<div dir="ltr"><div><div><div>Hi Shawn,<br><br></div>At least on RHEL6.5 if I run the scap scan (using oscap) with the scap-security-guide without configuring sshd_config at all, the scan tells me that I pass the 'Disable Host-Based Authentication' when in fact it is not configured. Same thing goes for the other ignoring rhosts, and disabling root login checks.<br>
<br></div>Thanks,<br><br></div>Gabe<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Aug 1, 2014 at 2:10 PM, Shawn Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5"><br>
On 7/29/14, 8:43 PM, Gabe wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
- fix false positive for SSH host-based authentication check in sshd_config<br>
<br>
Signed-off-by: Gabe <<a href="mailto:redhatrises@gmail.com" target="_blank">redhatrises@gmail.com</a>><br>
---<br>
shared/oval/disable_host_auth.<u></u>xml | 4 ++--<br>
1 file changed, 2 insertions(+), 2 deletions(-)<br>
<br>
diff --git a/shared/oval/disable_host_<u></u>auth.xml b/shared/oval/disable_host_<u></u>auth.xml<br>
index 6f4eb9d..de51fd7 100644<br>
--- a/shared/oval/disable_host_<u></u>auth.xml<br>
+++ b/shared/oval/disable_host_<u></u>auth.xml<br>
@@ -14,7 +14,7 @@<br>
<extend_definition comment="sshd service is disabled"<br>
definition_ref="service_sshd_<u></u>disabled" /><br>
<criterion comment="Check HostbasedAuthentication in /etc/ssh/sshd_config"<br>
- test_ref="test_sshd_<u></u>hostbasedauthentication" /><br>
+ negate="true" test_ref="test_sshd_<u></u>hostbasedauthentication" /><br>
</criteria><br>
</definition><br>
<ind:textfilecontent54_test check="all" check_existence="none_exist"<br>
@@ -24,7 +24,7 @@<br>
</ind:textfilecontent54_test><br>
<ind:textfilecontent54_object id="object_sshd_<u></u>hostbasedauthentication" version="2"><br>
<ind:filepath>/etc/ssh/sshd_<u></u>config</ind:filepath><br>
- <ind:pattern operation="pattern match">^[\s]*(?i)<u></u>HostbasedAuthentication(?-i)[\<u></u>s]+yes[\s]*(?:|(?:#.*))?$</<u></u>ind:pattern><br>
+ <ind:pattern operation="pattern match">^[\s]*(?i)<u></u>HostbasedAuthentication(?-i)[\<u></u>s]+no[\s]*(?:|(?:#.*))?$</ind:<u></u>pattern><br>
<ind:instance datatype="int">1</ind:<u></u>instance><br>
</ind:textfilecontent54_<u></u>object><br>
</def-group><br>
</blockquote>
<br></div></div>
The negate properly will fail you if HostbasedAuthentication != no, but I'm not getting the false positive. Can you share how to reproduce?<br>
<br>
this passes as expected:<br>
$ sudo grep ^HostbasedAuthentication /etc/ssh/sshd_config<br>
HostbasedAuthentication no<br>
$ sudo ./testcheck.py disable_host_auth.xml<br>
Evaluating with OVAL tempfile : /tmp/disable_host_authaoRDFL.<u></u>xml<br>
Writing results to : /tmp/disable_host_authaoRDFL.<u></u>xml-results<br>
Definition oval:scap-security-guide.<u></u>testing:def:103: false<br>
Definition oval:scap-security-guide.<u></u>testing:def:101: false<br>
Definition oval:scap-security-guide.<u></u>testing:def:100: true<br>
Evaluation done.<br>
<br>
fails as expected:<br>
$ sudo sed -i 's/HostbasedAuthentication no/HostbasedAuthentication yes/g' /etc/ssh/sshd_config<br>
$ sudo grep ^HostbasedAuthentication /etc/ssh/sshd_config<br>
HostbasedAuthentication yes<br>
$ sudo ./testcheck.py disable_host_auth.xml<br>
Evaluating with OVAL tempfile : /tmp/disable_host_auth2Vo5qy.<u></u>xml<br>
Writing results to : /tmp/disable_host_auth2Vo5qy.<u></u>xml-results<br>
Definition oval:scap-security-guide.<u></u>testing:def:103: false<br>
Definition oval:scap-security-guide.<u></u>testing:def:101: false<br>
Definition oval:scap-security-guide.<u></u>testing:def:100: false<br>
Evaluation done.<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
<br>
-- <br>
SCAP Security Guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.<u></u>fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/scap-<u></u>security-guide</a><br>
<a href="https://github.com/OpenSCAP/scap-security-guide/" target="_blank">https://github.com/OpenSCAP/<u></u>scap-security-guide/</a></font></span></blockquote></div><br></div>