[PATCH v2] [shared] Allow comments in sshd config directives, support only lowercase sshd config values (yes/no)
Shawn Wells
shawn at redhat.com
Mon Apr 14 17:32:28 UTC 2014
On 4/14/14, 1:14 PM, Jan Lieskovsky wrote:
> Patch summary:
> * provide v2 of the patch to support trailing comments after
> various directives in / from /etc/ssh/sshd_config - based on feedback from:
> https://lists.fedorahosted.org/pipermail/scap-security-guide/2014-April/005185.html
>
> * add end terminator for "case-insensitive" regex match for cases
> where appropriate
>
> (e.g. "PermitRootLogin Yes" is not allowed, since sshd allows just
> directive names to be case-insensitive. Can be verified by attempt
> to start sshd with such config.)
>
> * update versions & test attestations
>
> Testing report:
> * all changed files / directives has been tested on RHEL-6 for both cases
> (with / without trailing comments) and generate same results in particular
> configuration (IOW it's irrelevant if the comment is there or not)
>
> Please review.
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Technologies Team
>
> 0001-shared-Allow-comments-in-sshd-config-directives-supp.patch
>
>
> From 65d4cc63e2a4aff31ff4fe081f8d3247345139e9 Mon Sep 17 00:00:00 2001
> From: Jan Lieskovsky<jlieskov at redhat.com>
> Date: Mon, 14 Apr 2014 19:04:04 +0200
> Subject: [PATCH] [shared] Allow comments in sshd config directives, support
> only lowercase sshd config values (yes/no)
>
> Signed-off-by: Jan Lieskovsky<jlieskov at redhat.com>
> ---
> shared/oval/disable_host_auth.xml | 6 +++---
> shared/oval/sshd_allow_only_protocol2.xml | 6 +++---
> shared/oval/sshd_disable_empty_passwords.xml | 6 +++---
> shared/oval/sshd_disable_rhosts.xml | 6 +++---
> shared/oval/sshd_disable_root_login.xml | 6 +++---
> shared/oval/sshd_do_not_permit_user_env.xml | 6 +++---
> shared/oval/sshd_enable_warning_banner.xml | 6 +++---
> shared/oval/sshd_set_idle_timeout.xml | 6 +++---
> shared/oval/sshd_set_keepalive.xml | 6 +++---
> shared/oval/sshd_use_approved_ciphers.xml | 6 +++---
> 10 files changed, 30 insertions(+), 30 deletions(-)
>
> diff --git a/shared/oval/disable_host_auth.xml b/shared/oval/disable_host_auth.xml
> index faf372d..6f4eb9d 100644
> --- a/shared/oval/disable_host_auth.xml
> +++ b/shared/oval/disable_host_auth.xml
> @@ -7,7 +7,7 @@
> <platform>Red Hat Enterprise Linux 7</platform>
> </affected>
> <description>SSH host-based authentication should be disabled.</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140414" ref_url="test_attestation" />
> </metadata>
> <criteria comment="SSH is not being used or conditions are met"
> operator="OR">
> @@ -22,9 +22,9 @@
> version="1">
> <ind:object object_ref="object_sshd_hostbasedauthentication" />
> </ind:textfilecontent54_test>
> - <ind:textfilecontent54_object id="object_sshd_hostbasedauthentication" version="1">
> + <ind:textfilecontent54_object id="object_sshd_hostbasedauthentication" version="2">
> <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)HostbasedAuthentication[\s]+yes[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*(?i)HostbasedAuthentication(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
> </def-group>
> diff --git a/shared/oval/sshd_allow_only_protocol2.xml b/shared/oval/sshd_allow_only_protocol2.xml
> index 7ae306c..c17d568 100644
> --- a/shared/oval/sshd_allow_only_protocol2.xml
> +++ b/shared/oval/sshd_allow_only_protocol2.xml
> @@ -7,7 +7,7 @@
> <platform>Red Hat Enterprise Linux 7</platform>
> </affected>
> <description>The OpenSSH daemon should be running protocol 2.</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140414" ref_url="test_attestation" />
> </metadata>
> <criteria comment="SSH is not being used or conditions are met" operator="OR">
> <extend_definition comment="sshd service is disabled"
> @@ -22,9 +22,9 @@
> comment="sshd uses protocol 2" id="test_sshd_allow_only_protocol2" version="1">
> <ind:object object_ref="object_sshd_allow_only_protocol2" />
> </ind:textfilecontent54_test>
> - <ind:textfilecontent54_object id="object_sshd_allow_only_protocol2" version="2">
> + <ind:textfilecontent54_object id="object_sshd_allow_only_protocol2" version="3">
> <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*(?:|(?:#.*))?$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
> </def-group>
> diff --git a/shared/oval/sshd_disable_empty_passwords.xml b/shared/oval/sshd_disable_empty_passwords.xml
> index 81032c7..b450afa 100644
> --- a/shared/oval/sshd_disable_empty_passwords.xml
> +++ b/shared/oval/sshd_disable_empty_passwords.xml
> @@ -8,7 +8,7 @@
> </affected>
> <description>Remote connections from accounts with empty passwords should
> be disabled (and dependencies are met)</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140414" ref_url="test_attestation" />
> </metadata>
> <criteria comment="SSH is not being used or conditions are met"
> operator="OR">
> @@ -24,9 +24,9 @@
> <ind:object object_ref="obj_sshd_permitemptypasswords_no" />
> </ind:textfilecontent54_test>
> <ind:textfilecontent54_object id="obj_sshd_permitemptypasswords_no"
> - version="1">
> + version="2">
> <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)PermitEmptyPasswords[\s]+no[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*(?i)PermitEmptyPasswords(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
> </def-group>
> diff --git a/shared/oval/sshd_disable_rhosts.xml b/shared/oval/sshd_disable_rhosts.xml
> index 62d9e44..cb59a1f 100644
> --- a/shared/oval/sshd_disable_rhosts.xml
> +++ b/shared/oval/sshd_disable_rhosts.xml
> @@ -8,7 +8,7 @@
> </affected>
> <description>Emulation of the rsh command through the ssh server should
> be disabled (and dependencies are met)</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140414" ref_url="test_attestation" />
> </metadata>
> <criteria comment="SSH is not being used or conditions are met"
> operator="OR">
> @@ -24,9 +24,9 @@
> <ind:object object_ref="obj_sshd_rsh_emulation_disabled" />
> </ind:textfilecontent54_test>
> <ind:textfilecontent54_object id="obj_sshd_rsh_emulation_disabled"
> - version="1">
> + version="2">
> <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)IgnoreRhosts[\s]+no[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*(?i)IgnoreRhosts(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
> </def-group>
> diff --git a/shared/oval/sshd_disable_root_login.xml b/shared/oval/sshd_disable_root_login.xml
> index 0547354..73c4906 100644
> --- a/shared/oval/sshd_disable_root_login.xml
> +++ b/shared/oval/sshd_disable_root_login.xml
> @@ -8,7 +8,7 @@
> </affected>
> <description>Root login via SSH should be disabled (and dependencies are
> met)</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140414" ref_url="test_attestation" />
> </metadata>
> <criteria comment="SSH is not being used or conditions are met"
> operator="OR">
> @@ -23,9 +23,9 @@
> id="test_sshd_permitrootlogin_no" version="1">
> <ind:object object_ref="obj_sshd_permitrootlogin_no" />
> </ind:textfilecontent54_test>
> - <ind:textfilecontent54_object id="obj_sshd_permitrootlogin_no" version="1">
> + <ind:textfilecontent54_object id="obj_sshd_permitrootlogin_no" version="2">
> <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)PermitRootLogin[\s]+yes[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*(?i)PermitRootLogin(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
> </def-group>
> diff --git a/shared/oval/sshd_do_not_permit_user_env.xml b/shared/oval/sshd_do_not_permit_user_env.xml
> index 1d12591..0a0dea1 100644
> --- a/shared/oval/sshd_do_not_permit_user_env.xml
> +++ b/shared/oval/sshd_do_not_permit_user_env.xml
> @@ -7,7 +7,7 @@
> <platform>Red Hat Enterprise Linux 7</platform>
> </affected>
> <description>PermitUserEnvironment should be disabled</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140414" ref_url="test_attestation" />
> </metadata>
> <criteria comment="SSH is not being used or conditions are met"
> operator="OR">
> @@ -22,9 +22,9 @@
> id="test_sshd_no_user_envset" version="1">
> <ind:object object_ref="obj_sshd_no_user_envset" />
> </ind:textfilecontent54_test>
> - <ind:textfilecontent54_object id="obj_sshd_no_user_envset" version="1">
> + <ind:textfilecontent54_object id="obj_sshd_no_user_envset" version="2">
> <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)PermitUserEnvironment[\s]+no[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*(?i)PermitUserEnvironment(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
> </def-group>
> diff --git a/shared/oval/sshd_enable_warning_banner.xml b/shared/oval/sshd_enable_warning_banner.xml
> index 656a644..0bd8d32 100644
> --- a/shared/oval/sshd_enable_warning_banner.xml
> +++ b/shared/oval/sshd_enable_warning_banner.xml
> @@ -8,7 +8,7 @@
> </affected>
> <description>SSH warning banner should be enabled (and dependencies are
> met)</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140414" ref_url="test_attestation" />
> </metadata>
> <criteria comment="SSH is not being used or conditions are met"
> operator="OR">
> @@ -23,9 +23,9 @@
> id="test_sshd_banner_set" version="1">
> <ind:object object_ref="obj_sshd_banner_set" />
> </ind:textfilecontent54_test>
> - <ind:textfilecontent54_object id="obj_sshd_banner_set" version="1">
> + <ind:textfilecontent54_object id="obj_sshd_banner_set" version="2">
> <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*(?:|(?:#.*))?$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
> </def-group>
> diff --git a/shared/oval/sshd_set_idle_timeout.xml b/shared/oval/sshd_set_idle_timeout.xml
> index f891e65..0ccfae8 100644
> --- a/shared/oval/sshd_set_idle_timeout.xml
> +++ b/shared/oval/sshd_set_idle_timeout.xml
> @@ -9,7 +9,7 @@
> </affected>
> <description>The SSH idle timeout interval should be set to an
> appropriate value.</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140414" ref_url="test_attestation" />
> <!-- Fedora 20: <reference source="JL" ref_id="20140224" ref_url="test_attestation" /> -->
> </metadata>
> <criteria comment="SSH is not being used or conditions are met"
> @@ -28,9 +28,9 @@
> <ind:state state_ref="state_timeout_value_lower_bound" />
> </ind:textfilecontent54_test>
>
> - <ind:textfilecontent54_object id="object_sshd_idle_timeout" version="1">
> + <ind:textfilecontent54_object id="object_sshd_idle_timeout" version="2">
> <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:|(?:#.*))?$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
>
> diff --git a/shared/oval/sshd_set_keepalive.xml b/shared/oval/sshd_set_keepalive.xml
> index 6e3bf7b..424be27 100644
> --- a/shared/oval/sshd_set_keepalive.xml
> +++ b/shared/oval/sshd_set_keepalive.xml
> @@ -8,7 +8,7 @@
> </affected>
> <description>The SSH ClientAliveCountMax should be set to an appropriate
> value (and dependencies are met)</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140414" ref_url="test_attestation" />
> </metadata>
> <criteria comment="SSH is not being used or conditions are met"
> operator="OR">
> @@ -27,9 +27,9 @@
> <ind:textfilecontent54_state id="state_sshd_clientalivecountmax" version="1">
> <ind:subexpression datatype="int" operation="equals">0</ind:subexpression>
> </ind:textfilecontent54_state>
> - <ind:textfilecontent54_object id="obj_sshd_clientalivecountmax" version="1">
> + <ind:textfilecontent54_object id="obj_sshd_clientalivecountmax" version="2">
> <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:|(?:#.*))?$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
> </def-group>
> diff --git a/shared/oval/sshd_use_approved_ciphers.xml b/shared/oval/sshd_use_approved_ciphers.xml
> index 04ef3e2..dd33785 100644
> --- a/shared/oval/sshd_use_approved_ciphers.xml
> +++ b/shared/oval/sshd_use_approved_ciphers.xml
> @@ -8,7 +8,7 @@
> </affected>
> <description>Limit the ciphers to those which are FIPS-approved and only
> use ciphers in counter (CTR) mode.</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + <reference source="JL" ref_id="20140414" ref_url="test_attestation" />
> </metadata>
> <criteria comment="SSH is not being used or conditions are met"
> operator="OR">
> @@ -23,9 +23,9 @@
> id="test_sshd_use_approved_ciphers" version="1">
> <ind:object object_ref="obj_sshd_use_approved_ciphers" />
> </ind:textfilecontent54_test>
> - <ind:textfilecontent54_object id="obj_sshd_use_approved_ciphers" version="1">
> + <ind:textfilecontent54_object id="obj_sshd_use_approved_ciphers" version="2">
> <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc[\s]*$</ind:pattern>
> + <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc[\s]*(?:|(?:#.*))?$</ind:pattern>
> <ind:instance datatype="int">1</ind:instance>
> </ind:textfilecontent54_object>
> </def-group>
> -- 1.8.3.1
Applied & tested on RHEL6.
Ack
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140414/1246f557/attachment-0001.html>
More information about the scap-security-guide
mailing list