Remediations involving sshd_config

Rui Pedro Bernardino rui-p-bernardino at ptinovacao.pt
Fri Oct 4 07:52:05 UTC 2013


Hi,

I have exactly the same results but that’s not the point. This is what I get on a system without a ‘Banner’ but with a 'Match' group:
	[root at seis64 ~]# ssh localhost
	root at localhost's password:                    
	[root at seis64 ~]# sshd_enable_warning_banner.sh
	[root at seis64 ~]# /etc/init.d/sshd restart
	Stopping sshd:                                             [  OK  ]
	Starting sshd:                                             [  OK  ]
	[root at seis64 ~]# ssh localhost
	root at localhost's password:

Still no banner. 

This is because the ‘Banner’ was appended to the end of sshd_config and got ‘absorved’ by the Match rules (that use anything following 'Match' until EOF or another 'Match'):
	[root at seis64 ~]# tail -5 /etc/ssh/sshd_config
	# Rules for sftponly group
	Match group sftponly
	X11Forwarding no
	AllowTcpForwarding no
	Banner /etc/issue

This applies to all SSG's sshd_config fixes. Note not all configuration primitives are acceptable on the “Match” blocks, meaning starting sshd will fail.

Bottom line, new primitives must be inserted *before* Match blocks.


Regards

--
Rui Pedro Bernardino
CTE2/Tecnologias e Desenvolvimento
PT Inovação

From: scap-security-guide-bounces at lists.fedorahosted.org [mailto:scap-security-guide-bounces at lists.fedorahosted.org] On Behalf Of Shawn Wells
Sent: sexta-feira, 4 de Outubro de 2013 04:17
To: scap-security-guide at lists.fedorahosted.org
Subject: Re: Remediations involving sshd_config

On 10/3/13 10:08 AM, Rui Pedro Bernardino wrote:
Hi all,

The remediation won't work if it appends the new option to the end of file AND there are 'Match' rules (from sshd_config's: "If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file."). 

Although commented, 'Match' rules are in the default sshd_config.

For example, for "sshd_enable_warning_banner.sh", my suggestion would be:
==================================
grep -q ^Banner /etc/ssh/sshd_config && \
  sed -i "s/Banner.*/Banner \/etc\/issue/g" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
    ed -s /etc/ssh/sshd_config <<'EOF'
/Match/
?^[A-Z]?
+
i
Banner /etc/issue
.
w
q
EOF
fi
==================================
This will add a new line, after the last keyword before the first 'Match' block (including comments). I'm ashamed to say I couldn't do it with 'sed' :(

Does it sound reasonable?

This situation *should* be taken care of. Are you experiencing something different than the situation below?

1) Testing file with no Banner value set:

[shawn at SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config 
#Banner none

[shawn at SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml 
Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_bannerzkgnCU.xml
Writing results to : /tmp/sshd_enable_warning_bannerzkgnCU.xml-results
Definition oval:scap-security-guide.testing:def:129: false
Definition oval:scap-security-guide.testing:def:127: false
Definition oval:scap-security-guide.testing:def:126: false
Evaluation done.

[shawn at SSG-RHEL6 checks]$ sudo bash ../fixes/bash/sshd_enable_warning_banner.sh 
[shawn at SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config 
#Banner none
Banner /etc/issue

[shawn at SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml 
Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_banner43kR1V.xml
Writing results to : /tmp/sshd_enable_warning_banner43kR1V.xml-results
Definition oval:scap-security-guide.testing:def:129: false
Definition oval:scap-security-guide.testing:def:127: false
Definition oval:scap-security-guide.testing:def:126: true
Evaluation done.

2) Testing if incorrect Banner value set

[shawn at SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config 
#Banner none
Banner /totally/wrong/path

[shawn at SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml 
Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_banneryFifQw.xml
Writing results to : /tmp/sshd_enable_warning_banneryFifQw.xml-results
Definition oval:scap-security-guide.testing:def:129: false
Definition oval:scap-security-guide.testing:def:127: false
Definition oval:scap-security-guide.testing:def:126: false
Evaluation done.

[shawn at SSG-RHEL6 checks]$ sudo bash ../fixes/bash/sshd_enable_warning_banner.sh 
[shawn at SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config 
#Banner /etc/issue
Banner /etc/issue

[shawn at SSG-RHEL6 checks]$ sudo ./testcheck.py sshd_enable_warning_banner.xml 
Evaluating with OVAL tempfile : /tmp/sshd_enable_warning_bannervMyGwb.xml
Writing results to : /tmp/sshd_enable_warning_bannervMyGwb.xml-results
Definition oval:scap-security-guide.testing:def:129: false
Definition oval:scap-security-guide.testing:def:127: false
Definition oval:scap-security-guide.testing:def:126: true
Evaluation done.








More information about the scap-security-guide mailing list