ComplianceAsCode / ComplianceAsCode/content

xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy (CCE-85902-5) fails due to excess whitespace

Open
#12,186 2 comments 0 reactions 0 assignees View on GitHub
enhancement triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Share the context

After installing RHEL 8.10 using kickstart with following configuration:
```
%addon org_fedora_oscap
content-type = datastream
content-url = $MY_URL/ssg-rhel8-ds-1.2_0.1.73.xml
datastream-id = scap_org.open-scap_datastream_from_xccdf_ssg-rhel8-xccdf.xml
xccdf-id = scap_org.open-scap_cref_ssg-rhel8-xccdf.xml
profile = xccdf_org.ssgproject.content_profile_stig
fingerprint = 40c7d18cb94f440866e5e9d1650d4af2ba2caa3a19a94847e8e420f435f0f065
%end
```
I ran an `oscap` scan using the `xccdf_org.ssgproject.content_profile_stig` profile.

#### Description of problem:

Rule ID `xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy` failed despite the openssh.config line it was complaining about matching. Except when I copy/pasted the content I found that the check text is misformatted:
```
Ciphers aes256-ctr,aes192-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com

```
There is extra whitespace and it's failing the check due to this unnecessary whitespace. Manual testing showed if there was not both a newline plus the 12 spaces the check will fail despite the extra whitespace having no actual effect.
#### Proposed change:

The text to match against should not include the excess whitespace.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.