|
 |
9e17c9 |
From e368a515911cd09727d8cd1c7e8b46dc7bdff4fa Mon Sep 17 00:00:00 2001
|
|
|
9e17c9 |
From: Gabriel Becker <ggasparb@redhat.com>
|
|
|
9e17c9 |
Date: Tue, 9 Aug 2022 17:28:33 +0200
|
|
|
9e17c9 |
Subject: [PATCH] Reintroduce back the sshd timeout rules in RHEL8 STIG
|
|
|
9e17c9 |
profile.
|
|
|
f386a0 |
|
|
|
f386a0 |
---
|
|
|
f386a0 |
.../ssh/ssh_server/sshd_set_idle_timeout/rule.yml | 1 +
|
|
|
f386a0 |
.../ssh/ssh_server/sshd_set_keepalive_0/rule.yml | 1 +
|
|
|
f386a0 |
products/rhel8/profiles/stig.profile | 14 +++++++-------
|
|
|
f386a0 |
tests/data/profile_stability/rhel8/stig.profile | 2 ++
|
|
|
f386a0 |
.../data/profile_stability/rhel8/stig_gui.profile | 2 ++
|
|
|
f386a0 |
5 files changed, 13 insertions(+), 7 deletions(-)
|
|
|
f386a0 |
|
|
|
f386a0 |
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
|
|
|
9e17c9 |
index 46ea0558a42..1e9c6172758 100644
|
|
|
f386a0 |
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
|
|
|
f386a0 |
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
|
|
|
f386a0 |
@@ -57,6 +57,7 @@ references:
|
|
|
f386a0 |
stigid@ol7: OL07-00-040320
|
|
|
f386a0 |
stigid@ol8: OL08-00-010201
|
|
|
f386a0 |
stigid@rhel7: RHEL-07-040320
|
|
|
f386a0 |
+ stigid@rhel8: RHEL-08-010201
|
|
|
f386a0 |
stigid@sle12: SLES-12-030190
|
|
|
f386a0 |
stigid@sle15: SLES-15-010280
|
|
|
f386a0 |
stigid@ubuntu2004: UBTU-20-010037
|
|
|
f386a0 |
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml
|
|
|
9e17c9 |
index 0f0693ddc6c..f6e98a61d9a 100644
|
|
|
f386a0 |
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml
|
|
|
f386a0 |
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml
|
|
|
f386a0 |
@@ -53,6 +53,7 @@ references:
|
|
|
f386a0 |
stigid@ol7: OL07-00-040340
|
|
|
f386a0 |
stigid@ol8: OL08-00-010200
|
|
|
f386a0 |
stigid@rhel7: RHEL-07-040340
|
|
|
f386a0 |
+ stigid@rhel8: RHEL-08-010200
|
|
|
f386a0 |
stigid@sle12: SLES-12-030191
|
|
|
f386a0 |
stigid@sle15: SLES-15-010320
|
|
|
f386a0 |
vmmsrg: SRG-OS-000480-VMM-002000
|
|
|
f386a0 |
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
|
|
|
9e17c9 |
index 6b44436a2b1..124b7520d3a 100644
|
|
|
f386a0 |
--- a/products/rhel8/profiles/stig.profile
|
|
|
f386a0 |
+++ b/products/rhel8/profiles/stig.profile
|
|
|
f386a0 |
@@ -170,13 +170,13 @@ selections:
|
|
|
f386a0 |
# RHEL-08-010190
|
|
|
f386a0 |
- dir_perms_world_writable_sticky_bits
|
|
|
f386a0 |
|
|
|
f386a0 |
- # These two items don't behave as they used to in RHEL8.6 and RHEL9
|
|
|
f386a0 |
- # anymore. They will be disabled for now until an alternative
|
|
|
f386a0 |
- # solution is found.
|
|
|
f386a0 |
- # # RHEL-08-010200
|
|
|
f386a0 |
- # - sshd_set_keepalive_0
|
|
|
f386a0 |
- # # RHEL-08-010201
|
|
|
f386a0 |
- # - sshd_set_idle_timeout
|
|
|
f386a0 |
+ # Although these rules have a different behavior in RHEL>=8.6
|
|
|
f386a0 |
+ # they still need to be selected so it follows exactly what STIG
|
|
|
f386a0 |
+ # states.
|
|
|
f386a0 |
+ # RHEL-08-010200
|
|
|
f386a0 |
+ - sshd_set_keepalive_0
|
|
|
f386a0 |
+ # RHEL-08-010201
|
|
|
f386a0 |
+ - sshd_set_idle_timeout
|
|
|
f386a0 |
|
|
|
f386a0 |
# RHEL-08-010210
|
|
|
f386a0 |
- file_permissions_var_log_messages
|
|
|
f386a0 |
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
|
|
|
9e17c9 |
index 47f53a9d023..6c75d0ae1b1 100644
|
|
|
f386a0 |
--- a/tests/data/profile_stability/rhel8/stig.profile
|
|
|
f386a0 |
+++ b/tests/data/profile_stability/rhel8/stig.profile
|
|
|
f386a0 |
@@ -369,6 +369,8 @@ selections:
|
|
|
f386a0 |
- sshd_enable_warning_banner
|
|
|
f386a0 |
- sshd_print_last_log
|
|
|
f386a0 |
- sshd_rekey_limit
|
|
|
f386a0 |
+- sshd_set_idle_timeout
|
|
|
f386a0 |
+- sshd_set_keepalive_0
|
|
|
f386a0 |
- sshd_use_strong_rng
|
|
|
f386a0 |
- sshd_x11_use_localhost
|
|
|
f386a0 |
- sssd_certificate_verification
|
|
|
f386a0 |
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
9e17c9 |
index c4e60ddcde5..8a7a469b940 100644
|
|
|
f386a0 |
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
f386a0 |
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
|
|
|
f386a0 |
@@ -379,6 +379,8 @@ selections:
|
|
|
f386a0 |
- sshd_enable_warning_banner
|
|
|
f386a0 |
- sshd_print_last_log
|
|
|
f386a0 |
- sshd_rekey_limit
|
|
|
f386a0 |
+- sshd_set_idle_timeout
|
|
|
f386a0 |
+- sshd_set_keepalive_0
|
|
|
f386a0 |
- sshd_use_strong_rng
|
|
|
f386a0 |
- sshd_x11_use_localhost
|
|
|
f386a0 |
- sssd_certificate_verification
|