<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <br>
    <div class="moz-cite-prefix">On 7/29/14, 8:43 PM, Gabe wrote:<br>
    </div>
    <blockquote
      cite="mid:1406681018-3579-4-git-send-email-redhatrises@gmail.com"
      type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">- fix false positive for PermitRootLogin check in sshd_config

Signed-off-by: Gabe <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:redhatrises@gmail.com">&lt;redhatrises@gmail.com&gt;</a>
---
 shared/oval/sshd_disable_root_login.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/shared/oval/sshd_disable_root_login.xml b/shared/oval/sshd_disable_root_login.xml
index 73c4906..6f8cede 100644
--- a/shared/oval/sshd_disable_root_login.xml
+++ b/shared/oval/sshd_disable_root_login.xml
@@ -15,7 +15,7 @@
       &lt;extend_definition comment="sshd service is disabled"
       definition_ref="service_sshd_disabled" /&gt;
       &lt;criterion comment="Check PermitRootLogin in /etc/ssh/sshd_config"
-      test_ref="test_sshd_permitrootlogin_no" /&gt;
+      negate="true" test_ref="test_sshd_permitrootlogin_no" /&gt;
     &lt;/criteria&gt;
   &lt;/definition&gt;
   &lt;ind:textfilecontent54_test check="all" check_existence="none_exist"
@@ -25,7 +25,7 @@
   &lt;/ind:textfilecontent54_test&gt;
   &lt;ind:textfilecontent54_object id="obj_sshd_permitrootlogin_no" version="2"&gt;
     &lt;ind:filepath&gt;/etc/ssh/sshd_config&lt;/ind:filepath&gt;
-    &lt;ind:pattern operation="pattern match"&gt;^[\s]*(?i)PermitRootLogin(?-i)[\s]+yes[\s]*(?:|(?:#.*))?$&lt;/ind:pattern&gt;
+    &lt;ind:pattern operation="pattern match"&gt;^[\s]*(?i)PermitRootLogin(?-i)[\s]+no[\s]*(?:|(?:#.*))?$&lt;/ind:pattern&gt;
     &lt;ind:instance datatype="int"&gt;1&lt;/ind:instance&gt;
   &lt;/ind:textfilecontent54_object&gt;
 &lt;/def-group&gt;
<div class="moz-txt-sig">-- 
2.0.0
</div></pre>
      </div>
    </blockquote>
    <br>
    The default for PermitRootLogin is yes [1], so this should fail if:<br>
    - PermitRootLogin is left unconfigured<br>
    - PermitRootLogin is set to yes<br>
    <br>
    The existing rule had a failure only if "PermitRootLogin yes"....
    changing it to scan for "PermitRootLogin no," with your negate
    statement, is a much cleaner way to ensure proper checking.<br>
    <br>
    Ack.<br>
    <br>
    <br>
    [1] <a class="moz-txt-link-freetext" href="http://rc.quest.com/man.php?id=sshd_config(5)">http://rc.quest.com/man.php?id=sshd_config(5)</a><br>
  </body>
</html>