ComplianceAsCode / ComplianceAsCode/content

Ensure consistency among SSH related rules

Open
#12,420 2 comments 0 reactions 0 assignees View on GitHub
enhancement triaged Update Rule
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

The template `sshd_lineinfile` is intended to be used by SSH related rules that care about configuration parameters.
The template is robust and had some recent improvements:
- https://github.com/ComplianceAsCode/content/pull/12251
- https://github.com/ComplianceAsCode/content/pull/12419

Many rules are already using this template, but the following rules were not yet migrated:
- sshd_rekey_limit
- sshd_set_idle_timeout
- sshd_use_approved_ciphers
- sshd_use_directory_configuration
- sshd_use_strong_kex
- sshd_use_strong_macs

It seems they are relatively simple to be migrated and this way we can no only reduce duplication but also improve the consistency among these rules.

#### SCAP Security Guide Version:

master as of 2024-09-25

#### Operating System Version:

Multiple products would benefit from this improvement.

#### Steps to Reproduce:

1. ./build_product rhel9
2. Test each rule
```
for rule in sshd_rekey_limit sshd_set_idle_timeout sshd_use_approved_ciphers sshd_use_directory_configuration sshd_use_strong_kex sshd_use_strong_macs; do
./tests/automatus.py rule --libvirt qemu:///session rhel9 --datastream build/ssg-rhel9-ds.xml --dontclean $rule
done
```

#### Actual Results:

Although all tests may pass, there are differences on how each rule is tested, checked and remediated.

#### Expected Results:

All rules share as much as possible from the `ssh_lineinfile` template.

#### Additional Information/Debugging Steps:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.