[PATCH 01/01] - Replaced the sshd_* fix scripts by a 'Match' aware version - Linked all sshd_* to the shared fixes

Rui Pedro Bernardino rui-p-bernardino at telecom.pt
Wed May 28 15:09:58 UTC 2014


From: Rui Bernardino <rui-p-bernardino at telecom.pt>


Signed-off-by: Rui Bernardino <rui-p-bernardino at telecom.pt>
---
 Fedora/input/fixes/bash/sshd_disable_rhosts.sh     |    1 +
 .../fixes/bash/sshd_do_not_permit_user_env.sh      |    1 +
 .../input/fixes/bash/sshd_enable_warning_banner.sh |    1 +
 .../input/fixes/bash/sshd_use_approved_ciphers.sh  |    1 +
 shared/fixes/bash/sshd_disable_rhosts.sh           |   59 ++++++++++++++++++++
 shared/fixes/bash/sshd_do_not_permit_user_env.sh   |   59 ++++++++++++++++++++
 shared/fixes/bash/sshd_enable_warning_banner.sh    |   59 ++++++++++++++++++++
 shared/fixes/bash/sshd_use_approved_ciphers.sh     |   59 ++++++++++++++++++++
 8 files changed, 240 insertions(+), 0 deletions(-)  create mode 120000 Fedora/input/fixes/bash/sshd_disable_rhosts.sh
 create mode 120000 Fedora/input/fixes/bash/sshd_do_not_permit_user_env.sh
 create mode 120000 Fedora/input/fixes/bash/sshd_enable_warning_banner.sh
 create mode 120000 Fedora/input/fixes/bash/sshd_use_approved_ciphers.sh
 create mode 100755 shared/fixes/bash/sshd_disable_rhosts.sh
 create mode 100755 shared/fixes/bash/sshd_do_not_permit_user_env.sh
 create mode 100755 shared/fixes/bash/sshd_enable_warning_banner.sh
 create mode 100755 shared/fixes/bash/sshd_use_approved_ciphers.sh

diff --git a/Fedora/input/fixes/bash/sshd_disable_rhosts.sh b/Fedora/input/fixes/bash/sshd_disable_rhosts.sh
new file mode 120000
index 0000000..94579fe
--- /dev/null
+++ b/Fedora/input/fixes/bash/sshd_disable_rhosts.sh
@@ -0,0 +1 @@
+../../../../shared/fixes/bash/sshd_disable_rhosts.sh
\ No newline at end of file
diff --git a/Fedora/input/fixes/bash/sshd_do_not_permit_user_env.sh b/Fedora/input/fixes/bash/sshd_do_not_permit_user_env.sh
new file mode 120000
index 0000000..1e39646
--- /dev/null
+++ b/Fedora/input/fixes/bash/sshd_do_not_permit_user_env.sh
@@ -0,0 +1 @@
+../../../../shared/fixes/bash/sshd_do_not_permit_user_env.sh
\ No newline at end of file
diff --git a/Fedora/input/fixes/bash/sshd_enable_warning_banner.sh b/Fedora/input/fixes/bash/sshd_enable_warning_banner.sh
new file mode 120000
index 0000000..a7707eb
--- /dev/null
+++ b/Fedora/input/fixes/bash/sshd_enable_warning_banner.sh
@@ -0,0 +1 @@
+../../../../shared/fixes/bash/sshd_enable_warning_banner.sh
\ No newline at end of file
diff --git a/Fedora/input/fixes/bash/sshd_use_approved_ciphers.sh b/Fedora/input/fixes/bash/sshd_use_approved_ciphers.sh
new file mode 120000
index 0000000..dfec454
--- /dev/null
+++ b/Fedora/input/fixes/bash/sshd_use_approved_ciphers.sh
@@ -0,0 +1 @@
+../../../../shared/fixes/bash/sshd_use_approved_ciphers.sh
\ No newline at end of file
diff --git a/shared/fixes/bash/sshd_disable_rhosts.sh b/shared/fixes/bash/sshd_disable_rhosts.sh
new file mode 100755
index 0000000..6b96186
--- /dev/null
+++ b/shared/fixes/bash/sshd_disable_rhosts.sh
@@ -0,0 +1,59 @@
+#!/bin/bash -x
+
+#SSHD_CONFIG='/etc/ssh/sshd_config'
+SSHD_CONFIG='sshd_config'
+TOKEN='IgnoreRhosts'
+VALUE='yes'
+
+# Obtain line number of first uncommented case-insensitive occurrence 
+of Match # block directive (possibly prefixed with whitespace) present 
+in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n 
+'/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG)
+
+# Obtain line number of first uncommented case-insensitive occurence of 
+# Banner directive (possibly prefixed with whitespace) present in # 
+$SSHD_CONFIG FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" 
+$SSHD_CONFIG)
+
+# Case: Match block directive not present in $SSHD_CONFIG if [ -z 
+"$FIRST_MATCH_BLOCK" ] then
+
+    # Case: Banner directive not present in $SSHD_CONFIG yet
+    if [ -z "$FIRST_TOKEN" ]
+    then
+        # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG
+        echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG already
+    else
+        # Replace first uncommented case-insensitive occurrence
+        # of Banner directive
+        sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN $VALUE|I" $SSHD_CONFIG
+    fi
+
+# Case: Match block directive present in $SSHD_CONFIG else
+
+    # Case: Banner directive not present in $SSHD_CONFIG yet
+    if [ -z "$FIRST_TOKEN" ]
+    then
+        # Prepend 'TOKEN VALUE' before first uncommented
+        # case-insensitive occurrence of Match block directive
+        sed -i "$FIRST_MATCH_BLOCK 
+ s|^\([[:space:]]*Match[^\n]*\)|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG and placed
+    #       before first Match block directive
+    elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ]
+    then
+        # Replace first uncommented case-insensitive occurrence
+        # of Banner directive
+        sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN 
+ $VALUE|I" $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG and placed
+    # after first Match block directive
+    else
+         # Prepend 'TOKEN VALUE' before first uncommented
+         # case-insensitive occurrence of Match block directive
+         sed -i "$FIRST_MATCH_BLOCK s|^\([[:space:]]*Match[^\n]*\)|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG
+    fi
+fi
diff --git a/shared/fixes/bash/sshd_do_not_permit_user_env.sh b/shared/fixes/bash/sshd_do_not_permit_user_env.sh
new file mode 100755
index 0000000..2079622
--- /dev/null
+++ b/shared/fixes/bash/sshd_do_not_permit_user_env.sh
@@ -0,0 +1,59 @@
+#!/bin/bash -x
+
+#SSHD_CONFIG='/etc/ssh/sshd_config'
+SSHD_CONFIG='sshd_config'
+TOKEN='PermitUserEnvironment'
+VALUE='no'
+
+# Obtain line number of first uncommented case-insensitive occurrence 
+of Match # block directive (possibly prefixed with whitespace) present 
+in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n 
+'/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG)
+
+# Obtain line number of first uncommented case-insensitive occurence of 
+# Banner directive (possibly prefixed with whitespace) present in # 
+$SSHD_CONFIG FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" 
+$SSHD_CONFIG)
+
+# Case: Match block directive not present in $SSHD_CONFIG if [ -z 
+"$FIRST_MATCH_BLOCK" ] then
+
+    # Case: Banner directive not present in $SSHD_CONFIG yet
+    if [ -z "$FIRST_TOKEN" ]
+    then
+        # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG
+        echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG already
+    else
+        # Replace first uncommented case-insensitive occurrence
+        # of Banner directive
+        sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN $VALUE|I" $SSHD_CONFIG
+    fi
+
+# Case: Match block directive present in $SSHD_CONFIG else
+
+    # Case: Banner directive not present in $SSHD_CONFIG yet
+    if [ -z "$FIRST_TOKEN" ]
+    then
+        # Prepend 'TOKEN VALUE' before first uncommented
+        # case-insensitive occurrence of Match block directive
+        sed -i "$FIRST_MATCH_BLOCK 
+ s|^\([[:space:]]*Match[^\n]*\)|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG and placed
+    #       before first Match block directive
+    elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ]
+    then
+        # Replace first uncommented case-insensitive occurrence
+        # of Banner directive
+        sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN 
+ $VALUE|I" $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG and placed
+    # after first Match block directive
+    else
+         # Prepend 'TOKEN VALUE' before first uncommented
+         # case-insensitive occurrence of Match block directive
+         sed -i "$FIRST_MATCH_BLOCK s|^\([[:space:]]*Match[^\n]*\)|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG
+    fi
+fi
diff --git a/shared/fixes/bash/sshd_enable_warning_banner.sh b/shared/fixes/bash/sshd_enable_warning_banner.sh
new file mode 100755
index 0000000..1444bc2
--- /dev/null
+++ b/shared/fixes/bash/sshd_enable_warning_banner.sh
@@ -0,0 +1,59 @@
+#!/bin/bash -x
+
+#SSHD_CONFIG='/etc/ssh/sshd_config'
+SSHD_CONFIG='sshd_config'
+TOKEN='Banner'
+VALUE='/etc/issue'
+
+# Obtain line number of first uncommented case-insensitive occurrence 
+of Match # block directive (possibly prefixed with whitespace) present 
+in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n 
+'/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG)
+
+# Obtain line number of first uncommented case-insensitive occurence of 
+# Banner directive (possibly prefixed with whitespace) present in # 
+$SSHD_CONFIG FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" 
+$SSHD_CONFIG)
+
+# Case: Match block directive not present in $SSHD_CONFIG if [ -z 
+"$FIRST_MATCH_BLOCK" ] then
+
+    # Case: Banner directive not present in $SSHD_CONFIG yet
+    if [ -z "$FIRST_TOKEN" ]
+    then
+        # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG
+        echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG already
+    else
+        # Replace first uncommented case-insensitive occurrence
+        # of Banner directive
+        sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN $VALUE|I" $SSHD_CONFIG
+    fi
+
+# Case: Match block directive present in $SSHD_CONFIG else
+
+    # Case: Banner directive not present in $SSHD_CONFIG yet
+    if [ -z "$FIRST_TOKEN" ]
+    then
+        # Prepend 'TOKEN VALUE' before first uncommented
+        # case-insensitive occurrence of Match block directive
+        sed -i "$FIRST_MATCH_BLOCK 
+ s|^\([[:space:]]*Match[^\n]*\)|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG and placed
+    #       before first Match block directive
+    elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ]
+    then
+        # Replace first uncommented case-insensitive occurrence
+        # of Banner directive
+        sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN 
+ $VALUE|I" $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG and placed
+    # after first Match block directive
+    else
+         # Prepend 'TOKEN VALUE' before first uncommented
+         # case-insensitive occurrence of Match block directive
+         sed -i "$FIRST_MATCH_BLOCK s|^\([[:space:]]*Match[^\n]*\)|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG
+    fi
+fi
diff --git a/shared/fixes/bash/sshd_use_approved_ciphers.sh b/shared/fixes/bash/sshd_use_approved_ciphers.sh
new file mode 100755
index 0000000..2e720be
--- /dev/null
+++ b/shared/fixes/bash/sshd_use_approved_ciphers.sh
@@ -0,0 +1,59 @@
+#!/bin/bash -x
+
+#SSHD_CONFIG='/etc/ssh/sshd_config'
+SSHD_CONFIG='sshd_config'
+TOKEN='Ciphers'
+VALUE='aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc'
+
+# Obtain line number of first uncommented case-insensitive occurrence 
+of Match # block directive (possibly prefixed with whitespace) present 
+in $SSHD_CONFIG FIRST_MATCH_BLOCK=$(sed -n 
+'/^[[:space:]]*Match[^\n]*/I{=;q}' $SSHD_CONFIG)
+
+# Obtain line number of first uncommented case-insensitive occurence of 
+# Banner directive (possibly prefixed with whitespace) present in # 
+$SSHD_CONFIG FIRST_TOKEN=$(sed -n "\|^[[:space:]]*$TOKEN[^\n]*|I{=;q}" 
+$SSHD_CONFIG)
+
+# Case: Match block directive not present in $SSHD_CONFIG if [ -z 
+"$FIRST_MATCH_BLOCK" ] then
+
+    # Case: Banner directive not present in $SSHD_CONFIG yet
+    if [ -z "$FIRST_TOKEN" ]
+    then
+        # Append 'TOKEN VALUE' at the end of $SSHD_CONFIG
+        echo -e "\n$TOKEN $VALUE" >> $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG already
+    else
+        # Replace first uncommented case-insensitive occurrence
+        # of Banner directive
+        sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN $VALUE|I" $SSHD_CONFIG
+    fi
+
+# Case: Match block directive present in $SSHD_CONFIG else
+
+    # Case: Banner directive not present in $SSHD_CONFIG yet
+    if [ -z "$FIRST_TOKEN" ]
+    then
+        # Prepend 'TOKEN VALUE' before first uncommented
+        # case-insensitive occurrence of Match block directive
+        sed -i "$FIRST_MATCH_BLOCK 
+ s|^\([[:space:]]*Match[^\n]*\)|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG and placed
+    #       before first Match block directive
+    elif [ "$FIRST_TOKEN" -lt "$FIRST_MATCH_BLOCK" ]
+    then
+        # Replace first uncommented case-insensitive occurrence
+        # of Banner directive
+        sed -i "$FIRST_TOKEN s|^[[:space:]]*${TOKEN}.*$|$TOKEN 
+ $VALUE|I" $SSHD_CONFIG
+
+    # Case: Banner directive present in $SSHD_CONFIG and placed
+    # after first Match block directive
+    else
+         # Prepend 'TOKEN VALUE' before first uncommented
+         # case-insensitive occurrence of Match block directive
+         sed -i "$FIRST_MATCH_BLOCK s|^\([[:space:]]*Match[^\n]*\)|$TOKEN $VALUE\n\1|I" $SSHD_CONFIG
+    fi
+fi
--
1.7.1



More information about the scap-security-guide mailing list