<div dir="ltr">Got it. So if the default behavior is disabled, then the scan passes. Ignore this patch and the disable_rhosts patch then.<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Aug 5, 2014 at 12:27 PM, Shawn Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div class="">
<br>
<div>On 8/5/14, 9:35 AM, Gabe Alford wrote:<br>
</div>
<blockquote type="cite">
<div lang="x-unicode">
<div dir="ltr">
<div>
<div>
<div>Hi Shawn,<br>
<br>
</div>
At least on RHEL6.5 if I run the scap scan (using oscap)
with the scap-security-guide without configuring
sshd_config at all, the scan tells me that I pass the
'Disable Host-Based Authentication' when in fact it is not
configured. Same thing goes for the other ignoring rhosts,
and disabling root login checks.<br>
<br>
</div>
Thanks,<br>
<br>
</div>
Gabe<br>
</div>
</div>
</blockquote>
<br></div>
Ah, yes, this is expected. The default for HostbasedAuthentication
is disabled, so the absence of explicit "HostbasedAuthentication no"
is still a pass.<br>
<br>
Ref manpage @ <a href="http://rc.quest.com/man.php?id=sshd_config(5)" target="_blank">http://rc.quest.com/man.php?id=sshd_config(5)</a> (do a
find on "HostbasedAuthentication")<div><div class="h5"><br>
<br>
<br>
<blockquote type="cite">
<div lang="x-unicode">
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Fri, Aug 1, 2014 at 2:10 PM, Shawn
Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div><br>
On 7/29/14, 8:43 PM, Gabe wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
- fix false positive for SSH host-based
authentication check in sshd_config<br>
<br>
Signed-off-by: Gabe <<a href="mailto:redhatrises@gmail.com" target="_blank">redhatrises@gmail.com</a>><br>
---<br>
shared/oval/disable_host_auth.xml | 4 ++--<br>
1 file changed, 2 insertions(+), 2 deletions(-)<br>
<br>
diff --git a/shared/oval/disable_host_auth.xml
b/shared/oval/disable_host_auth.xml<br>
index 6f4eb9d..de51fd7 100644<br>
--- a/shared/oval/disable_host_auth.xml<br>
+++ b/shared/oval/disable_host_auth.xml<br>
@@ -14,7 +14,7 @@<br>
<extend_definition comment="sshd service
is disabled"<br>
definition_ref="service_sshd_disabled" /><br>
<criterion comment="Check
HostbasedAuthentication in /etc/ssh/sshd_config"<br>
- test_ref="test_sshd_hostbasedauthentication"
/><br>
+ negate="true" test_ref="test_sshd_hostbasedauthentication"
/><br>
</criteria><br>
</definition><br>
<ind:textfilecontent54_test check="all"
check_existence="none_exist"<br>
@@ -24,7 +24,7 @@<br>
</ind:textfilecontent54_test><br>
<ind:textfilecontent54_object
id="object_sshd_hostbasedauthentication"
version="2"><br>
<ind:filepath>/etc/ssh/sshd_config</ind:filepath><br>
- <ind:pattern operation="pattern
match">^[\s]*(?i)HostbasedAuthentication(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$</ind:pattern><br>
+ <ind:pattern operation="pattern
match">^[\s]*(?i)HostbasedAuthentication(?-i)[\s]+no[\s]*(?:|(?:#.*))?$</ind:pattern><br>
<ind:instance datatype="int">1</ind:instance><br>
</ind:textfilecontent54_object><br>
</def-group><br>
</blockquote>
<br>
</div>
</div>
The negate properly will fail you if
HostbasedAuthentication != no, but I'm not getting the
false positive. Can you share how to reproduce?<br>
<br>
this passes as expected:<br>
$ sudo grep ^HostbasedAuthentication /etc/ssh/sshd_config<br>
HostbasedAuthentication no<br>
$ sudo ./testcheck.py disable_host_auth.xml<br>
Evaluating with OVAL tempfile :
/tmp/disable_host_authaoRDFL.xml<br>
Writing results to : /tmp/disable_host_authaoRDFL.xml-results<br>
Definition oval:scap-security-guide.testing:def:103: false<br>
Definition oval:scap-security-guide.testing:def:101: false<br>
Definition oval:scap-security-guide.testing:def:100: true<br>
Evaluation done.<br>
<br>
fails as expected:<br>
$ sudo sed -i 's/HostbasedAuthentication
no/HostbasedAuthentication yes/g' /etc/ssh/sshd_config<br>
$ sudo grep ^HostbasedAuthentication /etc/ssh/sshd_config<br>
HostbasedAuthentication yes<br>
$ sudo ./testcheck.py disable_host_auth.xml<br>
Evaluating with OVAL tempfile :
/tmp/disable_host_auth2Vo5qy.xml<br>
Writing results to : /tmp/disable_host_auth2Vo5qy.xml-results<br>
Definition oval:scap-security-guide.testing:def:103: false<br>
Definition oval:scap-security-guide.testing:def:101: false<br>
Definition oval:scap-security-guide.testing:def:100: false<br>
Evaluation done.<span><font color="#888888"><br>
<br>
<br>
<br>
-- <br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></font></span></blockquote>
</div>
<br>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
<div style="font-family:-moz-fixed;font-size:12px" lang="x-unicode">
<pre><div>--
SCAP Security Guide mailing list
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.fedorahosted.org</a>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a></div></pre>
</div>
</blockquote>
<br>
</div></div><span class="HOEnZb"><font color="#888888"><pre cols="72">--
Shawn Wells
Director, Innovation Programs
<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a> | <a href="tel:443.534.0130" value="+14435340130" target="_blank">443.534.0130</a>
@shawndwells</pre>
</font></span></div>
<br>--<br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/scap-security-guide/</a><br></blockquote></div><br></div>