ComplianceAsCode / ComplianceAsCode/content
RHEL sshd_strong_kex values not compatible with OVAL logic
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
RHEL uses the negated form of KexAlgorithm for `sshd_strong_kex` values, e.g.
https://github.com/ComplianceAsCode/content/blob/ffe714f9387f75542aeaef31f24a16860f0b168a/linux_os/guide/services/ssh/sshd_strong_kex.var#L16
This is not compatible with the OVAL logic in rule `sshd_use_strong_kex`, which checks that each algorithm in the config file exists in `sshd_strong_kex`. It does _not_ check that the whole line equals `sshd_strong_kex`, which would be compatible with the negated form.
This means that these settings will match using the above variable and result in a false positive:
- `KexAlgorithms diffie-hellman-group14-sha1`
- `KexAlgorithms diffie-hellman-group-exchange-sha1`
#### SCAP Security Guide Version:
master
#### Operating System Version:
#### Steps to Reproduce:
1. build
2. add `KexAlgorithms diffie-hellman-group14-sha1` to `/etc/ssh/sshd_config`
3. `oscap xccdf eval --profile cis_level1_server --rule xccdf_org.ssgproject.content_rule_sshd_use_strong_kex datastream_name`
#### Actual Results:
Pass
#### Expected Results:
Fail
#### Additional Information/Debugging Steps:
Contributor guide
Assessment
This issue has not been assessed yet.