Checking the default values by performing a scan

Jan Lieskovsky jlieskov at redhat.com
Thu Nov 21 12:23:41 UTC 2013


Hello folks,

  with the intentions the Fedora scap-security-guide content
to be adaptable to future versions of scap-security-guide content
for Red Hat Enterprise Linux as much as possible, I encountered
the following question I would like the SSG upstream to provide
an opinion at prior me proceeding on actual implementation of the
rule.

The SCAP content for Red Hat Enterprise Linux 6 contains the following
SSH protocol / service related rule:
  "3.4.3.a. Allow Only SSH Protocol 2"

Having a look at particular OVAL check it implements approximately the
following logic - rule succeeds only in cases the sshd service isn't
enabled or the "Protocol 2" option is present in /etc/ssh/sshd_config
file.

In Fedora (for case of 19 currently based on openssh-server-6.2p2) the
situation is slightly different. OpenSSH upstream starting from 5.4 version:
  [1] http://www.openssh.com/txt/release-5.4
  [2] http://en.wikipedia.org/wiki/OpenSSH

the version 1 of the SSH protocol is disabled by default and clients / servers
that (still) need to use it need to explicitly enable it in ssh_config / sshd_config
files or via command line.

So for case of Fedora (later versions of Red Hat Enterprise Linux) the check
for "Protocol 2" string being present in /etc/ssh/sshd_config file would not
be sufficient.

This is the actual point of my question - protocol 2 being the default version,
is it sufficient to expect version 2 being the used one and the check should verify
just if version 1 of the SSH protocol wasn't explicitly enabled in the config file
and also possibly if version of openssh-server package is greater than 5.4?

Or would you recommend another approach? If so, what it would look like?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

P.S.: The case of "3.4.3.a. Allow Only SSH Protocol 2" has been selected just
      as an example of such rule. But there are more cases of behaviour like
      this (for example ExecShield being enabled by default etc.)


More information about the scap-security-guide mailing list