rpms/scap-security-guide
7
0
Fork 0
Code Issues Pull Requests Releases Activity
f68f0f633d
scap-security-guide/SOURCES/scap-security-guide-0.1.61-distributed-sshd-rekeylimit-PR_8148.patch
CentOS Sources c765dbf87f import scap-security-guide-0.1.60-6.el9_0
2022-05-17 18:17:34 +00:00

283 lines
15 KiB
Diff
Raw Blame History

From f7a2fb33ad1507ad4ce3f7ec6534c06d4f6a7e83 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Fri, 4 Feb 2022 12:02:36 +0100
Subject: [PATCH 1/3] Add tests for distributed SSHD RekeyLimit config
---
.../sshd_rekey_limit/tests/bad_size_directory.fail.sh | 10 ++++++++++
.../sshd_rekey_limit/tests/bad_time_directory.fail.sh | 10 ++++++++++
.../sshd_rekey_limit/tests/no_line_directory.fail.sh | 8 ++++++++
.../sshd_rekey_limit/tests/rhel8_ok.pass.sh | 2 +-
.../sshd_rekey_limit/tests/rhel9_ok.pass.sh | 11 +++++++++++
5 files changed, 40 insertions(+), 1 deletion(-)
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size_directory.fail.sh
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time_directory.fail.sh
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line_directory.fail.sh
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel9_ok.pass.sh
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size_directory.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size_directory.fail.sh
new file mode 100644
index 00000000000..88c6420c5ca
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size_directory.fail.sh
@@ -0,0 +1,10 @@
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 9
+
+mkdir -p /etc/ssh/sshd_config.d
+touch /etc/ssh/sshd_config.d/nothing
+
+if grep -q "^\s*RekeyLimit" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
+ sed -i "/^\s*RekeyLimit.*/Id" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
+fi
+
+echo "RekeyLimit 812M 1h" > /etc/ssh/sshd_config.d/bad_config.conf
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time_directory.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time_directory.fail.sh
new file mode 100644
index 00000000000..3bb0926017c
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time_directory.fail.sh
@@ -0,0 +1,10 @@
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 9
+
+mkdir -p /etc/ssh/sshd_config.d
+touch /etc/ssh/sshd_config.d/nothing
+
+if grep -q "^\s*RekeyLimit" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
+ sed -i "/^\s*RekeyLimit.*/Id" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
+fi
+
+echo "RekeyLimit 512M 2h" > /etc/ssh/sshd_config.d/bad_config.conf
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line_directory.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line_directory.fail.sh
new file mode 100644
index 00000000000..00569de1b84
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line_directory.fail.sh
@@ -0,0 +1,8 @@
+# platform = multi_platform_fedora,Red Hat Enterprise Linux 9
+
+mkdir -p /etc/ssh/sshd_config.d
+touch /etc/ssh/sshd_config.d/nothing
+
+if grep -q "^\s*RekeyLimit" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
+ sed -i "/^\s*RekeyLimit.*/Id" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
+fi
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel8_ok.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel8_ok.pass.sh
index b9834e6d0b2..894c0ae4ba8 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel8_ok.pass.sh
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel8_ok.pass.sh
@@ -1,4 +1,4 @@
-# platform = Red Hat Enterprise Linux 8
+# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
# profiles = xccdf_org.ssgproject.content_profile_ospp
sed -e '/RekeyLimit/d' /etc/ssh/sshd_config
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel9_ok.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel9_ok.pass.sh
new file mode 100644
index 00000000000..e183e8986dc
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/rhel9_ok.pass.sh
@@ -0,0 +1,11 @@
+# platform = Red Hat Enterprise Linux 9
+# profiles = xccdf_org.ssgproject.content_profile_ospp
+
+mkdir -p /etc/ssh/sshd_config.d
+touch /etc/ssh/sshd_config.d/nothing
+
+if grep -q "^\s*RekeyLimit" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* ; then
+ sed -i "/^\s*RekeyLimit.*/Id" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
+fi
+
+echo "RekeyLimit 1G 1h" >> /etc/ssh/sshd_config.d/good_config.conf
From 782e3a6108ea377d526d0aed4e8c0cf019f3dcdd Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Fri, 4 Feb 2022 12:06:45 +0100
Subject: [PATCH 2/3] Update rule to handle distributed config
Based on the template sshd_lineinfile, updated rule sshd_rekey_limit to
check and remediate SSHD configuration in products that support
/etc/sshd/sshd_config.d/
The rule cannot use the template as it relies on two external variables.
---
.../sshd_rekey_limit/ansible/shared.yml | 8 +++-
.../sshd_rekey_limit/bash/shared.sh | 2 +-
.../sshd_rekey_limit/oval/shared.xml | 46 ++++++++++++++-----
.../ssh/ssh_server/sshd_rekey_limit/rule.yml | 10 +++-
4 files changed, 50 insertions(+), 16 deletions(-)
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml
index 84a4f084d40..f30dcdb2ed3 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml
@@ -5,4 +5,10 @@
# disruption = low
{{{ ansible_instantiate_variables("var_rekey_limit_size", "var_rekey_limit_time") }}}
-{{{ ansible_sshd_set(parameter="RekeyLimit", value="{{ var_rekey_limit_size }} {{ var_rekey_limit_time }}") }}}
+{{{
+ ansible_sshd_set(
+ parameter="RekeyLimit",
+ value="{{ var_rekey_limit_size }} {{ var_rekey_limit_time }}",
+ config_is_distributed=sshd_distributed_config
+ )
+}}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh
index 4422f63472c..789358472a1 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh
@@ -2,4 +2,4 @@
{{{ bash_instantiate_variables("var_rekey_limit_size", "var_rekey_limit_time") }}}
-{{{ bash_sshd_config_set(parameter='RekeyLimit', value="$var_rekey_limit_size $var_rekey_limit_time") }}}
+{{{ bash_sshd_remediation(parameter='RekeyLimit', value="$var_rekey_limit_size $var_rekey_limit_time", config_is_distributed=sshd_distributed_config) -}}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
index f49d9ab5275..e109cbd3124 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
@@ -1,26 +1,49 @@
-{{% set filepath = "/etc/ssh/sshd_config" -%}}
-
+{{%- set parameter = "RekeyLimit" %}}
+{{%- set sshd_config_path = "/etc/ssh/sshd_config" %}}
+{{%- set sshd_config_dir = "/etc/ssh/sshd_config.d" -%}}
+{{%- set description = "Ensure RekeyLimit is configured with the appropriate value in " ~ sshd_config_path %}}
+{{%- if sshd_distributed_config == "true" %}}
+{{%- set description = description ~ " or in " ~ sshd_config_dir -%}}
+{{%- endif %}}
<def-group>
<definition class="compliance" id="{{{ rule_id }}}" version="1">
- {{{ oval_metadata("Ensure 'RekeyLimit' is configured with the correct value in '" + filepath + "'") }}}
- <criteria comment="sshd is configured correctly or is not installed" operator="OR">
- {{{- application_not_required_or_requirement_unset() }}}
- {{{- application_required_or_requirement_unset() }}}
- {{{- oval_line_in_file_criterion(filepath, "RekeyLimit") }}}
- </criteria>
- </criteria>
+ {{{ oval_metadata(description) }}}
+ <criteria comment="sshd is configured correctly or is not installed" operator="OR">
+ {{{- application_not_required_or_requirement_unset() }}}
+ {{{- application_required_or_requirement_unset() }}}
+ <criteria comment="sshd is configured corectly" operator="OR">
+ {{{- oval_line_in_file_criterion(sshd_config_path, parameter) }}}
+ {{%- if sshd_distributed_config %}}
+ {{{- oval_line_in_directory_criterion(sshd_config_dir, parameter) | indent(8) }}}
+ {{%- endif %}}
+ </criteria>
+ </criteria><!-- macro application_required_or_requirement_unset() leaves an open criteria element-->
+ </criteria>
</definition>
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in the file" id="test_sshd_rekey_limit" version="1">
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in the file" id="test_sshd_rekey_limit" version="1">
<ind:object object_ref="obj_sshd_rekey_limit"/>
</ind:textfilecontent54_test>
<ind:textfilecontent54_object id="obj_sshd_rekey_limit" version="1">
- <ind:filepath>{{{ filepath }}}</ind:filepath>
+ <ind:filepath>{{{ sshd_config_path }}}</ind:filepath>
+ <ind:pattern var_ref="sshd_line_regex" operation="pattern match"></ind:pattern>
+ <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ {{%- if sshd_distributed_config %}}
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in SSHD config directory" id="test_sshd_rekey_limit_config_dir" version="1">
+ <ind:object object_ref="obj_sshd_rekey_limit_config_dir"/>
+ </ind:textfilecontent54_test>
+
+ <ind:textfilecontent54_object id="obj_sshd_rekey_limit_config_dir" version="1">
+ <ind:path>{{{ sshd_config_dir}}}</ind:path>
+ <ind:filename operation="pattern match">.*\.conf$</ind:filename>
<ind:pattern var_ref="sshd_line_regex" operation="pattern match"></ind:pattern>
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
</ind:textfilecontent54_object>
+ {{%- endif %}}
<local_variable id="sshd_line_regex" datatype="string" comment="The regex of the directive" version="1">
<concat>
@@ -35,4 +58,3 @@
<external_variable comment="Size component of the rekey limit" datatype="string" id="var_rekey_limit_size" version="1" />
<external_variable comment="Time component of the rekey limit" datatype="string" id="var_rekey_limit_time" version="1" />
</def-group>
-
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml
index 450f244de41..702cd0506d3 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml
@@ -6,8 +6,10 @@ description: |-
The <tt>RekeyLimit</tt> parameter specifies how often
the session key of the is renegotiated, both in terms of
amount of data that may be transmitted and the time
- elapsed. To decrease the default limits, put line
- <tt>RekeyLimit {{{ xccdf_value("var_rekey_limit_size") }}} {{{ xccdf_value("var_rekey_limit_time") }}}</tt> to file <tt>/etc/ssh/sshd_config</tt>.
+ elapsed.<br/>
+ To decrease the default limits, add or correct the following line in
+ {{{ sshd_config_file() }}}
+ <pre>RekeyLimit {{{ xccdf_value("var_rekey_limit_size") }}} {{{ xccdf_value("var_rekey_limit_time") }}}</pre>
rationale: |-
By decreasing the limit based on the amount of data and enabling
@@ -32,6 +34,10 @@ ocil_clause: 'it is commented out or is not set'
ocil: |-
To check if RekeyLimit is set correctly, run the
following command:
+ {{% if sshd_distributed_config == "true" %}}
+ <pre>$ sudo grep RekeyLimit /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*</pre>
+ {{% else %}}
<pre>$ sudo grep RekeyLimit /etc/ssh/sshd_config</pre>
+ {{% endif %}}
If configured properly, output should be
<pre>RekeyLimit {{{ xccdf_value("var_rekey_limit_size") }}} {{{ xccdf_value("var_rekey_limit_time") }}}</pre>
From 78d6d40f280b0e43e6c8fd7d60cfd81e7979fb8f Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Wed, 9 Feb 2022 16:59:53 +0100
Subject: [PATCH 3/3] Use the Jinja variable 'parameter' where applicable
---
.../ssh/ssh_server/sshd_rekey_limit/oval/shared.xml | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
index e109cbd3124..d79ac7f2047 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml
@@ -1,7 +1,7 @@
{{%- set parameter = "RekeyLimit" %}}
{{%- set sshd_config_path = "/etc/ssh/sshd_config" %}}
{{%- set sshd_config_dir = "/etc/ssh/sshd_config.d" -%}}
-{{%- set description = "Ensure RekeyLimit is configured with the appropriate value in " ~ sshd_config_path %}}
+{{%- set description = "Ensure {{{ parameter }}} is configured with the appropriate value in " ~ sshd_config_path %}}
{{%- if sshd_distributed_config == "true" %}}
{{%- set description = description ~ " or in " ~ sshd_config_dir -%}}
{{%- endif %}}
@@ -22,7 +22,7 @@
</criteria>
</definition>
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in the file" id="test_sshd_rekey_limit" version="1">
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of {{{ parameter }}} setting in the file" id="test_sshd_rekey_limit" version="1">
<ind:object object_ref="obj_sshd_rekey_limit"/>
</ind:textfilecontent54_test>
@@ -33,7 +33,7 @@
</ind:textfilecontent54_object>
{{%- if sshd_distributed_config %}}
- <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in SSHD config directory" id="test_sshd_rekey_limit_config_dir" version="1">
+ <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of {{{ parameter }}} setting in SSHD config directory" id="test_sshd_rekey_limit_config_dir" version="1">
<ind:object object_ref="obj_sshd_rekey_limit_config_dir"/>
</ind:textfilecontent54_test>
@@ -47,7 +47,7 @@
<local_variable id="sshd_line_regex" datatype="string" comment="The regex of the directive" version="1">
<concat>
- <literal_component>^[\s]*RekeyLimit[\s]+</literal_component>
+ <literal_component>^[\s]*{{{ parameter }}}[\s]+</literal_component>
<variable_component var_ref="var_rekey_limit_size"/>
<literal_component>[\s]+</literal_component>
<variable_component var_ref="var_rekey_limit_time"/>
Reference in New Issue View Git Blame Copy Permalink