ComplianceAsCode / ComplianceAsCode/content
Some ssh rules write remediation to /etc/ssh/sshd_config.d/ but check /etc/ssh/sshd_config
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
Some ssh rules write remediation it a distributed configuration file in `/etc/ssh/sshd_config.d/` (if system uses distributed files) but check for expected configuration settings in `/etc/ssh/sshd_config`, which fails for obvious reasons.
The encountered the behavior with the following rules:
- sshd_use_approved_ciphers
- sshd_use_approved_ciphers_ordered_stig
- sshd_use_approved_macs
- sshd_use_approved_macs_ordered_stig
More rules may be affected.
#### SCAP Security Guide Version:
0.1.81
I believe the issue was introduced with that version as the rules pass in builds that use `0.1.80`.
#### Operating System Version:
SLES 15 SP5
#### Steps to Reproduce:
1. Start SLES 15 SP5+ instance (any system with distributed sshd config will probably do)
2. Run remediation for rules in question, e.g. `oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml`
#### Actual Results:
Remediation error:
```
:/ # oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml
--- Starting Evaluation ---
Title Use Only FIPS 140-2 Validated Ciphers
Rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
Ident CCE-91337-6
Result fail
--- Starting Remediation ---
Title Use Only FIPS 140-2 Validated Ciphers
Rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
Ident CCE-91337-6
Result error
```
Remediation was written though:
```
:/ # ls /etc/ssh/sshd_config.d/
00-complianceascode-hardening.conf
```
#### Expected Results:
Remediation check passes.
Contributor guide
Assessment
This issue has not been assessed yet.