RHEL6 SSG Bug (SSH,Ciphers)

Lesley Kimmel ljkimmel99 at hotmail.com
Wed Jun 10 22:14:56 UTC 2015


All;

I ran into a bug in the latest SSG for RHEL6 (0.1.21-2). There is definitely 
an issue with the check for approved Ciphers. Initially the check passed 
with no entry at all for Ciphers. I then placed a Cipher line with (1) valid 
cipher: pass. Finally I put an entry in sshd_config with a bogus cipher: 
passed. I just ran into this at the end of my workday today so I didn't get 
much of a chance to analyze it. Plus I'm really just starting to dig into 
the 'innards' of the content so I don't fully realize the connections of all 
the various sections (rule/def/tst/obj/ste). I'm also pretty sure that some 
of the other checks against sshd_config are off. The check for 
'PermitRootLogin no' passed even though the file contains '#PermitRootLogin 
yes' and typically the checks are looking for the presence of the target 
string, not the absence of it.

Any input would be appreciated.

Thanks,

Les Kimmel
Systems Engineer, CSC 



More information about the scap-security-guide mailing list