<div dir="ltr"><div><div><div>Hi Shawn,<br><br></div>At least on RHEL6.5 if I run the scap scan (using oscap) with the scap-security-guide without configuring sshd_config at all, the scan tells me that I pass the &#39;Disable Host-Based Authentication&#39; when in fact it is not configured. Same thing goes for the other ignoring rhosts, and disabling root login checks.<br>
<br></div>Thanks,<br><br></div>Gabe<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Aug 1, 2014 at 2:10 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5"><br>
On 7/29/14, 8:43 PM, Gabe wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
- fix false positive for SSH host-based authentication check in sshd_config<br>
<br>
Signed-off-by: Gabe &lt;<a href="mailto:redhatrises@gmail.com" target="_blank">redhatrises@gmail.com</a>&gt;<br>
---<br>
  shared/oval/disable_host_auth.<u></u>xml | 4 ++--<br>
  1 file changed, 2 insertions(+), 2 deletions(-)<br>
<br>
diff --git a/shared/oval/disable_host_<u></u>auth.xml b/shared/oval/disable_host_<u></u>auth.xml<br>
index 6f4eb9d..de51fd7 100644<br>
--- a/shared/oval/disable_host_<u></u>auth.xml<br>
+++ b/shared/oval/disable_host_<u></u>auth.xml<br>
@@ -14,7 +14,7 @@<br>
        &lt;extend_definition comment=&quot;sshd service is disabled&quot;<br>
        definition_ref=&quot;service_sshd_<u></u>disabled&quot; /&gt;<br>
        &lt;criterion comment=&quot;Check HostbasedAuthentication in /etc/ssh/sshd_config&quot;<br>
-      test_ref=&quot;test_sshd_<u></u>hostbasedauthentication&quot; /&gt;<br>
+      negate=&quot;true&quot; test_ref=&quot;test_sshd_<u></u>hostbasedauthentication&quot; /&gt;<br>
      &lt;/criteria&gt;<br>
    &lt;/definition&gt;<br>
    &lt;ind:textfilecontent54_test check=&quot;all&quot; check_existence=&quot;none_exist&quot;<br>
@@ -24,7 +24,7 @@<br>
    &lt;/ind:textfilecontent54_test&gt;<br>
    &lt;ind:textfilecontent54_object id=&quot;object_sshd_<u></u>hostbasedauthentication&quot; version=&quot;2&quot;&gt;<br>
      &lt;ind:filepath&gt;/etc/ssh/sshd_<u></u>config&lt;/ind:filepath&gt;<br>
-    &lt;ind:pattern operation=&quot;pattern match&quot;&gt;^[\s]*(?i)<u></u>HostbasedAuthentication(?-i)[\<u></u>s]+yes[\s]*(?:|(?:#.*))?$&lt;/<u></u>ind:pattern&gt;<br>
+    &lt;ind:pattern operation=&quot;pattern match&quot;&gt;^[\s]*(?i)<u></u>HostbasedAuthentication(?-i)[\<u></u>s]+no[\s]*(?:|(?:#.*))?$&lt;/ind:<u></u>pattern&gt;<br>
      &lt;ind:instance datatype=&quot;int&quot;&gt;1&lt;/ind:<u></u>instance&gt;<br>
    &lt;/ind:textfilecontent54_<u></u>object&gt;<br>
  &lt;/def-group&gt;<br>
</blockquote>
<br></div></div>
The negate properly will fail you if HostbasedAuthentication != no, but I&#39;m not getting the false positive. Can you share how to reproduce?<br>
<br>
this passes as expected:<br>
$ sudo grep ^HostbasedAuthentication /etc/ssh/sshd_config<br>
HostbasedAuthentication no<br>
$ sudo ./testcheck.py disable_host_auth.xml<br>
Evaluating with OVAL tempfile : /tmp/disable_host_authaoRDFL.<u></u>xml<br>
Writing results to : /tmp/disable_host_authaoRDFL.<u></u>xml-results<br>
Definition oval:scap-security-guide.<u></u>testing:def:103: false<br>
Definition oval:scap-security-guide.<u></u>testing:def:101: false<br>
Definition oval:scap-security-guide.<u></u>testing:def:100: true<br>
Evaluation done.<br>
<br>
fails as expected:<br>
$ sudo sed -i &#39;s/HostbasedAuthentication no/HostbasedAuthentication yes/g&#39; /etc/ssh/sshd_config<br>
$ sudo grep ^HostbasedAuthentication /etc/ssh/sshd_config<br>
HostbasedAuthentication yes<br>
$ sudo ./testcheck.py disable_host_auth.xml<br>
Evaluating with OVAL tempfile : /tmp/disable_host_auth2Vo5qy.<u></u>xml<br>
Writing results to : /tmp/disable_host_auth2Vo5qy.<u></u>xml-results<br>
Definition oval:scap-security-guide.<u></u>testing:def:103: false<br>
Definition oval:scap-security-guide.<u></u>testing:def:101: false<br>
Definition oval:scap-security-guide.<u></u>testing:def:100: false<br>
Evaluation done.<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
<br>
-- <br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.<u></u>fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/scap-<u></u>security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/<u></u>scap-security-guide/</a></font></span></blockquote></div><br></div>