skyler / rpms / scap-security-guide

Forked from rpms/scap-security-guide 3 years ago
Clone
Source Code
GIT

Files

  1.   dac76ab332cb6f7ca5cdbec311d2754a26f6d91e
  2.   SOURCES
  3.   scap-security-guide-0.1.50-ssh_references_PR_5297.patch
Blob Blame History Raw 
From 287fec018a738821ed62670fd202c3db40ed5300 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Mon, 16 Mar 2020 19:37:57 +0100
Subject: [PATCH 1/4] Select rules for SSH and add references

---
 .../rule.yml                                  |  1 +
 .../file_permissions_sshd_pub_key/rule.yml    |  1 +
 .../ssh/ssh_server/disable_host_auth/rule.yml |  3 +-
 .../sshd_disable_empty_passwords/rule.yml     |  3 +-
 .../ssh_server/sshd_disable_rhosts/rule.yml   |  3 +-
 .../sshd_disable_root_login/rule.yml          |  3 +-
 .../sshd_do_not_permit_user_env/rule.yml      |  3 +-
 .../sshd_enable_warning_banner/rule.yml       |  3 +-
 .../sshd_enable_x11_forwarding/rule.yml       |  3 +-
 .../ssh_server/sshd_set_idle_timeout/rule.yml |  3 +-
 .../ssh_server/sshd_set_keepalive/rule.yml    |  3 +-
 .../sshd_set_loglevel_info/rule.yml           |  1 +
 .../sshd_set_max_auth_tries/rule.yml          |  1 +
 .../configure_ssh_crypto_policy/rule.yml      |  1 +
 15 files changed, 51 insertions(+), 22 deletions(-)

diff --git a/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml b/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml
index b1b7ccabaa..108c9c5ce0 100644
--- a/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml
+++ b/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml
@@ -33,6 +33,7 @@ references:
     cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
     iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
     cis-csc: 12,13,14,15,16,18,3,5
+    cis@rhel8: 5.2.3
 
 ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/ssh/*_key", perms="-rw-r-----") }}}'
 
diff --git a/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml b/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml
index da3dead155..714b507db1 100644
--- a/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml
+++ b/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml
@@ -28,6 +28,7 @@ references:
     cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
     iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
     cis-csc: 12,13,14,15,16,18,3,5
+    cis@rhel8: 5.2.4
 
 ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/ssh/*.pub", perms="-rw-r--r--") }}}'
 
diff --git a/linux_os/guide/services/ssh/ssh_server/disable_host_auth/rule.yml b/linux_os/guide/services/ssh/ssh_server/disable_host_auth/rule.yml
index de5580b9f5..9db9fd7516 100644
--- a/linux_os/guide/services/ssh/ssh_server/disable_host_auth/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/disable_host_auth/rule.yml
@@ -27,7 +27,8 @@ references:
     stigid@rhel6: "000236"
     srg@rhel6: SRG-OS-000106
     disa@rhel6: 765,766
-    cis: 5.2.7
+    cis@rhel8: 5.2.7
+    cis@rhel8: 5.2.9
     cjis: 5.5.6
     cui: 3.1.12
     disa: "366"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/rule.yml
index 25908a4e4d..b9bbe1e48e 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/rule.yml
@@ -28,7 +28,8 @@ references:
     stigid@rhel6: "000239"
     srg@rhel6: SRG-OS-000106
     disa@rhel6: 765,766
-    cis: 5.2.9
+    cis@rhel7: 5.2.9
+    cis@rhel8: 5.2.11
     cjis: 5.5.6
     cui: 3.1.1,3.1.5
     disa: "366"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/rule.yml
index fd960a55ae..3a5d16c052 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/rule.yml
@@ -27,7 +27,8 @@ references:
     stigid@rhel6: "000234"
     srg@rhel6: SRG-OS-000106
     disa@rhel6: 765,766
-    cis: 5.2.6
+    ci@rhel8s: 5.2.6
+    ci@rhel8s: 5.2.8
     cjis: 5.5.6
     cui: 3.1.12
     disa: "366"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_root_login/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_root_login/rule.yml
index 8b9cba960f..c6e7d7986c 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_root_login/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_root_login/rule.yml
@@ -28,7 +28,8 @@ references:
     stigid@rhel6: "000237"
     srg@rhel6: SRG-OS-000109
     disa@rhel6: '770'
-    cis: 5.2.8
+    cis@rhel7: 5.2.8
+    cis@rhel8: 5.2.10
     cjis: 5.5.6
     cui: '3.1.1,3.1.5'
     disa: 366,770
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_do_not_permit_user_env/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_do_not_permit_user_env/rule.yml
index f25d2a690a..f1a09a1b8d 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_do_not_permit_user_env/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_do_not_permit_user_env/rule.yml
@@ -23,7 +23,8 @@ references:
     stigid@rhel6: "000241"
     srg@rhel6: SRG-OS-000242
     disa@rhel6: '1414'
-    cis: 5.2.10
+    cis@rhel7: 5.2.10
+    cis@rhel8: 5.2.12
     cjis: 5.5.6
     cui: 3.1.12
     disa: "366"
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml
index f32287ff7c..4aa26eeb90 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml
@@ -25,7 +25,8 @@ identifiers:
 references:
     stigid@rhel6: "000240"
     srg@rhel6: SRG-OS-000023
-    cis: 5.2.16
+    cis@rhel7: 5.2.15
+    cis@rhel8: 5.2.15
     cjis: 5.5.6
     cui: 3.1.9
     disa: 48,50,1384,1385,1386,1387,1388
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
index 5d50c2ed07..5fdca265fa 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
@@ -22,7 +22,8 @@ identifiers:
     cce@rhel8: 82421-9
 
 references:
-    cis: 5.2.4
+    cis@rhel7: 5.2.4
+    cis@rhel8: 5.2.6
     cui: 3.1.13
     disa: "366"
     nist: CM-6(a),AC-17(a),AC-17(2)
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
index 7cf263bef4..347610cd6f 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
@@ -34,7 +34,8 @@ references:
     stigid@rhel6: "000230"
     srg@rhel6: SRG-OS-000163
     disa@rhel6: '879'
-    cis: 5.2.12
+    cis@rhel7: 5.2.12
+    cis@rhel8: 5.2.13
     cjis: 5.5.6
     cui: 3.1.11
     disa: 879,1133,2361
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/rule.yml
index cc9f62b0af..65aac90ace 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/rule.yml
@@ -23,7 +23,8 @@ references:
     stigid@rhel6: "000231"
     srg@rhel6: SRG-OS-000126
     disa@rhel6: '879'
-    cis: 5.2.12
+    cis@rhel7: 5.2.12
+    cis@rhel8: 5.2.13
     cjis: 5.5.6
     cui: 3.1.11
     disa: 879,1133,2361
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_loglevel_info/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_loglevel_info/rule.yml
index 26eca336b2..e9e84cdf9b 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_loglevel_info/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_loglevel_info/rule.yml
@@ -26,6 +26,7 @@ references:
     cis@debian8: 9.3.2
     cis@debian10: 9.3.2
     cis@rhel7: 5.2.3
+    cis@rhel8: 5.2.5
     nist: AC-17(a),CM-6(a)
 
 ocil_clause: 'it is commented out or is not enabled'
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/rule.yml
index 6fd7a4b6bd..1661b78773 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/rule.yml
@@ -21,6 +21,7 @@ references:
     cis@debian8: 9.3.5
     cis@debian9: 9.3.5
     cis@rhel7: 5.2.5
+    cis@rhel8: 5.2.7
 
 ocil_clause: 'it is commented out or not configured properly'
 
diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
index b9d8b06028..db5ce07f0e 100644
--- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
+++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml
@@ -23,6 +23,7 @@ identifiers:
 
 references:
     nist: AC-17(a),AC-17(2),CM-6(a),MA-4(6),SC-13
+    cis@rhel8: 5.2.20
 
 ocil_clause: 'the CRYPTO_POLICY variable is not set or is commented in the /etc/sysconfig/sshd'
 
From 74741eeab94571d881faf27221c75b2b3ea98c0f Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 17 Mar 2020 15:08:50 +0100
Subject: [PATCH 2/4] Fix typos in CIS references

---
 .../guide/services/ssh/ssh_server/disable_host_auth/rule.yml  | 2 +-
 .../services/ssh/ssh_server/sshd_disable_rhosts/rule.yml      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/linux_os/guide/services/ssh/ssh_server/disable_host_auth/rule.yml b/linux_os/guide/services/ssh/ssh_server/disable_host_auth/rule.yml
index 9db9fd7516..d19bfd4538 100644
--- a/linux_os/guide/services/ssh/ssh_server/disable_host_auth/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/disable_host_auth/rule.yml
@@ -27,7 +27,7 @@ references:
     stigid@rhel6: "000236"
     srg@rhel6: SRG-OS-000106
     disa@rhel6: 765,766
-    cis@rhel8: 5.2.7
+    cis@rhel7: 5.2.7
     cis@rhel8: 5.2.9
     cjis: 5.5.6
     cui: 3.1.12
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/rule.yml
index 3a5d16c052..5dafad7462 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts/rule.yml
@@ -27,8 +27,8 @@ references:
     stigid@rhel6: "000234"
     srg@rhel6: SRG-OS-000106
     disa@rhel6: 765,766
-    ci@rhel8s: 5.2.6
-    ci@rhel8s: 5.2.8
+    cis@rhel7: 5.2.6
+    cis@rhel8: 5.2.8
     cjis: 5.5.6
     cui: 3.1.12
     disa: "366"

From 65f019d15c73a2d4f081a1506939d862bda946cf Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 17 Mar 2020 19:43:16 +0100
Subject: [PATCH 3/4] Update CIS references for sshd_config

---
 .../guide/services/ssh/file_groupowner_sshd_config/rule.yml    | 3 ++-
 linux_os/guide/services/ssh/file_owner_sshd_config/rule.yml    | 3 ++-
 .../guide/services/ssh/file_permissions_sshd_config/rule.yml   | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/linux_os/guide/services/ssh/file_groupowner_sshd_config/rule.yml b/linux_os/guide/services/ssh/file_groupowner_sshd_config/rule.yml
index a9c09765d0..e53ac9d6b9 100644
--- a/linux_os/guide/services/ssh/file_groupowner_sshd_config/rule.yml
+++ b/linux_os/guide/services/ssh/file_groupowner_sshd_config/rule.yml
@@ -21,7 +21,8 @@ identifiers:
     cce@rhel8: 82901-0
 
 references:
-    cis: 5.2.1
+    cis@rhel7: 5.2.1
+    cis@rhel8: 5.2.1
     nist: AC-17(a),CM-6(a),AC-6(1)
     nist-csf: PR.AC-4,PR.DS-5
     srg: SRG-OS-000480-GPOS-00227
diff --git a/linux_os/guide/services/ssh/file_owner_sshd_config/rule.yml b/linux_os/guide/services/ssh/file_owner_sshd_config/rule.yml
index 5a80d04763..ca1cc19eeb 100644
--- a/linux_os/guide/services/ssh/file_owner_sshd_config/rule.yml
+++ b/linux_os/guide/services/ssh/file_owner_sshd_config/rule.yml
@@ -21,7 +21,8 @@ identifiers:
     cce@rhel8: 82898-8
 
 references:
-    cis: 5.2.1
+    cis@rhel7: 5.2.1
+    cis@rhel8: 5.2.1
     nist: AC-17(a),CM-6(a),AC-6(1)
     nist-csf: PR.AC-4,PR.DS-5
     srg: SRG-OS-000480-GPOS-00227
diff --git a/linux_os/guide/services/ssh/file_permissions_sshd_config/rule.yml b/linux_os/guide/services/ssh/file_permissions_sshd_config/rule.yml
index 13bdab401e..e40868dac4 100644
--- a/linux_os/guide/services/ssh/file_permissions_sshd_config/rule.yml
+++ b/linux_os/guide/services/ssh/file_permissions_sshd_config/rule.yml
@@ -21,7 +21,8 @@ identifiers:
     cce@rhel8: 82894-7
 
 references:
-    cis: 5.2.1
+    cis@rhel7: 5.2.1
+    cis@rhel8: 5.2.1
     nist: AC-17(a),CM-6(a),AC-6(1)
     nist-csf: PR.AC-4,PR.DS-5
     srg: SRG-OS-000480-GPOS-00227

From 9b9f7978409f23775f623d1c398f5b448ac73c94 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Thu, 19 Mar 2020 13:17:03 +0100
Subject: [PATCH 4/4] Remove incorrect rule selection and its references

Policy would like X11 forwarding disabled, not enabled.
---
 .../services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
index 5fdca265fa..4dedae6e8b 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_x11_forwarding/rule.yml
@@ -22,8 +22,6 @@ identifiers:
     cce@rhel8: 82421-9
 
 references:
-    cis@rhel7: 5.2.4
-    cis@rhel8: 5.2.6
     cui: 3.1.13
     disa: "366"
     nist: CM-6(a),AC-17(a),AC-17(2)

Powered by Pagure 5.14.1

SSH Hostkey/Fingerprint | Documentation