ComplianceAsCode / ComplianceAsCode/content

Some ssh rules write remediation to /etc/ssh/sshd_config.d/ but check /etc/ssh/sshd_config

Open
#14,926 1 comment 0 reactions 1 assignee Claimed by @teacup-on-rockingchair View on GitHub
SLES triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

Some ssh rules write remediation it a distributed configuration file in `/etc/ssh/sshd_config.d/` (if system uses distributed files) but check for expected configuration settings in `/etc/ssh/sshd_config`, which fails for obvious reasons.

The encountered the behavior with the following rules:
- sshd_use_approved_ciphers
- sshd_use_approved_ciphers_ordered_stig
- sshd_use_approved_macs
- sshd_use_approved_macs_ordered_stig

More rules may be affected.

#### SCAP Security Guide Version:

0.1.81

I believe the issue was introduced with that version as the rules pass in builds that use `0.1.80`.

#### Operating System Version:

SLES 15 SP5

#### Steps to Reproduce:

1. Start SLES 15 SP5+ instance (any system with distributed sshd config will probably do)
2. Run remediation for rules in question, e.g. `oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml`

#### Actual Results:

Remediation error:
```
:/ # oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml
--- Starting Evaluation ---

Title Use Only FIPS 140-2 Validated Ciphers
Rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
Ident CCE-91337-6
Result fail

--- Starting Remediation ---

Title Use Only FIPS 140-2 Validated Ciphers
Rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
Ident CCE-91337-6
Result error
```
Remediation was written though:
```
:/ # ls /etc/ssh/sshd_config.d/
00-complianceascode-hardening.conf
```

#### Expected Results:

Remediation check passes.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.