<div dir="ltr">Got it. So if the default behavior is disabled, then the scan passes. Ignore this patch and the disable_rhosts patch then.<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Aug 5, 2014 at 12:27 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000"><div class="">
    <br>
    <div>On 8/5/14, 9:35 AM, Gabe Alford wrote:<br>
    </div>
    <blockquote type="cite">
      <div lang="x-unicode">
        <div dir="ltr">
          <div>
            <div>
              <div>Hi Shawn,<br>
                <br>
              </div>
              At least on RHEL6.5 if I run the scap scan (using oscap)
              with the scap-security-guide without configuring
              sshd_config at all, the scan tells me that I pass the
              &#39;Disable Host-Based Authentication&#39; when in fact it is not
              configured. Same thing goes for the other ignoring rhosts,
              and disabling root login checks.<br>
              <br>
            </div>
            Thanks,<br>
            <br>
          </div>
          Gabe<br>
        </div>
      </div>
    </blockquote>
    <br></div>
    Ah, yes, this is expected. The default for HostbasedAuthentication
    is disabled, so the absence of explicit &quot;HostbasedAuthentication no&quot;
    is still a pass.<br>
    <br>
    Ref manpage @ <a href="http://rc.quest.com/man.php?id=sshd_config(5)" target="_blank">http://rc.quest.com/man.php?id=sshd_config(5)</a> (do a
    find on &quot;HostbasedAuthentication&quot;)<div><div class="h5"><br>
    <br>
    <br>
    <blockquote type="cite">
      <div lang="x-unicode">
        <div class="gmail_extra"><br>
          <br>
          <div class="gmail_quote">On Fri, Aug 1, 2014 at 2:10 PM, Shawn
            Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span>
            wrote:<br>
            <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
              <div>
                <div><br>
                  On 7/29/14, 8:43 PM, Gabe wrote:<br>
                  <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
                    - fix false positive for SSH host-based
                    authentication check in sshd_config<br>
                    <br>
                    Signed-off-by: Gabe &lt;<a href="mailto:redhatrises@gmail.com" target="_blank">redhatrises@gmail.com</a>&gt;<br>
                    ---<br>
                      shared/oval/disable_host_auth.xml | 4 ++--<br>
                      1 file changed, 2 insertions(+), 2 deletions(-)<br>
                    <br>
                    diff --git a/shared/oval/disable_host_auth.xml
                    b/shared/oval/disable_host_auth.xml<br>
                    index 6f4eb9d..de51fd7 100644<br>
                    --- a/shared/oval/disable_host_auth.xml<br>
                    +++ b/shared/oval/disable_host_auth.xml<br>
                    @@ -14,7 +14,7 @@<br>
                            &lt;extend_definition comment=&quot;sshd service
                    is disabled&quot;<br>
                            definition_ref=&quot;service_sshd_disabled&quot; /&gt;<br>
                            &lt;criterion comment=&quot;Check
                    HostbasedAuthentication in /etc/ssh/sshd_config&quot;<br>
                    -      test_ref=&quot;test_sshd_hostbasedauthentication&quot;
                    /&gt;<br>
                    +      negate=&quot;true&quot; test_ref=&quot;test_sshd_hostbasedauthentication&quot;
                    /&gt;<br>
                          &lt;/criteria&gt;<br>
                        &lt;/definition&gt;<br>
                        &lt;ind:textfilecontent54_test check=&quot;all&quot;
                    check_existence=&quot;none_exist&quot;<br>
                    @@ -24,7 +24,7 @@<br>
                        &lt;/ind:textfilecontent54_test&gt;<br>
                        &lt;ind:textfilecontent54_object
                    id=&quot;object_sshd_hostbasedauthentication&quot;
                    version=&quot;2&quot;&gt;<br>
                          &lt;ind:filepath&gt;/etc/ssh/sshd_config&lt;/ind:filepath&gt;<br>
                    -    &lt;ind:pattern operation=&quot;pattern
                    match&quot;&gt;^[\s]*(?i)HostbasedAuthentication(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$&lt;/ind:pattern&gt;<br>
                    +    &lt;ind:pattern operation=&quot;pattern
                    match&quot;&gt;^[\s]*(?i)HostbasedAuthentication(?-i)[\s]+no[\s]*(?:|(?:#.*))?$&lt;/ind:pattern&gt;<br>
                          &lt;ind:instance datatype=&quot;int&quot;&gt;1&lt;/ind:instance&gt;<br>
                        &lt;/ind:textfilecontent54_object&gt;<br>
                      &lt;/def-group&gt;<br>
                  </blockquote>
                  <br>
                </div>
              </div>
              The negate properly will fail you if
              HostbasedAuthentication != no, but I&#39;m not getting the
              false positive. Can you share how to reproduce?<br>
              <br>
              this passes as expected:<br>
              $ sudo grep ^HostbasedAuthentication /etc/ssh/sshd_config<br>
              HostbasedAuthentication no<br>
              $ sudo ./testcheck.py disable_host_auth.xml<br>
              Evaluating with OVAL tempfile :
              /tmp/disable_host_authaoRDFL.xml<br>
              Writing results to : /tmp/disable_host_authaoRDFL.xml-results<br>
              Definition oval:scap-security-guide.testing:def:103: false<br>
              Definition oval:scap-security-guide.testing:def:101: false<br>
              Definition oval:scap-security-guide.testing:def:100: true<br>
              Evaluation done.<br>
              <br>
              fails as expected:<br>
              $ sudo sed -i &#39;s/HostbasedAuthentication
              no/HostbasedAuthentication yes/g&#39; /etc/ssh/sshd_config<br>
              $ sudo grep ^HostbasedAuthentication /etc/ssh/sshd_config<br>
              HostbasedAuthentication yes<br>
              $ sudo ./testcheck.py disable_host_auth.xml<br>
              Evaluating with OVAL tempfile :
              /tmp/disable_host_auth2Vo5qy.xml<br>
              Writing results to : /tmp/disable_host_auth2Vo5qy.xml-results<br>
              Definition oval:scap-security-guide.testing:def:103: false<br>
              Definition oval:scap-security-guide.testing:def:101: false<br>
              Definition oval:scap-security-guide.testing:def:100: false<br>
              Evaluation done.<span><font color="#888888"><br>
                  <br>
                  <br>
                  <br>
                  -- <br>
                  SCAP Security Guide mailing list<br>
                  <a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
                  <a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
                  <a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></font></span></blockquote>
          </div>
          <br>
        </div>
      </div>
      <br>
      <fieldset></fieldset>
      <br>
      <div style="font-family:-moz-fixed;font-size:12px" lang="x-unicode">
        <pre><div>-- 
SCAP Security Guide mailing list
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></div></pre>
      </div>
    </blockquote>
    <br>
    </div></div><span class="HOEnZb"><font color="#888888"><pre cols="72">-- 
Shawn Wells
Director, Innovation Programs
<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a> | <a href="tel:443.534.0130" value="+14435340130" target="_blank">443.534.0130</a>
@shawndwells</pre>
  </font></span></div>

<br>--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br></blockquote></div><br></div>