[PATCH 01/10] Added sshd_set_idle_timeout to shared/ + RHEL7
Shawn Wells
shawn at redhat.com
Tue Jan 28 03:24:47 UTC 2014
On 1/27/14, 11:00 AM, Shawn Wells wrote:
>
> 0001-Added-sshd_set_idle_timeout-to-shared-RHEL7.patch
>
>
> From 8d42270022be11ee84d128dd4eec54cd37a1612c Mon Sep 17 00:00:00 2001
> From: Shawn Wells<shawn at redhat.com>
> Date: Thu, 23 Jan 2014 00:54:35 -0500
> Subject: [PATCH 01/10] Added sshd_set_idle_timeout to shared/ + RHEL7
>
> - Moved sshd_set_idle_timeout.xml to shared/, tested on RHEL7, updated CPE info
> - Added to RHEL7 rht-ccp profile
> ---
> RHEL/6/input/checks/sshd_set_idle_timeout.xml | 38 +--------------------------
> RHEL/7/input/checks/sshd_set_idle_timeout.xml | 1 +
> RHEL/7/input/profiles/rht-ccp.xml | 11 +++++---
> scap-security-guide.spec | 6 ++++-
> shared/oval/sshd_set_idle_timeout.xml | 38 +++++++++++++++++++++++++++
> 5 files changed, 52 insertions(+), 42 deletions(-)
> mode change 100644 => 120000 RHEL/6/input/checks/sshd_set_idle_timeout.xml
> create mode 120000 RHEL/7/input/checks/sshd_set_idle_timeout.xml
> create mode 100644 shared/oval/sshd_set_idle_timeout.xml
>
> diff --git a/RHEL/6/input/checks/sshd_set_idle_timeout.xml b/RHEL/6/input/checks/sshd_set_idle_timeout.xml
> deleted file mode 100644
> index 5183876..0000000
> --- a/RHEL/6/input/checks/sshd_set_idle_timeout.xml
> +++ /dev/null
> @@ -1,37 +0,0 @@
> -<def-group>
> - <definition class="compliance" id="sshd_set_idle_timeout" version="1">
> - <metadata>
> - <title>Set OpenSSH Idle Timeout Interval</title>
> - <affected family="unix">
> - <platform>Red Hat Enterprise Linux 6</platform>
> - </affected>
> - <description>The SSH idle timeout interval should be set to an
> - appropriate value.</description>
> - <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> - </metadata>
> - <criteria comment="SSH is not being used or conditions are met"
> - operator="OR">
> - <extend_definition comment="sshd service is disabled"
> - definition_ref="service_sshd_disabled" />
> - <criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config"
> - test_ref="test_sshd_idle_timeout" />
> - </criteria>
> - </definition>
> - <ind:textfilecontent54_test check="all" check_existence="all_exist"
> - comment="timeout is configured" id="test_sshd_idle_timeout" version="1">
> - <ind:object object_ref="object_sshd_idle_timeout" />
> - <ind:state state_ref="state_timeout_value" />
> - </ind:textfilecontent54_test>
> - <ind:textfilecontent54_object id="object_sshd_idle_timeout" version="1">
> - <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> - <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*$</ind:pattern>
> - <ind:instance datatype="int">1</ind:instance>
> - </ind:textfilecontent54_object>
> - <ind:textfilecontent54_state comment="ClientAliveInterval in seconds"
> - id="state_timeout_value" version="1">
> - <ind:subexpression datatype="int" operation="less than or equal" var_check="all"
> - var_ref="sshd_idle_timeout_value" />
> - </ind:textfilecontent54_state>
> - <external_variable comment="timeout value" datatype="int"
> - id="sshd_idle_timeout_value" version="1" />
> -</def-group>
> diff --git a/RHEL/6/input/checks/sshd_set_idle_timeout.xml b/RHEL/6/input/checks/sshd_set_idle_timeout.xml
> new file mode 120000
> index 0000000..2e9bd9a
> --- /dev/null
> +++ b/RHEL/6/input/checks/sshd_set_idle_timeout.xml
> @@ -0,0 +1 @@
> +../../../../shared/oval/sshd_set_idle_timeout.xml
> \ No newline at end of file
> diff --git a/RHEL/7/input/checks/sshd_set_idle_timeout.xml b/RHEL/7/input/checks/sshd_set_idle_timeout.xml
> new file mode 120000
> index 0000000..2e9bd9a
> --- /dev/null
> +++ b/RHEL/7/input/checks/sshd_set_idle_timeout.xml
> @@ -0,0 +1 @@
> +../../../../shared/oval/sshd_set_idle_timeout.xml
> \ No newline at end of file
> diff --git a/RHEL/7/input/profiles/rht-ccp.xml b/RHEL/7/input/profiles/rht-ccp.xml
> index 7bf1318..02dcbd1 100644
> --- a/RHEL/7/input/profiles/rht-ccp.xml
> +++ b/RHEL/7/input/profiles/rht-ccp.xml
> @@ -80,10 +80,11 @@
> <select idref="file_ownership_library_dirs" selected="true"/>
> <select idref="file_permissions_binary_dirs" selected="true"/>
> <select idref="file_ownership_binary_dirs" selected="true"/>
> -<!-- these need to be updated
> - for RHEL7
> <select idref="file_permissions_var_log_audit" selected="true"/>
> -<select idref="user_owner_grub_conf" selected="true"/>
> +
> +<!-- These checks need to be updated for RHEL7,
> + specifically new locations of grub
> +<select idref="user_owner_grub_conf" selected="true"/>
> <select idref="group_owner_grub_conf" selected="true"/>
> <select idref="permissions_grub_conf" selected="true"/>
> <select idref="bootloader_password" selected="true"/> -->
> @@ -123,8 +124,10 @@ ANTIQUATED SERVICES
> <select idref="service_rdisc_disabled" selected="true"/>
>
> SSH / REMOTE ACCESS CHECKS
> -<select idref="sshd_allow_only_protocol2" selected="true"/>
> +<select idref="sshd_allow_only_protocol2" selected="true"/> -->
> <select idref="sshd_set_idle_timeout" selected="true"/>
> +
> +<!--
> <select idref="sshd_set_keepalive" selected="true"/>
> <select idref="sshd_disable_rhosts" selected="true"/>
> <select idref="disable_host_auth" selected="true"/>
> diff --git a/scap-security-guide.spec b/scap-security-guide.spec
> index 7925b6e..c93b8be 100644
> --- a/scap-security-guide.spec
> +++ b/scap-security-guide.spec
> @@ -1,4 +1,4 @@
> -%global redhatssgrelease 16.rc2
> +%global redhatssgrelease 16.rc3
>
> Name: scap-security-guide
> Version: 0.1
> @@ -53,6 +53,10 @@ cp -a RHEL/6/input/auxiliary/scap-security-guide.8 %{buildroot}%{_mandir}/en/man
> %doc RHEL/6/LICENSE RHEL/6/output/rhel6-guide.html RHEL/6/output/table-rhel6-cces.html RHEL/6/output/table-rhel6-nistrefs-common.html RHEL/6/output/table-rhel6-nistrefs.html RHEL/6/output/table-rhel6-srgmap-flat.html RHEL/6/output/table-rhel6-srgmap-flat.xhtml RHEL/6/output/table-rhel6-srgmap.html RHEL/6/output/table-rhel6-stig.html JBossEAP5/docs/JBossEAP5_Guide.html
>
> %changelog
> +* Thu Jan 23 2014 Shawn Wells<shawn at redhat.com> 0.1-16.rc3
> ++ Added to RHEL7 content pool
> +- OVAL for sshd_set_idle_timeout
> +
> * Tue Dec 24 2013 Shawn Wells<shawn at redhat.com> 0.1-16.rc2
> + RHEL6 stig-rhel6-server XCCDF profile renamed to stig-rhel6-server-upstream
>
> diff --git a/shared/oval/sshd_set_idle_timeout.xml b/shared/oval/sshd_set_idle_timeout.xml
> new file mode 100644
> index 0000000..ad63830
> --- /dev/null
> +++ b/shared/oval/sshd_set_idle_timeout.xml
> @@ -0,0 +1,38 @@
> +<def-group>
> + <definition class="compliance" id="sshd_set_idle_timeout" version="1">
> + <metadata>
> + <title>Set OpenSSH Idle Timeout Interval</title>
> + <affected family="unix">
> + <platform>Red Hat Enterprise Linux 6</platform>
> + <platform>Red Hat Enterprise Linux 7</platform>
> + </affected>
> + <description>The SSH idle timeout interval should be set to an
> + appropriate value.</description>
> + <reference source="MED" ref_id="20130813" ref_url="test_attestation" />
> + </metadata>
> + <criteria comment="SSH is not being used or conditions are met"
> + operator="OR">
> + <extend_definition comment="sshd service is disabled"
> + definition_ref="service_sshd_disabled" />
> + <criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config"
> + test_ref="test_sshd_idle_timeout" />
> + </criteria>
> + </definition>
> + <ind:textfilecontent54_test check="all" check_existence="all_exist"
> + comment="timeout is configured" id="test_sshd_idle_timeout" version="1">
> + <ind:object object_ref="object_sshd_idle_timeout" />
> + <ind:state state_ref="state_timeout_value" />
> + </ind:textfilecontent54_test>
> + <ind:textfilecontent54_object id="object_sshd_idle_timeout" version="1">
> + <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
> + <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*$</ind:pattern>
> + <ind:instance datatype="int">1</ind:instance>
> + </ind:textfilecontent54_object>
> + <ind:textfilecontent54_state comment="ClientAliveInterval in seconds"
> + id="state_timeout_value" version="1">
> + <ind:subexpression datatype="int" operation="less than or equal" var_check="all"
> + var_ref="sshd_idle_timeout_value" />
> + </ind:textfilecontent54_state>
> + <external_variable comment="timeout value" datatype="int"
> + id="sshd_idle_timeout_value" version="1" />
> +</def-group>
> -- 1.8.3.1
Pushing set per ack from Dave (he doesn't have email atm, only chat)
--
Shawn Wells
Director, Innovation Programs
shawn at redhat.com | 443.534.0130
@shawndwells
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140127/b7730ce2/attachment-0001.html>
More information about the scap-security-guide
mailing list