[PATCH 04/13] New remediation

Shawn Wells shawn at redhat.com
Tue Sep 10 14:42:45 UTC 2013


On 9/10/13 7:47 AM, Trevor Vaughan wrote:
> I need to look through the SCAP code but, since the order of ciphers 
> is unimportant on the daemon side, wouldn't you want the check side of 
> this to be a regex such that people can use the same cipher setting 
> for both ssh_config and sshd_config?
>
> I would modify the order of the remediation statement in this patch to 
> match the strong -> weak order as well as a hint to the local admin.
>
> I tend to list from strongest to weakest for ssh_config and just 
> re-use the string in sshd_config for consistency.
>
> There should be a check (I apologize if there is and I just didn't 
> check enough) for the Ciphers setting in ssh_config as well to order 
> the ciphers from strongest to weakest since order matters in the 
> client file.
>
> Yes, I know that the client file can be overridden by the user but, 
> since most users don't do that, it's a good idea to set it appropriately.

These are really good ideas. I've created a Trac ticket [1] to ensure 
this doesn't get stuck in mailing list limbo. Would you be willing to 
whip up a regex patch?

[1] https://fedorahosted.org/scap-security-guide/ticket/413


More information about the scap-security-guide mailing list