[PATCH 04/13] New remediation
Shawn Wells
shawn at redhat.com
Tue Sep 10 14:42:45 UTC 2013
On 9/10/13 7:47 AM, Trevor Vaughan wrote:
> I need to look through the SCAP code but, since the order of ciphers
> is unimportant on the daemon side, wouldn't you want the check side of
> this to be a regex such that people can use the same cipher setting
> for both ssh_config and sshd_config?
>
> I would modify the order of the remediation statement in this patch to
> match the strong -> weak order as well as a hint to the local admin.
>
> I tend to list from strongest to weakest for ssh_config and just
> re-use the string in sshd_config for consistency.
>
> There should be a check (I apologize if there is and I just didn't
> check enough) for the Ciphers setting in ssh_config as well to order
> the ciphers from strongest to weakest since order matters in the
> client file.
>
> Yes, I know that the client file can be overridden by the user but,
> since most users don't do that, it's a good idea to set it appropriately.
These are really good ideas. I've created a Trac ticket [1] to ensure
this doesn't get stuck in mailing list limbo. Would you be willing to
whip up a regex patch?
[1] https://fedorahosted.org/scap-security-guide/ticket/413
More information about the scap-security-guide
mailing list