<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<blockquote
cite="mid:CACv9p5pM34vb86Zz6m2843DfbaTTC9JktJjG+crtSM8y2bAAZg@mail.gmail.com"
type="cite">
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<blockquote type="cite">
<div dir="ltr">
<blockquote>
<div>240 /etc/ssh/sshd_config Banner<br>
</div>
The OVAL check was definitely working on my system
when I last tested it. I'm able to reproduce...<br>
<br>
[root@rhel6 checks]# cat /etc/issue<br>
You are accessing a U.S. Government (USG)
Information System (IS) that is provided for
USG-authorized use only. By using this IS (which
includes any device attached to this IS), you
consent to the following conditions: <br>
-The USG routinely intercepts and monitors
communications on this IS for purposes including,
but not limited to, penetration testing, COMSEC
monitoring, network operations and defense,
personnel misconduct (PM), law enforcement (LE), and
counterintelligence (CI) investigations. <br>
-At any time, the USG may inspect and seize data
stored on this IS. <br>
-Communications using, or data stored on, this IS
are not private, are subject to routine monitoring,
interception, and search, and may be disclosed or
used for any USG-authorized purpose. <br>
-This IS includes security measures (e.g.,
authentication and access controls) to protect USG
interests -- not for your personal benefit or
privacy. <br>
-Notwithstanding the above, using this IS does not
constitute consent to PM, LE or CI investigative
searching or monitoring of the content of privileged
communications, or work product, related to personal
representation or services by attorneys,
psychotherapists, or clergy, and their assistants.
Such communications and work product are private and
confidential. See User Agreement for details.<br>
<br>
[root@rhel6 checks]# ./testcheck.py
sshd_banner_set.xml <br>
Evaluating with OVAL tempfile :
/tmp/sshd_banner_setXKCJxI.xml<br>
Writing results to :
/tmp/sshd_banner_setXKCJxI.xml-results<br>
Definition oval:scap-security-guide.testing:def:193:
false<br>
Definition oval:scap-security-guide.testing:def:191:
false<br>
Definition oval:scap-security-guide.testing:def:190:
false<br>
Evaluation done.<br>
<br>
Maura, do you want to take a stab at this (noticed
your signoff on the OVAL)?<br>
<br>
FWIW, if I used the USGCB banner everything worked
OK.<br>
<br>
</blockquote>
</div>
</blockquote>
</div>
</blockquote>
</div>
</div>
</blockquote>
<br>
The ONLY thing the check is doing is checking that the line 'Banner
/etc/issue' exists in /etc/ssh/sshd_config or that sshd is disabled.
It doesn't care about the content of /etc/issue at all. I have no
idea why it's failing for both of you guys. Full check is below my
signature for comparison.<br>
<br>
- Maura Dailey<br>
<br>
<def-group><br>
<definition class="compliance" id="sshd_banner_set"
version="1"><br>
<metadata><br>
<title>Enable a Warning Banner</title><br>
<affected family="unix"><br>
<platform>Red Hat Enterprise Linux 6</platform><br>
</affected><br>
<description>SSH warning banner should be enabled (and
dependencies are<br>
met)</description><br>
<reference source="MED" ref_id="20130813"
ref_url="test_attestation" /><br>
</metadata><br>
<criteria comment="SSH is not being used or conditions are
met"<br>
operator="OR"><br>
<extend_definition comment="sshd service is disabled"<br>
definition_ref="service_sshd_disabled" /><br>
<criterion comment="Check Banner in /etc/ssh/sshd_config"<br>
test_ref="test_sshd_banner_set" /><br>
</criteria><br>
</definition><br>
<ind:textfilecontent54_test check="all"
check_existence="all_exist"<br>
comment="Tests the value of the Banner[\s]+/etc/issue setting in
the /etc/ssh/sshd_config file"<br>
id="test_sshd_banner_set" version="1"><br>
<ind:object object_ref="obj_sshd_banner_set" /><br>
</ind:textfilecontent54_test><br>
<ind:textfilecontent54_object id="obj_sshd_banner_set"
version="1"><br>
<ind:path>/etc/ssh</ind:path><br>
<ind:filename>sshd_config</ind:filename><br>
<ind:pattern operation="pattern
match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*$</ind:pattern><br>
<ind:instance datatype="int">1</ind:instance><br>
</ind:textfilecontent54_object><br>
</def-group><br>
</body>
</html>