From 389d25be2b69e4e5c828d9b0b72573e0962cabb4 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 13 Jan 2021 17:07:48 +0100
Subject: [PATCH 1/4] add rule
---
.../sshd_x11_use_localhost/rule.yml | 43 +++++++++++++++++++
shared/references/cce-redhat-avail.txt | 3 --
2 files changed, 43 insertions(+), 3 deletions(-)
create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
new file mode 100644
index 0000000000..67131e509c
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
@@ -0,0 +1,43 @@
+documentation_complete: true
+
+prodtype: fedora,ol7,rhel7
+
+title: 'Prevent remote hosts from connecting to the proxy display'
+
+description: |-
+ The SSH daemon should prevent remote hosts from connecting to the proxy
+ display. Make sure that the option <tt>X11UseLocalhost</tt> is set to
+ <tt>yes</tt> within the SSH server configuration file.
+
+
+rationale: |-
+ When X11 forwarding is enabled, there may be additional exposure to the
+ server and client displays if the sshd proxy display is configured to listen
+ on the wildcard address. By default, sshd binds the forwarding server to the
+ loopback address and sets the hostname part of the <tt>DISPLAY</tt>
+ environment variable to localhost. This prevents remote hosts from
+ connecting to the proxy display.
+
+severity: medium
+
+identifiers:
+ cce@rhel7: CCE-83404-4
+
+references:
+ srg: SRG-OS-000480-GPOS-00227
+ stig@rhel7: RHEL-07-040711
+ disa: CCI-000366
+ nist: CM-6(b)
+
+ocil_clause: "the display proxy is listening on wildcard address"
+
+ocil: |-
+ {{{ ocil_sshd_option(default="yes", option="X11UseLocalhost", value="yes") }}}
+
+template:
+ name: sshd_lineinfile
+ vars:
+ missing_parameter_pass: 'false'
+ parameter: X11UseLocalhost
+ rule_id: sshd_x11_use_localhost
+ value: 'yes'
From a40b9e68305afb52c2c674848b71cbcaee25fe32 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Wed, 13 Jan 2021 17:08:08 +0100
Subject: [PATCH 2/4] add rule to the stig profile
---
rhel7/profiles/stig.profile | 1 +
1 file changed, 1 insertion(+)
diff --git a/rhel7/profiles/stig.profile b/rhel7/profiles/stig.profile
index 88b50d5ef4..817e0982e5 100644
--- a/rhel7/profiles/stig.profile
+++ b/rhel7/profiles/stig.profile
@@ -286,6 +286,7 @@ selections:
- package_vsftpd_removed
- package_tftp-server_removed
- sshd_enable_x11_forwarding
+ - sshd_x11_use_localhost
- tftpd_uses_secure_mode
- package_xorg-x11-server-common_removed
- xwindows_runlevel_target
From be2f96b80fbfb74708381e15a2a6e76c3952bbb5 Mon Sep 17 00:00:00 2001
From: vojtapolasek <krecoun@gmail.com>
Date: Fri, 15 Jan 2021 07:46:09 +0100
Subject: [PATCH 4/4] Update
linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
Co-authored-by: Gabriel Becker <ggasparb@redhat.com>
---
.../services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
index 67131e509c..7267d2443a 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml
@@ -37,7 +37,7 @@ ocil: |-
template:
name: sshd_lineinfile
vars:
- missing_parameter_pass: 'false'
+ missing_parameter_pass: 'true'
parameter: X11UseLocalhost
rule_id: sshd_x11_use_localhost
value: 'yes'