|
 |
0950b5 |
From 44d270133421722ac0dfa0af9756b73d582f4d56 Mon Sep 17 00:00:00 2001
|
|
|
0950b5 |
From: Gabe <redhatrises@gmail.com>
|
|
|
0950b5 |
Date: Fri, 8 Dec 2017 11:59:13 -0700
|
|
|
0950b5 |
Subject: [PATCH] Deprecate RhostsRSAAuthentication as it have been deprecated
|
|
|
0950b5 |
in 7.4
|
|
|
0950b5 |
|
|
|
0950b5 |
- Fixes #2478
|
|
|
0950b5 |
---
|
|
|
0950b5 |
shared/checks/oval/sshd_disable_rhosts_rsa.xml | 7 +++++--
|
|
|
0950b5 |
shared/xccdf/services/ssh.xml | 9 +++++++++
|
|
|
0950b5 |
2 files changed, 14 insertions(+), 2 deletions(-)
|
|
|
0950b5 |
|
|
|
0950b5 |
diff --git a/shared/checks/oval/sshd_disable_rhosts_rsa.xml b/shared/checks/oval/sshd_disable_rhosts_rsa.xml
|
|
|
0950b5 |
index d7e00fafc..2abf88c70 100644
|
|
|
0950b5 |
--- a/shared/checks/oval/sshd_disable_rhosts_rsa.xml
|
|
|
0950b5 |
+++ b/shared/checks/oval/sshd_disable_rhosts_rsa.xml
|
|
|
0950b5 |
@@ -15,8 +15,11 @@
|
|
|
0950b5 |
<criteria comment="sshd is installed and configured" operator="AND">
|
|
|
0950b5 |
|
|
|
0950b5 |
definition_ref="sshd_required_or_unset" />
|
|
|
0950b5 |
-
|
|
|
0950b5 |
- negate="true" test_ref="test_sshd_disable_rhosts_rsa" />
|
|
|
0950b5 |
+ <criteria comment="SSH version is equal or higher than 7.4 has deprecated RhostsRSAAuthentication" operator="OR">
|
|
|
0950b5 |
+ <extend_definition comment="OpenSSH version 7.4 or higher has deprecated RhostsRSAAuthentication" definition_ref="sshd_version_equal_or_higher_than_74" />
|
|
|
0950b5 |
+
|
|
|
0950b5 |
+ negate="true" test_ref="test_sshd_disable_rhosts_rsa" />
|
|
|
0950b5 |
+ </criteria>
|
|
|
0950b5 |
</criteria>
|
|
|
0950b5 |
</criteria>
|
|
|
0950b5 |
</definition>
|
|
|
0950b5 |
diff --git a/shared/xccdf/services/ssh.xml b/shared/xccdf/services/ssh.xml
|
|
|
0950b5 |
index 6edd47ab8..53c28faa9 100644
|
|
|
0950b5 |
--- a/shared/xccdf/services/ssh.xml
|
|
|
0950b5 |
+++ b/shared/xccdf/services/ssh.xml
|
|
|
0950b5 |
@@ -603,6 +603,11 @@ following line in <tt>/etc/ssh/sshd_config</tt>:
|
|
|
0950b5 |
RhostsRSAAuthentication no
|
|
|
0950b5 |
</description>
|
|
|
0950b5 |
<ocil>
|
|
|
0950b5 |
+To check which SSH protocol version is allowed, check version of
|
|
|
0950b5 |
+<tt>openssh-server</tt> with following command:
|
|
|
0950b5 |
+$ rpm -qi openssh-server | grep Version
|
|
|
0950b5 |
+Versions equal to or higher than 7.4 have deprecated the <tt>RhostsRSAAuthentication</tt> option.
|
|
|
0950b5 |
+If version is lower than 7.4, run the following command to check configuration:
|
|
|
0950b5 |
<sshd-check-macro option="RhostsRSAAuthentication" value="no" default="yes" />
|
|
|
0950b5 |
</ocil>
|
|
|
0950b5 |
<rationale>
|
|
|
0950b5 |
@@ -610,6 +615,10 @@ Configuring this setting for the SSH daemon provides additional
|
|
|
0950b5 |
assurance that remove login via SSH will require a password, even
|
|
|
0950b5 |
in the event of misconfiguration elsewhere.
|
|
|
0950b5 |
</rationale>
|
|
|
0950b5 |
+<warning category="general">As of <tt>openssh-server</tt> version <tt>7.4</tt> and above,
|
|
|
0950b5 |
+the <tt>RhostsRSAAuthentication</tt> option has been deprecated, and the line
|
|
|
0950b5 |
+RhostsRSAAuthentication no in <tt>/etc/ssh/sshd_config</tt> is not
|
|
|
0950b5 |
+necessary.</warning>
|
|
|
0950b5 |
<ident prodtype="rhel7" cce="80373-4" />
|
|
|
0950b5 |
<oval id="sshd_disable_rhosts_rsa" value="sshd_required" />
|
|
|
0950b5 |
<ref prodtype="rhel7" stigid="040330" />
|