From 91c7ff65572b51b52eaf14f3b147b118dc85cc9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= Date: Tue, 19 May 2020 15:49:34 +0200 Subject: [PATCH 1/5] Made the rule sshd_rekey_limit parametrized. Introduce the rekey_limit_size and rekey_limit_time XCCDF values to make the rule more flexible. --- .../sshd_rekey_limit/bash/shared.sh | 9 ++++ .../sshd_rekey_limit/oval/shared.xml | 43 +++++++++++++++++++ .../ssh/ssh_server/sshd_rekey_limit/rule.yml | 12 +----- .../sshd_rekey_limit/tests/bad_size.fail.sh | 4 ++ .../sshd_rekey_limit/tests/bad_time.fail.sh | 4 ++ .../sshd_rekey_limit/tests/no_line.fail.sh | 3 ++ .../sshd_rekey_limit/tests/ok.pass.sh | 4 ++ .../ssh/ssh_server/var_rekey_limit_size.var | 14 ++++++ .../ssh/ssh_server/var_rekey_limit_time.var | 14 ++++++ rhel8/profiles/ospp.profile | 2 + 10 files changed, 99 insertions(+), 10 deletions(-) create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size.fail.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time.fail.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line.fail.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/ok.pass.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/var_rekey_limit_size.var create mode 100644 linux_os/guide/services/ssh/ssh_server/var_rekey_limit_time.var diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh new file mode 100644 index 0000000000..2620c2d49e --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh @@ -0,0 +1,9 @@ +# platform = multi_platform_all + +# Include source function library. +. /usr/share/scap-security-guide/remediation_functions + +populate var_rekey_limit_size +populate var_rekey_limit_time + +{{{ bash_sshd_config_set(parameter='RekeyLimit', value="$var_rekey_limit_size $var_rekey_limit_time") }}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml new file mode 100644 index 0000000000..57aa090948 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml @@ -0,0 +1,43 @@ +{{% set filepath = "/etc/ssh/sshd_config" %}} +{{% set parameter = "RekeyLimit" %}} + + + + + + {{{ rule_title }}} + {{{- oval_affected(products) }}} + Ensure '{{{ RekeyLimit }}}' is configured with the correct value in '{{{ filepath }}}' + + + {{{- application_not_required_or_requirement_unset() }}} + {{{- application_required_or_requirement_unset() }}} + {{{- oval_line_in_file_criterion(filepath, "RekeyLimit") }}} + + + + + + + + + + {{{ filepath }}} + + 1 + + + + + ^[\s]*RekeyLimit[\s]+ + + [\s]+ + + [\s]*$ + + + + + + + diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml index e11678faa0..4936a381f5 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml @@ -7,7 +7,7 @@ description: |- the session key of the is renegotiated, both in terms of amount of data that may be transmitted and the time elapsed. To decrease the default limits, put line - RekeyLimit 512M 1h to file /etc/ssh/sshd_config. + RekeyLimit {{{ sub_var_value("var_rekey_limit_size") }}} {{{ sub_var_value("var_rekey_limit_time") }}} to file /etc/ssh/sshd_config. rationale: |- By decreasing the limit based on the amount of data and enabling @@ -30,12 +30,4 @@ ocil: |- following command: 
$ sudo grep RekeyLimit /etc/ssh/sshd_config
If configured properly, output should be - 
RekeyLimit 512M 1h
- -template: - name: sshd_lineinfile - vars: - missing_parameter_pass: 'false' - parameter: RekeyLimit - rule_id: sshd_rekey_limit - value: 512M 1h + 
RekeyLimit {{{ sub_var_value("var_rekey_limit_size") }}} {{{ sub_var_value("var_rekey_limit_time") }}}
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size.fail.sh new file mode 100644 index 0000000000..2ac0bbf350 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_size.fail.sh @@ -0,0 +1,4 @@ +# platform = multi_platform_all + +sed -e '/RekeyLimit/d' /etc/ssh/sshd_config +echo "RekeyLimit 812M 1h" >> /etc/ssh/sshd_config diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time.fail.sh new file mode 100644 index 0000000000..fec859fe05 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/bad_time.fail.sh @@ -0,0 +1,4 @@ +# platform = multi_platform_all + +sed -e '/RekeyLimit/d' /etc/ssh/sshd_config +echo "RekeyLimit 512M 2h" >> /etc/ssh/sshd_config diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line.fail.sh new file mode 100644 index 0000000000..a6cd10163f --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/no_line.fail.sh @@ -0,0 +1,3 @@ +# platform = multi_platform_all + +sed -e '/RekeyLimit/d' /etc/ssh/sshd_config diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/ok.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/ok.pass.sh new file mode 100644 index 0000000000..a6a2ba7adf --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/tests/ok.pass.sh @@ -0,0 +1,4 @@ +# platform = multi_platform_all + +sed -e '/RekeyLimit/d' /etc/ssh/sshd_config +echo "RekeyLimit 512M 1h" >> /etc/ssh/sshd_config diff --git a/linux_os/guide/services/ssh/ssh_server/var_rekey_limit_size.var b/linux_os/guide/services/ssh/ssh_server/var_rekey_limit_size.var new file mode 100644 index 0000000000..16dc376508 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/var_rekey_limit_size.var @@ -0,0 +1,14 @@ +documentation_complete: true + +title: 'SSH RekeyLimit - size' + +description: 'Specify the size component of the rekey limit.' + +type: string + +operator: equals + +options: + sshd_default: "default" + default: "512M" + "512M": "512M" diff --git a/linux_os/guide/services/ssh/ssh_server/var_rekey_limit_time.var b/linux_os/guide/services/ssh/ssh_server/var_rekey_limit_time.var new file mode 100644 index 0000000000..8801fbbf6f --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/var_rekey_limit_time.var @@ -0,0 +1,14 @@ +documentation_complete: true + +title: 'SSH RekeyLimit - size' + +description: 'Specify the size component of the rekey limit.' + +type: string + +operator: equals + +options: + sshd_default: "none" + default: "1h" + "1hour": "1h" diff --git a/rhel8/profiles/ospp.profile b/rhel8/profiles/ospp.profile index c672066050..a5223a187f 100644 --- a/rhel8/profiles/ospp.profile +++ b/rhel8/profiles/ospp.profile @@ -58,6 +58,8 @@ selections: - sshd_set_keepalive - sshd_enable_warning_banner - sshd_rekey_limit + - var_rekey_limit_size=512M + - var_rekey_limit_time=1hour - sshd_use_strong_rng - openssl_use_strong_entropy From 85efae481db88792de138916c242fbbf0a7adeb1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= Date: Tue, 19 May 2020 17:57:12 +0200 Subject: [PATCH 2/5] Updated stable profile definitions. --- tests/data/profile_stability/rhel8/ospp.profile | 2 ++ tests/data/profile_stability/rhel8/stig.profile | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile index 23039c82b4..bdda39a903 100644 --- a/tests/data/profile_stability/rhel8/ospp.profile +++ b/tests/data/profile_stability/rhel8/ospp.profile @@ -214,6 +214,8 @@ selections: - timer_dnf-automatic_enabled - usbguard_allow_hid_and_hub - var_sshd_set_keepalive=0 +- var_rekey_limit_size=512M +- var_rekey_limit_time=1hour - var_accounts_user_umask=027 - var_password_pam_difok=4 - var_password_pam_maxrepeat=3 diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile index cd31b73700..ebef541921 100644 --- a/tests/data/profile_stability/rhel8/stig.profile +++ b/tests/data/profile_stability/rhel8/stig.profile @@ -21,7 +21,6 @@ description: 'This profile contains configuration checks that align to the - Red Hat Containers with a Red Hat Enterprise Linux 8 image' documentation_complete: true -extends: ospp selections: - account_disable_post_pw_expiration - account_temp_expire_date @@ -243,6 +242,8 @@ selections: - timer_dnf-automatic_enabled - usbguard_allow_hid_and_hub - var_sshd_set_keepalive=0 +- var_rekey_limit_size=512M +- var_rekey_limit_time=1hour - var_accounts_user_umask=027 - var_password_pam_difok=4 - var_password_pam_maxrepeat=3 From d75161c4f7232380a1b46aa8d99fa5d562503c80 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= Date: Fri, 22 May 2020 11:43:36 +0200 Subject: [PATCH 3/5] Improved how variables are handled in remediations. --- shared/macros-ansible.jinja | 14 ++++++++++++++ shared/macros-bash.jinja | 15 +++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja index 56a3f5f3ec..6798a25d1f 100644 --- a/shared/macros-ansible.jinja +++ b/shared/macros-ansible.jinja @@ -1,3 +1,17 @@ +{{# +Pass strings that correspond to XCCDF value names as arguments to this macro: +ansible_instantiate_variables("varname1", "varname2") + +Then, assume that the task that follows can work with the variable by referencing it, e.g. +value: "Setting={{ varname1 }}" + +#}} +{{%- macro ansible_instantiate_variables() -%}} +{{%- for name in varargs -%}} +- (xccdf-var {{{ name }}}) +{{% endfor -%}} +{{%- endmacro -%}} + {{# A wrapper over the Ansible lineinfile module. This handles the most common options for us. regex is optional and when blank, it won't be included in diff --git a/shared/macros-bash.jinja b/shared/macros-bash.jinja index 01b9e62e7b..3a94fe5dd8 100644 --- a/shared/macros-bash.jinja +++ b/shared/macros-bash.jinja @@ -1,5 +1,20 @@ {{# ##### High level macros ##### #}} +{{# +Pass strings that correspond to XCCDF value names as arguments to this macro: +bash_instantiate_variables("varname1", "varname2") + +Then, assume that variables of that names are defined and contain the correct value, e.g. +echo "Setting=$varname1" >> config_file + +#}} +{{%- macro bash_instantiate_variables() -%}} +{{%- for name in varargs -%}} +populate {{{ name }}} +{{# this line is intentionally left blank #}} +{{% endfor -%}} +{{%- endmacro -%}} + {{%- macro bash_shell_file_set(path, parameter, value, no_quotes=false) -%}} {{% if no_quotes -%}} {{% if "$" in value %}} From 912ce0a4ade9aa335c044314a6cc018f1ead1abe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= Date: Fri, 22 May 2020 11:44:08 +0200 Subject: [PATCH 4/5] Fixed Bash and Ansible remediations. --- .../ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml | 8 ++++++++ .../ssh/ssh_server/sshd_rekey_limit/bash/shared.sh | 3 +-- 2 files changed, 9 insertions(+), 2 deletions(-) create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml new file mode 100644 index 0000000000..43a2d4521f --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/ansible/shared.yml @@ -0,0 +1,8 @@ +# platform = multi_platform_all [0/453] +# reboot = false +# strategy = configure +# complexity = low +# disruption = low +{{{ ansible_instantiate_variables("var_rekey_limit_size", "var_rekey_limit_time") }}} + +{{{ ansible_sshd_set(parameter="RekeyLimit", value="{{ var_rekey_limit_size}} {{var_rekey_limit_time}}") }}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh index 2620c2d49e..0277f31392 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/bash/shared.sh @@ -3,7 +3,6 @@ # Include source function library. . /usr/share/scap-security-guide/remediation_functions -populate var_rekey_limit_size -populate var_rekey_limit_time +{{{ bash_instantiate_variables("var_rekey_limit_size", "var_rekey_limit_time") }}} {{{ bash_sshd_config_set(parameter='RekeyLimit', value="$var_rekey_limit_size $var_rekey_limit_time") }}} From d0ac47945e14017e522d523267d3a4bfb5ecdf71 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mat=C4=9Bj=20T=C3=BD=C4=8D?= Date: Fri, 22 May 2020 11:49:04 +0200 Subject: [PATCH 5/5] Improved the OVAL according to the review feedback. --- .../services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml index 57aa090948..47796e5332 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/oval/shared.xml @@ -1,5 +1,4 @@ -{{% set filepath = "/etc/ssh/sshd_config" %}} -{{% set parameter = "RekeyLimit" %}} +{{% set filepath = "/etc/ssh/sshd_config" -%}} @@ -7,7 +6,7 @@ {{{ rule_title }}} {{{- oval_affected(products) }}} - Ensure '{{{ RekeyLimit }}}' is configured with the correct value in '{{{ filepath }}}' + Ensure 'RekeyLimit' is configured with the correct value in '{{{ filepath }}}' {{{- application_not_required_or_requirement_unset() }}}