<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/3/13 10:08 AM, Rui Pedro
      Bernardino wrote:<br>
    </div>
    <blockquote
cite="mid:B0F8BA03CBE85346A2A4A48A2A9365D401EA7422E4AB@INOAVREX11.ptin.corpPT.com"
      type="cite">
      <pre wrap="">Hi all,

The remediation won't work if it appends the new option to the end of file AND there are 'Match' rules (from sshd_config's: "If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file."). 

Although commented, 'Match' rules are in the default sshd_config.

For example, for "sshd_enable_warning_banner.sh", my suggestion would be:
==================================
grep -q ^Banner /etc/ssh/sshd_config &amp;&amp; \
  sed -i "s/Banner.*/Banner \/etc\/issue/g" /etc/ssh/sshd_config
if ! [ $? -eq 0 ]; then
    ed -s /etc/ssh/sshd_config &lt;&lt;'EOF'
<i class="moz-txt-slash"><span class="moz-txt-tag">/</span>Match<span class="moz-txt-tag">/</span></i>
?^[A-Z]?
+
i
Banner /etc/issue
.
w
q
EOF
fi
==================================
This will add a new line, after the last keyword before the first 'Match' block (including comments). I'm ashamed to say I couldn't do it with 'sed' <span class="moz-smiley-s2" title=":("><span>:(</span></span>

Does it sound reasonable?
</pre>
    </blockquote>
    <br>
    This situation *should* be taken care of. Are you experiencing
    something different than the situation below?<br>
    <br>
    1) Testing file with no Banner value set:<br>
    <blockquote type="cite">[shawn@SSG-RHEL6 checks]$ sudo grep Banner
      /etc/ssh/sshd_config <br>
      #Banner none<br>
      <br>
      [shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py
      sshd_enable_warning_banner.xml <br>
      Evaluating with OVAL tempfile :
      /tmp/sshd_enable_warning_bannerzkgnCU.xml<br>
      Writing results to :
      /tmp/sshd_enable_warning_bannerzkgnCU.xml-results<br>
      Definition oval:scap-security-guide.testing:def:129: false<br>
      Definition oval:scap-security-guide.testing:def:127: false<br>
      Definition oval:scap-security-guide.testing:def:126: false<br>
      Evaluation done.<br>
      <br>
      [shawn@SSG-RHEL6 checks]$ sudo bash
      ../fixes/bash/sshd_enable_warning_banner.sh <br>
      [shawn@SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config <br>
      #Banner none<br>
      Banner /etc/issue<br>
      <br>
      [shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py
      sshd_enable_warning_banner.xml <br>
      Evaluating with OVAL tempfile :
      /tmp/sshd_enable_warning_banner43kR1V.xml<br>
      Writing results to :
      /tmp/sshd_enable_warning_banner43kR1V.xml-results<br>
      Definition oval:scap-security-guide.testing:def:129: false<br>
      Definition oval:scap-security-guide.testing:def:127: false<br>
      Definition oval:scap-security-guide.testing:def:126: true<br>
      Evaluation done.<br>
    </blockquote>
    <br>
    2) Testing if incorrect Banner value set<br>
    <blockquote type="cite">[shawn@SSG-RHEL6 checks]$ sudo grep Banner
      /etc/ssh/sshd_config <br>
      #Banner none<br>
      Banner /totally/wrong/path<br>
      <br>
      [shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py
      sshd_enable_warning_banner.xml <br>
      Evaluating with OVAL tempfile :
      /tmp/sshd_enable_warning_banneryFifQw.xml<br>
      Writing results to :
      /tmp/sshd_enable_warning_banneryFifQw.xml-results<br>
      Definition oval:scap-security-guide.testing:def:129: false<br>
      Definition oval:scap-security-guide.testing:def:127: false<br>
      Definition oval:scap-security-guide.testing:def:126: false<br>
      Evaluation done.<br>
      <br>
      [shawn@SSG-RHEL6 checks]$ sudo bash
      ../fixes/bash/sshd_enable_warning_banner.sh <br>
      [shawn@SSG-RHEL6 checks]$ sudo grep Banner /etc/ssh/sshd_config <br>
      #Banner /etc/issue<br>
      Banner /etc/issue<br>
      <br>
      [shawn@SSG-RHEL6 checks]$ sudo ./testcheck.py
      sshd_enable_warning_banner.xml <br>
      Evaluating with OVAL tempfile :
      /tmp/sshd_enable_warning_bannervMyGwb.xml<br>
      Writing results to :
      /tmp/sshd_enable_warning_bannervMyGwb.xml-results<br>
      Definition oval:scap-security-guide.testing:def:129: false<br>
      Definition oval:scap-security-guide.testing:def:127: false<br>
      Definition oval:scap-security-guide.testing:def:126: true<br>
      Evaluation done.</blockquote>
    <br>
    <br>
    <br>
    <br>
    <br>
    <br>
    <br>
  </body>
</html>