From 2f0f9914e94e2aaf614b530548d94354a8bcab2d Mon Sep 17 00:00:00 2001

From: Marcus Burghardt <maburgha@redhat.com>

Date: Thu, 13 Oct 2022 18:59:06 +0200

Subject: [PATCH 01/14] Improve rule descriptions for

 firewalld_sshd_port_enabled

It was also included the platform section since the scope of this rule

is only applicable to machines and not to containers.

---

 .../firewalld_sshd_port_enabled/rule.yml      | 24 ++++++++++++++-----

 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml

index 77ba9d3cca4..9b96faf222d 100644

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml

@@ -5,14 +5,14 @@ prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4

 title: 'Enable SSH Server firewalld Firewall Exception'

 description: |-

-    By default, inbound connections to SSH's port are allowed. If

-    the SSH server is being used but denied by the firewall, this exception should

-    be added to the firewall configuration.

+    If the SSH server is in use, inbound connections to SSH's port should be allowed to permit

+    remote access through SSH. In more restrictive firewalld settings, the SSH port should be

+    added to the proper firewalld zone in order to allow SSH remote access.

     {{{ describe_firewalld_allow(proto="tcp", service="ssh") }}}

 rationale: |-

-    If inbound SSH connections are expected, adding a firewall rule exception

+    If inbound SSH connections are expected, adding the SSH port to the proper firewalld zone

     will allow remote access through the SSH port.

 severity: medium

@@ -28,11 +28,23 @@ references:

     nist: AC-17(a),CM-6(b),CM-7(a),CM-7(b)

     srg: SRG-OS-000096-GPOS-00050

-ocil_clause: 'sshd service is disabled by firewall'

+platform: machine

+

+ocil_clause: 'sshd service is not enabled in the proper firewalld zone'

+

 ocil: |

     {{{ ocil_firewalld_allow_access(port="22", proto="tcp", service="ssh") }}}

 fixtext: |-

-    Enable sshd in firewalld configuration.

+    Enable SSH service in firewalld configuration.

     {{{ describe_firewalld_allow(proto="tcp", service="ssh") }}}

+

+warnings:

+    - general: |-

+        The remediation for this rule uses <tt>firewall-cmd</tt> and <tt>nmcli</tt> tools.

+        Therefore, it will only be executed if <tt>firewalld</tt> and <tt>NetworkManager</tt>

+        services are running. Otherwise, the remediation will be aborted and a informative message

+        will be shown in the remediation report.

+        These respective services will not be started in order to preserve any intentional change

+        in network components related to firewall and network interfaces.

From 4e76d01001398948de8d1b085964bbb1ea68626c Mon Sep 17 00:00:00 2001

From: Marcus Burghardt <maburgha@redhat.com>

Date: Fri, 14 Oct 2022 09:02:08 +0200

Subject: [PATCH 02/14] Increase robustness of firewalld_sshd_port_enabled bash

 remediation

The remediation was not capable to properly treat some special cases,

like a system with multiple interfaces. It wasn't also capable to safely

configure the correct interface since it was assuming the NetworkManager

connection file was prefixed with the network interface name. In

addition, it is not stable to manually change firewalld XML files while

a proper command is present. This commit makes the remediation reliable

and assertive by using firewall-cmd and nmcli commands.

---

 .../bash/shared.sh                            | 76 +++++++++----------

 1 file changed, 37 insertions(+), 39 deletions(-)

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/bash/shared.sh

index a328bee5c8a..e1b4f0fbd20 100644

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/bash/shared.sh

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/bash/shared.sh

@@ -5,49 +5,47 @@

 # disruption = low

 {{{ bash_package_install("firewalld") }}}

-

+{{{ bash_package_install("NetworkManager") }}}

 {{{ bash_instantiate_variables("firewalld_sshd_zone") }}}

-{{% if product in ['rhel9'] %}}

-  {{% set network_config_path = "/etc/NetworkManager/system-connections/${interface}.nmconnection" %}}

-{{% else %}}

-  {{% set network_config_path = "/etc/sysconfig/network-scripts/ifcfg-${interface}" %}}

-{{% endif %}}

+if firewall-cmd --state -q; then

+    # First make sure the SSH service is enabled in run-time for the proper zone.

+    # This is to avoid connection issues when new interfaces are addeded to this zone.

+    firewall-cmd --zone="$firewalld_sshd_zone" --add-service=ssh

-# This assumes that firewalld_sshd_zone is one of the pre-defined zones

-if [ ! -f "/etc/firewalld/zones/${firewalld_sshd_zone}.xml" ]; then

-    cp "/usr/lib/firewalld/zones/${firewalld_sshd_zone}.xml" "/etc/firewalld/zones/${firewalld_sshd_zone}.xml"

-fi

-if ! grep -q 'service name="ssh"' "/etc/firewalld/zones/${firewalld_sshd_zone}.xml"; then

-    sed -i '/<\/description>/a \

-  <service name="ssh"/>' "/etc/firewalld/zones/${firewalld_sshd_zone}.xml"

-fi

+    if systemctl is-active NetworkManager; then

+        # This will collect all NetworkManager connections names

+        readarray -t nm_connections < <(nmcli --fields CONNECTION device status | grep -v "\-\-" | tail -n+2)

-# Check if any eth interface is bounded to the zone with SSH service enabled

-nic_bound=false

-readarray -t eth_interface_list < <(ip link show up | cut -d ' ' -f2 | cut -d ':' -s -f1 | grep -E '^(en|eth)')

-for interface in "${eth_interface_list[@]}"; do

-    if grep -qi "ZONE=$firewalld_sshd_zone" "{{{ network_config_path }}}"; then

-        nic_bound=true

-        break;

-    fi

-done

-

-if [ $nic_bound = false ];then

-    # Add first NIC to SSH enabled zone

-    interface="${eth_interface_list[0]}"

-

-    if ! firewall-cmd --state -q; then

-        {{% if product in ['rhel9'] %}}

-          {{{ bash_replace_or_append(network_config_path, '^zone=', "$firewalld_sshd_zone", '%s=%s') | indent(8) }}}

-        {{% else %}}

-          {{{ bash_replace_or_append(network_config_path, '^ZONE=', "$firewalld_sshd_zone", '%s=%s') | indent(8) }}}

-        {{% endif %}}

+        # If the connection is not yet assigned to a firewalld zone, assign it to the proper zone.

+        # This will not change connections which are already assigned to any firewalld zone.

+        for connection in $nm_connections; do

+            current_zone=$(nmcli -f connection.zone connection show "$connection" | awk '{ print $2}')

+            if [ $current_zone = "--" ]; then

+                nmcli connection modify "$connection" connection.zone $firewalld_sshd_zone

+            fi

+        done

+        systemctl restart NetworkManager

     else

-        # If firewalld service is running, we need to do this step with firewall-cmd

-        # Otherwise firewalld will communicate with NetworkManage and will revert assigned zone

-        # of NetworkManager managed interfaces upon reload

-        firewall-cmd --permanent --zone="$firewalld_sshd_zone" --add-interface="${eth_interface_list[0]}"

-        firewall-cmd --reload

+        echo "

+        NetworkManager service is not active. Remediation aborted!

+        This remediation could not be applied because it depends on NetworkManager service running.

+        The service is not started by this remediation in order to prevent connection issues."

+        exit 1

     fi

+

+    # Active zones are zones with at least one interface assigned to it.

+    # It is possible that traffic is comming by any active interface and consequently any

+    # active zone. So, this make sure all active zones are permanently allowing SSH service.

+    readarray -t firewalld_active_zones < <(firewall-cmd --get-active-zones | grep -v interfaces)

+    for zone in $firewalld_active_zones; do

+        firewall-cmd --permanent --zone="$zone" --add-service=ssh

+    done

+    firewall-cmd --reload

+else

+    echo "

+    firewalld service is not active. Remediation aborted!

+    This remediation could not be applied because it depends on firewalld service running.

+    The service is not started by this remediation in order to prevent connection issues."

+    exit 1

 fi

From a1fe2e8c34f8dbbaf573e6d6fa37b8e4fc63ad09 Mon Sep 17 00:00:00 2001

From: Marcus Burghardt <maburgha@redhat.com>

Date: Wed, 19 Oct 2022 13:19:46 +0200

Subject: [PATCH 03/14] Include warning message regarging custom SSH port

---

 .../ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml    | 7 +++++++

 1 file changed, 7 insertions(+)

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml

index 9b96faf222d..d49a2af1d02 100644

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml

@@ -48,3 +48,10 @@ warnings:

         will be shown in the remediation report.

         These respective services will not be started in order to preserve any intentional change

         in network components related to firewall and network interfaces.

+    - general: |-

+        This rule also checks if the SSH port was modified by the administrator and is reflecting

+        the expected port number. Although this is checked, fixing the custom ssh.xml file is not

+        in the scope of the remediation since there is no reliable way to manually change the

+        respective file. If the default SSH port is modified, it is on the administrator

+        responsibility to ensure the firewalld customizations in the service port level are

+        properly configured.

From b7c665bd163acb0595438223e4ebaa6a34e674a0 Mon Sep 17 00:00:00 2001

From: Marcus Burghardt <maburgha@redhat.com>

Date: Fri, 14 Oct 2022 15:03:33 +0200

Subject: [PATCH 04/14] Review test scenario scripts

---

 .../tests/no_nic_in_ssh_zone.fail.sh                       | 7 +------

 .../firewalld_sshd_port_enabled/tests/no_ssh_zone.fail.sh  | 4 ----

 .../tests/ssh_zone_and_nic_mismatch.fail.sh                | 4 ----

 .../tests/ssh_zone_nic_bounded.pass.sh                     | 3 ---

 4 files changed, 1 insertion(+), 17 deletions(-)

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_nic_in_ssh_zone.fail.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_nic_in_ssh_zone.fail.sh

index 7ed0c21ed1e..21d7c0eafc4 100644

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_nic_in_ssh_zone.fail.sh

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_nic_in_ssh_zone.fail.sh

@@ -1,9 +1,5 @@

 #!/bin/bash

 # packages = firewalld

-#

-# remediation = none

-

-# ensure firewalld installed

 # Make sure there is a zone with ssh service enabled

 firewall-cmd --permanent --zone=work --add-service=ssh

@@ -11,8 +7,7 @@ firewall-cmd --permanent --zone=work --add-service=ssh

 all_zones=$(firewall-cmd --get-zones)

 eth_interfaces=$(ip link show up | cut -d ' ' -f2 | cut -d ':' -s -f1 | grep -E '^(en|eth)')

-# Make sure NICs are bounded to no zone

-# Note: Interfaces managed by NetworkManager will be assigned to the default firewalld zone

+# Make sure all NICs are not bounded to any zone

 for zone in $all_zones; do

     for interface in $eth_interfaces; do

         firewall-cmd --permanent --zone=$zone --remove-interface=$interface

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_ssh_zone.fail.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_ssh_zone.fail.sh

index 78918c9fee5..41fb83d9489 100644

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_ssh_zone.fail.sh

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_ssh_zone.fail.sh

@@ -1,9 +1,5 @@

 #!/bin/bash

 # packages = firewalld

-#

-# remediation = none

-

-# ensure firewalld installed

 all_zones=$(firewall-cmd --get-zones)

 for zone in $all_zones;do

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_and_nic_mismatch.fail.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_and_nic_mismatch.fail.sh

index fed30230588..ab05492f74d 100644

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_and_nic_mismatch.fail.sh

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_and_nic_mismatch.fail.sh

@@ -1,9 +1,5 @@

 #!/bin/bash

 # packages = firewalld

-#

-# remediation = none

-

-# ensure firewalld installed

 # Make sure there is only one zone with ssh service enabled

 all_zones=$(firewall-cmd --get-zones)

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_nic_bounded.pass.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_nic_bounded.pass.sh

index f426236466f..eabc38e7248 100644

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_nic_bounded.pass.sh

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_nic_bounded.pass.sh

@@ -1,8 +1,5 @@

 #!/bin/bash

 # packages = firewalld

-#

-

-# ensure firewalld installed

 firewall-cmd --permanent --zone=public --add-service=ssh

From 32a41b09b0b963e3fb681a5ea617e96383e2277c Mon Sep 17 00:00:00 2001

From: Marcus Burghardt <maburgha@redhat.com>

Date: Wed, 19 Oct 2022 08:39:04 +0200

Subject: [PATCH 05/14] Reinvent the test scenarios for

 firewalld_sshd_port_enabled

The test scenarios were aligned to the old remediation approach, making

them also incomplete and incapable to catch real cases. Once the

remediation was robust, test scenarios also need the same level of

robustness in order to ensure the rules is as much realistic as

possible. They are now covering cases with multiple interfaces and

multiple active zones. It is also covered custom SSH port.

---

 .../tests/customized_zone_configured.pass.sh  | 37 +++++++++++++++++

 .../tests/customized_zone_without_ssh.fail.sh | 37 +++++++++++++++++

 .../tests/new_zone_configured.pass.sh         | 39 ++++++++++++++++++

 .../tests/new_zone_without_ssh.fail.sh        | 40 +++++++++++++++++++

 .../tests/no_nic_in_ssh_zone.fail.sh          | 18 ---------

 .../tests/no_ssh_zone.fail.sh                 | 10 -----

 .../tests/only_nics_configured.fail.sh        | 35 ++++++++++++++++

 .../tests/only_zones_configured.fail.sh       | 34 ++++++++++++++++

 .../tests/ssh_port_enabled.pass.sh            |  5 ---

 .../tests/ssh_zone_and_nic_mismatch.fail.sh   | 25 ------------

 .../tests/ssh_zone_nic_bounded.pass.sh        |  8 ----

 .../tests/zones_and_nics_configured.pass.sh   | 34 ++++++++++++++++

 .../zones_and_nics_ok_no_custom_files.pass.sh | 39 ++++++++++++++++++

 .../zones_and_nics_ok_port_changed.pass.sh    | 38 ++++++++++++++++++

 14 files changed, 333 insertions(+), 66 deletions(-)

 create mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/customized_zone_configured.pass.sh

 create mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/customized_zone_without_ssh.fail.sh

 create mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/new_zone_configured.pass.sh

 create mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/new_zone_without_ssh.fail.sh

 delete mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_nic_in_ssh_zone.fail.sh

 delete mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_ssh_zone.fail.sh

 create mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/only_nics_configured.fail.sh

 create mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/only_zones_configured.fail.sh

 delete mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_port_enabled.pass.sh

 delete mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_and_nic_mismatch.fail.sh

 delete mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_nic_bounded.pass.sh

 create mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/zones_and_nics_configured.pass.sh

 create mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/zones_and_nics_ok_no_custom_files.pass.sh

 create mode 100644 linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/zones_and_nics_ok_port_changed.pass.sh

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/customized_zone_configured.pass.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/customized_zone_configured.pass.sh

new file mode 100644

index 00000000000..9bfd1737dc8

--- /dev/null

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/customized_zone_configured.pass.sh

@@ -0,0 +1,37 @@

+#!/bin/bash

+# packages = firewalld, NetworkManager

+# variables = firewalld_sshd_zone=work

+

+# Ensure the required services are started.

+systemctl start firewalld NetworkManager

+

+# Ensure the SSH service is enabled in run-time for the proper zone.

+# This is to avoid connection issues when new interfaces are addeded to this zone.

+firewall-cmd --zone=work --add-service=ssh

+

+# Collect all NetworkManager connections names.

+readarray -t nm_connections < <(nmcli --fields CONNECTION device status | grep -v "\-\-" | tail -n+2)

+

+# If the connection is not yet assigned to a firewalld zone, assign it to the proper zone.

+# This will not change connections which are already assigned to any firewalld zone.

+for connection in $nm_connections; do

+    current_zone=$(nmcli -f connection.zone connection show "$connection" | awk '{ print $2}')

+    if [ $current_zone = "--" ]; then

+        nmcli connection modify "$connection" connection.zone "work"

+    fi

+done

+systemctl restart NetworkManager

+

+# Active zones are zones with at least one interface assigned to it.

+readarray -t firewalld_active_zones < <(firewall-cmd --get-active-zones | grep -v interfaces)

+

+# It is possible that traffic is comming by any active interface and consequently any

+# active zone. So, this make sure all active zones are permanently allowing SSH service.

+# Most of the zones already allow ssh, so it is also allowed http to ensure a custom file is

+# created in /etc/firewalld/zones.

+for zone in $firewalld_active_zones; do

+    firewall-cmd --permanent --zone="$zone" --add-service=ssh

+    firewall-cmd --permanent --zone="$zone" --add-service=http

+done

+

+firewall-cmd --reload

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/customized_zone_without_ssh.fail.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/customized_zone_without_ssh.fail.sh

new file mode 100644

index 00000000000..f1d152c683e

--- /dev/null

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/customized_zone_without_ssh.fail.sh

@@ -0,0 +1,37 @@

+#!/bin/bash

+# packages = firewalld, NetworkManager

+# variables = firewalld_sshd_zone=work

+

+# Ensure the required services are started.

+systemctl start firewalld NetworkManager

+

+# Ensure the SSH service is enabled in run-time for the proper zone.

+# This is to avoid connection issues when new interfaces are addeded to this zone.

+firewall-cmd --zone=work --add-service=ssh

+

+# Collect all NetworkManager connections names.

+readarray -t nm_connections < <(nmcli --fields CONNECTION device status | grep -v "\-\-" | tail -n+2)

+

+# If the connection is not yet assigned to a firewalld zone, assign it to the proper zone.

+# This will not change connections which are already assigned to any firewalld zone.

+for connection in $nm_connections; do

+    current_zone=$(nmcli -f connection.zone connection show "$connection" | awk '{ print $2}')

+    if [ $current_zone = "--" ]; then

+        nmcli connection modify "$connection" connection.zone "work"

+    fi

+done

+systemctl restart NetworkManager

+

+# Active zones are zones with at least one interface assigned to it.

+readarray -t firewalld_active_zones < <(firewall-cmd --get-active-zones | grep -v interfaces)

+

+# It is possible that traffic is comming by any active interface and consequently any

+# active zone. So, this make sure all active zones are permanently allowing SSH service.

+# It is to ensure a custom file is created in /etc/firewalld/zones.

+for zone in $firewalld_active_zones; do

+    firewall-cmd --permanent --zone="$zone" --remove-service=ssh

+    firewall-cmd --permanent --zone="$zone" --add-service=http

+done

+

+# Do not reload, otherwise SSG Test suite will be locked out.

+#firewall-cmd --reload

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/new_zone_configured.pass.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/new_zone_configured.pass.sh

new file mode 100644

index 00000000000..cb8849b3f9f

--- /dev/null

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/new_zone_configured.pass.sh

@@ -0,0 +1,39 @@

+#!/bin/bash

+# packages = firewalld, NetworkManager

+# variables = firewalld_sshd_zone=work

+

+# Ensure the required services are started.

+systemctl start firewalld NetworkManager

+

+# Create a custom zone

+custom_zone_name="custom"

+firewall-cmd --new-zone=$custom_zone_name --permanent

+firewall-cmd --reload

+

+# Ensure the SSH service is enabled in run-time for the proper zone.

+# This is to avoid connection issues when new interfaces are addeded to this zone.

+firewall-cmd --zone=$custom_zone_name --add-service=ssh

+

+# Collect all NetworkManager connections names.

+readarray -t nm_connections < <(nmcli --fields CONNECTION device status | grep -v "\-\-" | tail -n+2)

+

+# If the connection is not yet assigned to a firewalld zone, assign it to the proper zone.

+# This will not change connections which are already assigned to any firewalld zone.

+for connection in $nm_connections; do

+    current_zone=$(nmcli -f connection.zone connection show "$connection" | awk '{ print $2}')

+    if [ $current_zone = "--" ]; then

+        nmcli connection modify "$connection" connection.zone "$custom_zone_name"

+    fi

+done

+systemctl restart NetworkManager

+

+# Active zones are zones with at least one interface assigned to it.

+readarray -t firewalld_active_zones < <(firewall-cmd --get-active-zones | grep -v interfaces)

+

+# It is possible that traffic is comming by any active interface and consequently any

+# active zone. So, this make sure all active zones are permanently allowing SSH service.

+for zone in $firewalld_active_zones "$custom_zone_name"; do

+    firewall-cmd --permanent --zone="$zone" --add-service=ssh

+done

+

+firewall-cmd --reload

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/new_zone_without_ssh.fail.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/new_zone_without_ssh.fail.sh

new file mode 100644

index 00000000000..5e0a6453df7

--- /dev/null

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/new_zone_without_ssh.fail.sh

@@ -0,0 +1,40 @@

+#!/bin/bash

+# packages = firewalld, NetworkManager

+# variables = firewalld_sshd_zone=work

+

+# Ensure the required services are started.

+systemctl start firewalld NetworkManager

+

+# Create a custom zone

+custom_zone_name="custom"

+firewall-cmd --new-zone=$custom_zone_name --permanent

+firewall-cmd --reload

+

+# Ensure the SSH service is enabled in run-time for the proper zone.

+# This is to avoid connection issues when new interfaces are addeded to this zone.

+firewall-cmd --zone=$custom_zone_name --add-service=ssh

+

+# Collect all NetworkManager connections names.

+readarray -t nm_connections < <(nmcli --fields CONNECTION device status | grep -v "\-\-" | tail -n+2)

+

+# If the connection is not yet assigned to a firewalld zone, assign it to the proper zone.

+# This will not change connections which are already assigned to any firewalld zone.

+for connection in $nm_connections; do

+    current_zone=$(nmcli -f connection.zone connection show "$connection" | awk '{ print $2}')

+    if [ $current_zone = "--" ]; then

+        nmcli connection modify "$connection" connection.zone "$custom_zone_name"

+    fi

+done

+systemctl restart NetworkManager

+

+# Active zones are zones with at least one interface assigned to it.

+readarray -t firewalld_active_zones < <(firewall-cmd --get-active-zones | grep -v interfaces)

+

+# It is possible that traffic is comming by any active interface and consequently any

+# active zone. So, this make sure all active zones are permanently allowing SSH service.

+for zone in $firewalld_active_zones "$custom_zone_name"; do

+    firewall-cmd --permanent --zone="$zone" --remove-service=ssh

+done

+

+# Do not reload, otherwise SSG Test suite will be locked out.

+#firewall-cmd --reload

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_nic_in_ssh_zone.fail.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_nic_in_ssh_zone.fail.sh

deleted file mode 100644

index 21d7c0eafc4..00000000000

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_nic_in_ssh_zone.fail.sh

+++ /dev/null

@@ -1,18 +0,0 @@

-#!/bin/bash

-# packages = firewalld

-

-# Make sure there is a zone with ssh service enabled

-firewall-cmd --permanent --zone=work --add-service=ssh

-

-all_zones=$(firewall-cmd --get-zones)

-eth_interfaces=$(ip link show up | cut -d ' ' -f2 | cut -d ':' -s -f1 | grep -E '^(en|eth)')

-

-# Make sure all NICs are not bounded to any zone

-for zone in $all_zones; do

-    for interface in $eth_interfaces; do

-        firewall-cmd --permanent --zone=$zone --remove-interface=$interface

-    done

-done

-

-# Do not reload, otherwise SSG Test suite will be locked out

-# firewall-cmd --reload

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_ssh_zone.fail.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_ssh_zone.fail.sh

deleted file mode 100644

index 41fb83d9489..00000000000

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/no_ssh_zone.fail.sh

+++ /dev/null

@@ -1,10 +0,0 @@

-#!/bin/bash

-# packages = firewalld

-

-all_zones=$(firewall-cmd --get-zones)

-for zone in $all_zones;do

-    firewall-cmd --permanent --zone=$zone --remove-service=ssh

-done

-

-# Do not reload, otherwise SSG Test suite will be locked out

-# firewall-cmd --reload

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/only_nics_configured.fail.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/only_nics_configured.fail.sh

new file mode 100644

index 00000000000..98525db2729

--- /dev/null

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/only_nics_configured.fail.sh

@@ -0,0 +1,35 @@

+#!/bin/bash

+# packages = firewalld, NetworkManager

+# variables = firewalld_sshd_zone=work

+

+# Ensure the required services are started.

+systemctl start firewalld NetworkManager

+

+# Ensure the SSH service is enabled in run-time for the proper zone.

+# This is to avoid connection issues when new interfaces are addeded to this zone.

+firewall-cmd --zone=work --add-service=ssh

+

+# Collect all NetworkManager connections names.

+readarray -t nm_connections < <(nmcli --fields CONNECTION device status | grep -v "\-\-" | tail -n+2)

+

+# If the connection is not yet assigned to a firewalld zone, assign it to the proper zone.

+# This will not change connections which are already assigned to any firewalld zone.

+for connection in $nm_connections; do

+    current_zone=$(nmcli -f connection.zone connection show "$connection" | awk '{ print $2}')

+    if [ $current_zone = "--" ]; then

+        nmcli connection modify "$connection" connection.zone "work"

+    fi

+done

+systemctl restart NetworkManager

+

+# Active zones are zones with at least one interface assigned to it.

+readarray -t firewalld_active_zones < <(firewall-cmd --get-active-zones | grep -v interfaces)

+

+# It is possible that traffic is comming by any active interface and consequently any

+# active zone. So, this make sure all active zones are permanently allowing SSH service.

+for zone in $firewalld_active_zones; do

+    firewall-cmd --permanent --zone="$zone" --remove-service=ssh

+done

+

+# Do not reload, otherwise SSG Test suite will be locked out.

+#firewall-cmd --reload

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/only_zones_configured.fail.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/only_zones_configured.fail.sh

new file mode 100644

index 00000000000..e14d6c959dc

--- /dev/null

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/only_zones_configured.fail.sh

@@ -0,0 +1,34 @@

+#!/bin/bash

+# packages = firewalld, NetworkManager

+# variables = firewalld_sshd_zone=work

+

+# Ensure the required services are started.

+systemctl start firewalld NetworkManager

+

+# Ensure the SSH service is enabled in run-time for the proper zone.

+# This is to avoid connection issues when new interfaces are addeded to this zone.

+firewall-cmd --zone=work --add-service=ssh

+

+# Collect all NetworkManager connections names.

+readarray -t nm_connections < <(nmcli --fields CONNECTION device status | grep -v "\-\-" | tail -n+2)

+

+# If the connection is already assigned to a firewalld zone, removes the assignment.

+# This will not change connections which are not assigned to any firewalld zone.

+for connection in $nm_connections; do

+    current_zone=$(nmcli -f connection.zone connection show "$connection" | awk '{ print $2}')

+    if [ $current_zone != "--" ]; then

+        nmcli connection modify "$connection" connection.zone ""

+    fi

+done

+systemctl restart NetworkManager

+

+readarray -t firewalld_all_zones < <(firewall-cmd --get-zones)

+

+# Ensure all zones are permanently allowing SSH service.

+for zone in $firewalld_all_zones; do

+    firewall-cmd --permanent --zone="$zone" --add-service=ssh

+done

+

+# It is not a problem to reload the settings since all interfaces without an explicit assgined zone

+# will be automatically assigned to the default zone.

+firewall-cmd --reload

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_port_enabled.pass.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_port_enabled.pass.sh

deleted file mode 100644

index c9959c40937..00000000000

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_port_enabled.pass.sh

+++ /dev/null

@@ -1,5 +0,0 @@

-#!/bin/bash

-# packages = firewalld

-

-firewall-cmd --add-port=22/tcp

-firewall-cmd --add-port=22/tcp --permanent

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_and_nic_mismatch.fail.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_and_nic_mismatch.fail.sh

deleted file mode 100644

index ab05492f74d..00000000000

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_and_nic_mismatch.fail.sh

+++ /dev/null

@@ -1,25 +0,0 @@

-#!/bin/bash

-# packages = firewalld

-

-# Make sure there is only one zone with ssh service enabled

-all_zones=$(firewall-cmd --get-zones)

-for zone in $all_zones;do

-    firewall-cmd --permanent --zone=$zone --remove-service=ssh

-done

-firewall-cmd --permanent --zone=work --add-service=ssh

-

-all_interfaces=$(ip link show up | cut -d ' ' -f2 | cut -d ':' -s -f1)

-

-# Make sure NICs are bounded to no zone

-for zone in $all_zones; do

-    for interface in $all_interfaces; do

-        firewall-cmd --permanent --zone=$zone --remove-interface=$interface

-    done

-done

-

-eth_interfaces=$(echo "$all_interfaces" | grep -E '^(en|eth)')

-# Add interface to wrong zone

-firewall-cmd --permanent --zone=trusted --add-interface=${eth_interfaces[0]}

-

-# Do not reload, otherwise SSG Test suite will be locked out

-# firewall-cmd --reload

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_nic_bounded.pass.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_nic_bounded.pass.sh

deleted file mode 100644

index eabc38e7248..00000000000

--- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/ssh_zone_nic_bounded.pass.sh

+++ /dev/null

@@ -1,8 +0,0 @@

-#!/bin/bash

-# packages = firewalld

-

-firewall-cmd --permanent --zone=public --add-service=ssh

-

-eth_interface=$(ip link show up | cut -d ' ' -f2 | cut -d ':' -s -f1 | grep -E '^(en|eth)')

-

-firewall-cmd --permanent --zone=public --add-interface=${eth_interface[0]}

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/zones_and_nics_configured.pass.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/zones_and_nics_configured.pass.sh

new file mode 100644

index 00000000000..489fe6ae7e8

--- /dev/null

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/zones_and_nics_configured.pass.sh

@@ -0,0 +1,34 @@

+#!/bin/bash

+# packages = firewalld, NetworkManager

+# variables = firewalld_sshd_zone=work

+

+# Ensure the required services are started.

+systemctl start firewalld NetworkManager

+

+# Ensure the SSH service is enabled in run-time for the proper zone.

+# This is to avoid connection issues when new interfaces are addeded to this zone.

+firewall-cmd --zone=work --add-service=ssh

+

+# Collect all NetworkManager connections names.

+readarray -t nm_connections < <(nmcli --fields CONNECTION device status | grep -v "\-\-" | tail -n+2)

+

+# If the connection is not yet assigned to a firewalld zone, assign it to the proper zone.

+# This will not change connections which are already assigned to any firewalld zone.

+for connection in $nm_connections; do

+    current_zone=$(nmcli -f connection.zone connection show "$connection" | awk '{ print $2}')

+    if [ $current_zone = "--" ]; then

+        nmcli connection modify "$connection" connection.zone "work"

+    fi

+done

+systemctl restart NetworkManager

+

+# Active zones are zones with at least one interface assigned to it.

+readarray -t firewalld_active_zones < <(firewall-cmd --get-active-zones | grep -v interfaces)

+

+# It is possible that traffic is comming by any active interface and consequently any

+# active zone. So, this make sure all active zones are permanently allowing SSH service.

+for zone in $firewalld_active_zones; do

+    firewall-cmd --permanent --zone="$zone" --add-service=ssh

+done

+

+firewall-cmd --reload

diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/zones_and_nics_ok_no_custom_files.pass.sh b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/zones_and_nics_ok_no_custom_files.pass.sh

new file mode 100644

index 00000000000..c53fb99de78

--- /dev/null

+++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/tests/zones_and_nics_ok_no_custom_files.pass.sh

@@ -0,0 +1,39 @@

+#!/bin/bash

+# packages = firewalld, NetworkManager