fi
> --
> 1.8.3.1
> 
> Ack (+thank you!)

Noticed another (sub)case when remediation would fail. In cases like:

  \t+PermitRootLogin.*

current implementation, when performing the search if directive is already present
in sshd config, doesn't take possibility of prefix / head whitescape (other than
space itself) being present.

  Filed upstream ticket for this:
    https://fedorahosted.org/scap-security-guide/ticket/430

and will include fix for this in the current process of moving sshd related remediations
to /shared infrastructure [*].

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

[*] That ticket is just for me not to need to keep it in the head (and
    possibly not to forget about it during / after Christmas break).

> 
> _______________________________________________
> scap-security-guide mailing list
> scap-security-guide at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 


More information about the scap-security-guide mailing list