[PATCH] [Shared] Add shared remediation script for sshd disable root login rule
Jan Lieskovsky
jlieskov at redhat.com
Fri Dec 20 10:33:09 UTC 2013
Hello folks,
just FYI have pushed this patch to master (would like
to make new Fedora releases before Christmas yet).
Should there be some issues found, I will fix them later.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team
----- Original Message -----
> From: "Jan Lieskovsky" <jlieskov at redhat.com>
> To: scap-security-guide at lists.fedorahosted.org, "Rui Pedro Bernardino" <rui-p-bernardino at ptinovacao.pt>
> Sent: Thursday, December 19, 2013 3:12:10 PM
> Subject: [PATCH] [Shared] Add shared remediation script for sshd disable root login rule
>
> Hello Rui, folks,
>
> as correctly observed by Rui Pedro Bernardino in [*]:
> [1]
> https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-December/004711.html
> [2]
> https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-December/004715.html
>
> current implementation of sshd related remediation scripts for RHEL-6 SSG
> content
> does't handle presence of Match block directive present in sshd config
> correctly.
>
> Attached patch is a prototype solution, which should deal with this problem.
> It is proposed to be a shared remediation script (since the same would affect
> Fedora).
>
> Couple of notes:
> * while it looks overly / more complex against the original version:
> [3]
> https://git.fedorahosted.org/cgit/scap-security-guide.git/tree/RHEL6/input/fixes/bash/sshd_disable_root_login.sh
>
> actually it shouldn't be that bad. While actions for selected (sub)cases
> are identical ( -- examples:
> - when there isn't Match block and already one PermitRootLogin directive
> present
> in sshd config with case when there are Match block and PermitRootLogin
> (PRL) directives
> present in sshd config already, and PRL is sooner than Match block or,
> - in case when there's Match block present, no PRL yet with case when
> there's Match block present, PRL present too, and PRL is placed after
> first Match block directive),
>
> and therefore corresponding if statements could be merged, I would prefer
> to keep this version (including the comments), as it's straightforward /
> visible in each case what the remediation (sub)action would look like.
>
> * I am aware this "Match block issue" isn't problem just of 'sshd disable
> root
> login' rule, but problem of RHEL-6's sshd remediation scripts in general =>
> have created upstream ticket:
> [4] https://fedorahosted.org/scap-security-guide/ticket/429
>
> to track this, took it, and will gradually propose (shared) patches,
> taking this into account during the process / as adding them for Fedora
> SCAP
> content.
>
> * Besides that noticed another issue - search for whitespace (other than
> space character itself) prefixed directives wouldn't succeed, thus we would
> end up adding new directive at the end of sshd config, resulting into
> situation the remediation wouldn't actually correct the configuration.
>
> Example case for the former implementation wouldn't work being:
>
> ^\t*PermitRootLogin yes
>
> present in sshd config. Have filed another ticket:
> [5] https://fedorahosted.org/scap-security-guide/ticket/430
>
> to track this deficiency across RHEL-6's sshd remediation scripts.
>
> The attached patch deals also with this situation for the case of
> 'sshd disable root login' rule. For the remaining rules, took the [5]
> ticket,
> and will provide (shared) patches gradually aligned with as I will provide
> sshd remediation fixes for Fedora.
>
> * The above proposal has been tested against following subcases:
> -- no PRL, no MB present in sshd config,
> -- PRL present, no MB present in sshd config,
> -- MB present, no PRL present yet in sshd config,
> -- MB present, PRL present before MB directive in sshd config, and finally
>
> on sample Fedora sshd configuration and seems to be working. Would
> appreciate
> further testing / any objections though.
>
> * Last but not least the current proposal intentionally doesn't apply the
> remediation for 'PermitRootLogin' directive being present within Match
> block directive
> (since I am taking presence of MB as some kind of exception case).
>
> Example - considering sshd config:
>
> # PermitRootLogin not yet in sshd config
> Match Address some_IP
> PermitRootLogin yes
>
> it would transform it into:
>
> # PermitRootLogin not yet in sshd config
> PermitRootLogin no
> Match Address some_IP
> PermitRootLogin yes
>
> IOW any occurrence of PRL within Match block would be kept intact. If this
> should
> be changed too, let me know (and we can adjust in subsequent version).
>
>
> Please review / test the proposal (since it should work for both
> of RHEL-6 and Fedora, and if acceptable could be used as prototype for
> remediation scripts also for other sshd rules).
>
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> [*] Thank you again for opening this (sub)case, Rui.
>
>
> P.S.: Apologize for such a long post, but too much information to share.
>
>
More information about the scap-security-guide
mailing list