|
 |
618a7c |
From 389d25be2b69e4e5c828d9b0b72573e0962cabb4 Mon Sep 17 00:00:00 2001
|
|
|
618a7c |
From: Vojtech Polasek <vpolasek@redhat.com>
|
|
|
618a7c |
Date: Wed, 13 Jan 2021 17:07:48 +0100
|
|
|
618a7c |
Subject: [PATCH 1/4] add rule
|
|
|
618a7c |
|
|
|
618a7c |
---
|
|
|
618a7c |
.../sshd_x11_use_localhost/rule.yml | 43 +++++++++++++++++++
|
|
|
618a7c |
shared/references/cce-redhat-avail.txt | 3 --
|
|
|
618a7c |
2 files changed, 43 insertions(+), 3 deletions(-)
|
|
|
618a7c |
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
|
|
|
618a7c |
|
|
|
618a7c |
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
|
|
|
618a7c |
new file mode 100644
|
|
|
618a7c |
index 0000000000..67131e509c
|
|
|
618a7c |
--- /dev/null
|
|
|
618a7c |
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
|
|
|
618a7c |
@@ -0,0 +1,43 @@
|
|
|
618a7c |
+documentation_complete: true
|
|
|
618a7c |
+
|
|
|
618a7c |
+prodtype: fedora,ol7,rhel7
|
|
|
618a7c |
+
|
|
|
618a7c |
+title: 'Prevent remote hosts from connecting to the proxy display'
|
|
|
618a7c |
+
|
|
|
618a7c |
+description: |-
|
|
|
618a7c |
+ The SSH daemon should prevent remote hosts from connecting to the proxy
|
|
|
618a7c |
+ display. Make sure that the option <tt>X11UseLocalhost</tt> is set to
|
|
|
618a7c |
+ <tt>yes</tt> within the SSH server configuration file.
|
|
|
618a7c |
+
|
|
|
618a7c |
+
|
|
|
618a7c |
+rationale: |-
|
|
|
618a7c |
+ When X11 forwarding is enabled, there may be additional exposure to the
|
|
|
618a7c |
+ server and client displays if the sshd proxy display is configured to listen
|
|
|
618a7c |
+ on the wildcard address. By default, sshd binds the forwarding server to the
|
|
|
618a7c |
+ loopback address and sets the hostname part of the <tt>DISPLAY</tt>
|
|
|
618a7c |
+ environment variable to localhost. This prevents remote hosts from
|
|
|
618a7c |
+ connecting to the proxy display.
|
|
|
618a7c |
+
|
|
|
618a7c |
+severity: medium
|
|
|
618a7c |
+
|
|
|
618a7c |
+identifiers:
|
|
|
618a7c |
+ cce@rhel7: CCE-83404-4
|
|
|
618a7c |
+
|
|
|
618a7c |
+references:
|
|
|
618a7c |
+ srg: SRG-OS-000480-GPOS-00227
|
|
|
618a7c |
+ stig@rhel7: RHEL-07-040711
|
|
|
618a7c |
+ disa: CCI-000366
|
|
|
618a7c |
+ nist: CM-6(b)
|
|
|
618a7c |
+
|
|
|
618a7c |
+ocil_clause: "the display proxy is listening on wildcard address"
|
|
|
618a7c |
+
|
|
|
618a7c |
+ocil: |-
|
|
|
618a7c |
+ {{{ ocil_sshd_option(default="yes", option="X11UseLocalhost", value="yes") }}}
|
|
|
618a7c |
+
|
|
|
618a7c |
+template:
|
|
|
618a7c |
+ name: sshd_lineinfile
|
|
|
618a7c |
+ vars:
|
|
|
618a7c |
+ missing_parameter_pass: 'false'
|
|
|
618a7c |
+ parameter: X11UseLocalhost
|
|
|
618a7c |
+ rule_id: sshd_x11_use_localhost
|
|
|
618a7c |
+ value: 'yes'
|
|
|
618a7c |
From a40b9e68305afb52c2c674848b71cbcaee25fe32 Mon Sep 17 00:00:00 2001
|
|
|
618a7c |
From: Vojtech Polasek <vpolasek@redhat.com>
|
|
|
618a7c |
Date: Wed, 13 Jan 2021 17:08:08 +0100
|
|
|
618a7c |
Subject: [PATCH 2/4] add rule to the stig profile
|
|
|
618a7c |
|
|
|
618a7c |
---
|
|
|
618a7c |
rhel7/profiles/stig.profile | 1 +
|
|
|
618a7c |
1 file changed, 1 insertion(+)
|
|
|
618a7c |
|
|
|
618a7c |
diff --git a/rhel7/profiles/stig.profile b/rhel7/profiles/stig.profile
|
|
|
618a7c |
index 88b50d5ef4..817e0982e5 100644
|
|
|
618a7c |
--- a/rhel7/profiles/stig.profile
|
|
|
618a7c |
+++ b/rhel7/profiles/stig.profile
|
|
|
618a7c |
@@ -286,6 +286,7 @@ selections:
|
|
|
618a7c |
- package_vsftpd_removed
|
|
|
618a7c |
- package_tftp-server_removed
|
|
|
618a7c |
- sshd_enable_x11_forwarding
|
|
|
618a7c |
+ - sshd_x11_use_localhost
|
|
|
618a7c |
- tftpd_uses_secure_mode
|
|
|
618a7c |
- package_xorg-x11-server-common_removed
|
|
|
618a7c |
- xwindows_runlevel_target
|
|
|
618a7c |
|
|
|
618a7c |
From be2f96b80fbfb74708381e15a2a6e76c3952bbb5 Mon Sep 17 00:00:00 2001
|
|
|
618a7c |
From: vojtapolasek <krecoun@gmail.com>
|
|
|
618a7c |
Date: Fri, 15 Jan 2021 07:46:09 +0100
|
|
|
618a7c |
Subject: [PATCH 4/4] Update
|
|
|
618a7c |
linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
|
|
|
618a7c |
|
|
|
618a7c |
Co-authored-by: Gabriel Becker <ggasparb@redhat.com>
|
|
|
618a7c |
---
|
|
|
618a7c |
.../services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml | 2 +-
|
|
|
618a7c |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
618a7c |
|
|
|
618a7c |
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
|
|
|
618a7c |
index 67131e509c..7267d2443a 100644
|
|
|
618a7c |
--- a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
|
|
|
618a7c |
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
|
|
|
618a7c |
@@ -37,7 +37,7 @@ ocil: |-
|
|
|
618a7c |
template:
|
|
|
618a7c |
name: sshd_lineinfile
|
|
|
618a7c |
vars:
|
|
|
618a7c |
- missing_parameter_pass: 'false'
|
|
|
618a7c |
+ missing_parameter_pass: 'true'
|
|
|
618a7c |
parameter: X11UseLocalhost
|
|
|
618a7c |
rule_id: sshd_x11_use_localhost
|
|
|
618a7c |
value: 'yes'
|