Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure consistency among SSH related rules #12420

Open
marcusburghardt opened this issue Sep 25, 2024 · 1 comment
Open

Ensure consistency among SSH related rules #12420

marcusburghardt opened this issue Sep 25, 2024 · 1 comment
Labels
enhancement General enhancements to the project. Update Rule Issues or pull requests related to Rules updates.

Comments

@marcusburghardt
Copy link
Member

Description of problem:

The template sshd_lineinfile is intended to be used by SSH related rules that care about configuration parameters.
The template is robust and had some recent improvements:

Many rules are already using this template, but the following rules were not yet migrated:

  • sshd_rekey_limit
  • sshd_set_idle_timeout
  • sshd_use_approved_ciphers
  • sshd_use_directory_configuration
  • sshd_use_strong_kex
  • sshd_use_strong_macs

It seems they are relatively simple to be migrated and this way we can no only reduce duplication but also improve the consistency among these rules.

SCAP Security Guide Version:

master as of 2024-09-25

Operating System Version:

Multiple products would benefit from this improvement.

Steps to Reproduce:

  1. ./build_product rhel9
  2. Test each rule
for rule in sshd_rekey_limit sshd_set_idle_timeout sshd_use_approved_ciphers sshd_use_directory_configuration sshd_use_strong_kex sshd_use_strong_macs; do
  ./tests/automatus.py rule --libvirt qemu:///session rhel9 --datastream build/ssg-rhel9-ds.xml --dontclean $rule
done

Actual Results:

Although all tests may pass, there are differences on how each rule is tested, checked and remediated.

Expected Results:

All rules share as much as possible from the ssh_lineinfile template.

Additional Information/Debugging Steps:

@marcusburghardt marcusburghardt added enhancement General enhancements to the project. Update Rule Issues or pull requests related to Rules updates. labels Sep 25, 2024
@marcusburghardt
Copy link
Member Author

This issue was raised when I was working on #12419

@marcusburghardt marcusburghardt changed the title Ensure consistence among SSH related rules Ensure consistency among SSH related rules Sep 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement General enhancements to the project. Update Rule Issues or pull requests related to Rules updates.
Projects
None yet
Development

No branches or pull requests

1 participant