ComplianceAsCode / ComplianceAsCode/content

RHEL sshd_strong_kex values not compatible with OVAL logic

Open
#13,498 0 comments 0 reactions 0 assignees View on GitHub
RHEL triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

RHEL uses the negated form of KexAlgorithm for `sshd_strong_kex` values, e.g.
https://github.com/ComplianceAsCode/content/blob/ffe714f9387f75542aeaef31f24a16860f0b168a/linux_os/guide/services/ssh/sshd_strong_kex.var#L16

This is not compatible with the OVAL logic in rule `sshd_use_strong_kex`, which checks that each algorithm in the config file exists in `sshd_strong_kex`. It does _not_ check that the whole line equals `sshd_strong_kex`, which would be compatible with the negated form.

This means that these settings will match using the above variable and result in a false positive:
- `KexAlgorithms diffie-hellman-group14-sha1`
- `KexAlgorithms diffie-hellman-group-exchange-sha1`

#### SCAP Security Guide Version:

master

#### Operating System Version:

#### Steps to Reproduce:

1. build
2. add `KexAlgorithms diffie-hellman-group14-sha1` to `/etc/ssh/sshd_config`
3. `oscap xccdf eval --profile cis_level1_server --rule xccdf_org.ssgproject.content_rule_sshd_use_strong_kex datastream_name`

#### Actual Results:

Pass

#### Expected Results:

Fail

#### Additional Information/Debugging Steps:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.