[PATCH] [Fedora] Fix remediation for sshd set keepalive (ClientAliveCountMax) and move it to /shared

Shawn Wells shawn at redhat.com
Fri Dec 20 14:31:06 UTC 2013


On 12/20/13, 9:13 AM, Jan Lieskovsky wrote:
> Attached patch fixes remediation script for sshd set
> keepalive (ClientAliveCountMax) rule, since it has been
> reported to cause issues:
>    [1]https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-December/004715.html
>
> when Match block present in sshd config and moves it
> to /shared fixes directory.
>
> Tests succeeded for all four (sub)cases:
> * no ClientAliveCountMax and no Match block
> * ClientAliveCountMax already present, no Match block
> * ClientAliveCountMax not present, Match block present
> * both of ClientAliveCountMax and Match block directives present
>
> in sshd config.
>
> Pushed to master.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> 0001-Fedora-Fix-remediation-for-sshd-set-keepalive-Client.patch
>
>
>  From 070f80e51904a3bd157ca4897a3a7fc23de3b20c Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Fri, 20 Dec 2013 15:06:28 +0100
> Subject: [PATCH] [Fedora] Fix remediation for sshd set keepalive
>   (ClientAliveCountMax)          and move it to /shared
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
>   Fedora/input/fixes/bash/sshd_set_keepalive.sh | 15 +-------
>   Fedora/scap-security-guide.spec               |  6 ++-
>   shared/fixes/bash/sshd_set_keepalive.sh       | 55 +++++++++++++++++++++++++++
>   3 files changed, 61 insertions(+), 15 deletions(-)
>   mode change 100644 => 120000 Fedora/input/fixes/bash/sshd_set_keepalive.sh
>   create mode 100755 shared/fixes/bash/sshd_set_keepalive.sh
>
> diff --git a/Fedora/input/fixes/bash/sshd_set_keepalive.sh b/Fedora/input/fixes/bash/sshd_set_keepalive.sh
> deleted file mode 100644
> index 100da61..0000000
> --- a/Fedora/input/fixes/bash/sshd_set_keepalive.sh
> +++ /dev/null
> @@ -1,14 +0,0 @@
> -#
> -# Configure proper ClientAliveCountMax sshd daemon value
> -#
> -grep -q ^ClientAliveCountMax /etc/ssh/sshd_config && \
> -sed -i "s/ClientAliveCountMax.*/ClientAliveCountMax 0/g" /etc/ssh/sshd_config
> -if ! [ $? -eq 0 ]
> -then
> -  echo -e "ClientAliveCountMax 0" >> /etc/ssh/sshd_config
> -fi
> -
> -#
> -# Restart the sshd service (new option to take effect)
> -#
> -systemctl restart sshd.service
> diff --git a/Fedora/input/fixes/bash/sshd_set_keepalive.sh b/Fedora/input/fixes/bash/sshd_set_keepalive.sh
> new file mode 120000
> index 0000000..834cf15
> --- /dev/null
> +++ b/Fedora/input/fixes/bash/sshd_set_keepalive.sh
> @@ -0,0 +1 @@
> +../../../../shared/fixes/bash/sshd_set_keepalive.sh
> \ No newline at end of file
> diff --git a/Fedora/scap-security-guide.spec b/Fedora/scap-security-guide.spec
> index b578279..c2bcf62 100644
> --- a/Fedora/scap-security-guide.spec
> +++ b/Fedora/scap-security-guide.spec
> @@ -5,7 +5,7 @@
>   # file one level up - in the main scap-security-guide directory (instead of
>   # this one).
>   
> -%global	fedorassgversion	4.rc15
> +%global	fedorassgversion	4.rc16
>   
>   Name:		scap-security-guide
>   Version:	0.1.%{fedorassgversion}
> @@ -68,6 +68,10 @@ cp -a Fedora/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man
>   %files compat
>   
>   %changelog
> +* Fri Dec 20 2013 Jan iankko Lieskovsky<jlieskov at redhat.com>  0.1.4.rc16-1
> +- Fix remediation for sshd set keepalive (ClientAliveCountMax) and move
> +  it to /shared
> +
>   * Thu Dec 19 2013 Jan iankko Lieskovsky<jlieskov at redhat.com>  0.1.4.rc15-1
>   - Shared remediation for sshd disable root login
>   - Add empty -compat subpackage to ensure backward-compatibility with
> diff --git a/shared/fixes/bash/sshd_set_keepalive.sh b/shared/fixes/bash/sshd_set_keepalive.sh
> new file mode 100755
> index 0000000..35754da
> --- /dev/null
> +++ b/shared/fixes/bash/sshd_set_keepalive.sh
> @@ -0,0 +1,55 @@
> +
> +SSHD_CONFIG='/etc/ssh/sshd_config'
> +
> +# Obtain line number of first uncommented case-insensitive occurrence of Match
> +# block directive (possibly prefixed with whitespace) present in $SSHD_CONFIG
> +FIRST_MATCH_BLOCK=$(sed -n '/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG)
> +
> +# Obtain line number of first uncommented case-insensitive occurence of
> +# ClientAliveCountMax directive (possibly prefixed with whitespace) present in
> +# $SSHD_CONFIG
> +FIRST_CLIENT_ALIVE_COUNT_MAX=$(sed -n '/^[[:space:]]*ClientAliveCountMax[^\n]*/I{=;q}' $SSHD_CONFIG)
> +
> +# Case: Match block directive not present in $SSHD_CONFIG
> +if [ -z "$FIRST_MATCH_BLOCK" ]
> +then
> +
> +    # Case: ClientAliveCountMax directive not present in $SSHD_CONFIG yet
> +    if [ -z "$FIRST_CLIENT_ALIVE_COUNT_MAX" ]
> +    then
> +        # Append 'ClientAliveCountMax 0' at the end of $SSHD_CONFIG
> +        echo -e "\nClientAliveCountMax 0" >> $SSHD_CONFIG
> +
> +    # Case: ClientAliveCountMax directive present in $SSHD_CONFIG already
> +    else
> +        # Replace first uncommented case-insensitive occurrence
> +        # of ClientAliveCountMax directive
> +        sed -i "$FIRST_CLIENT_ALIVE_COUNT_MAX s/^[[:space:]]*ClientAliveCountMax.*$/ClientAliveCountMax 0/I" $SSHD_CONFIG
> +    fi
> +
> +# Case: Match block directive present in $SSHD_CONFIG
> +else
> +
> +    # Case: ClientAliveCountMax directive not present in $SSHD_CONFIG yet
> +    if [ -z "$FIRST_CLIENT_ALIVE_COUNT_MAX" ]
> +    then
> +        # Prepend 'ClientAliveCountMax 0' before first uncommented
> +        # case-insensitive occurrence of Match block directive
> +        sed -i "$FIRST_MATCH_BLOCK s/^\([[:space:]]*Match[^\n]*\)/ClientAliveCountMax 0\n\1/I" $SSHD_CONFIG
> +
> +    # Case: ClientAliveCountMax directive present in $SSHD_CONFIG and placed
> +    #       before first Match block directive
> +    elif [ "$FIRST_CLIENT_ALIVE_COUNT_MAX" -lt "$FIRST_MATCH_BLOCK" ]
> +    then
> +        # Replace first uncommented case-insensitive occurrence
> +        # of ClientAliveCountMax directive
> +        sed -i "$FIRST_CLIENT_ALIVE_COUNT_MAX s/^[[:space:]]*ClientAliveCountMax.*$/ClientAliveCountMax 0/I" $SSHD_CONFIG
> +
> +    # Case: ClientAliveCountMax directive present in $SSHD_CONFIG and placed
> +    # after first Match block directive
> +    else
> +         # Prepend 'ClientAliveCountMax 0' before first uncommented
> +         # case-insensitive occurrence of Match block directive
> +         sed -i "$FIRST_MATCH_BLOCK s/^\([[:space:]]*Match[^\n]*\)/ClientAliveCountMax 0\n\1/I" $SSHD_CONFIG
> +    fi
> +fi
> -- 1.8.3.1

Since the remediation is going into shared/, could you add a comment 
into the script reflecting that it's been tested on Fedora? At some 
future point we may find a better way to indicate which platform(s) 
scripts have been tested against, but this will get us started.

Ack.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20131220/c8b791b6/attachment.html>


More information about the scap-security-guide mailing list