From 44bcccbe3a3b00ef1151089b0faacf82770bdc98 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Tue, 9 Aug 2022 13:09:07 -0500
Subject: [PATCH 8/8] Merge pull request #9318 from
 ggbecker/reintroduce-sshd-timeout

Patch-name: scap-security-guide-0.1.64-readd-sshd_timeout-rules-PR_9318.patch
Patch-status: Reintroduce back the sshd timeout rules in RHEL8 STIG profile
---
 .../ssh/ssh_server/sshd_set_idle_timeout/rule.yml  |  1 +
 .../ssh/ssh_server/sshd_set_keepalive_0/rule.yml   |  1 +
 products/rhel8/profiles/stig.profile               | 14 +++++++-------
 tests/data/profile_stability/rhel8/stig.profile    |  2 ++
 .../data/profile_stability/rhel8/stig_gui.profile  |  2 ++
 5 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
index 46ea0558a4..1e9c617275 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml
@@ -57,6 +57,7 @@ references:
     stigid@ol7: OL07-00-040320
     stigid@ol8: OL08-00-010201
     stigid@rhel7: RHEL-07-040320
+    stigid@rhel8: RHEL-08-010201
     stigid@sle12: SLES-12-030190
     stigid@sle15: SLES-15-010280
     stigid@ubuntu2004: UBTU-20-010037
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml
index 0f0693ddc6..f6e98a61d9 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml
@@ -53,6 +53,7 @@ references:
     stigid@ol7: OL07-00-040340
     stigid@ol8: OL08-00-010200
     stigid@rhel7: RHEL-07-040340
+    stigid@rhel8: RHEL-08-010200
     stigid@sle12: SLES-12-030191
     stigid@sle15: SLES-15-010320
     vmmsrg: SRG-OS-000480-VMM-002000
diff --git a/products/rhel8/profiles/stig.profile b/products/rhel8/profiles/stig.profile
index 6b44436a2b..124b7520d3 100644
--- a/products/rhel8/profiles/stig.profile
+++ b/products/rhel8/profiles/stig.profile
@@ -170,13 +170,13 @@ selections:
     # RHEL-08-010190
     - dir_perms_world_writable_sticky_bits
 
-    # These two items don't behave as they used to in RHEL8.6 and RHEL9
-    # anymore. They will be disabled for now until an alternative
-    # solution is found.
-    # # RHEL-08-010200
-    # - sshd_set_keepalive_0
-    # # RHEL-08-010201
-    # - sshd_set_idle_timeout
+    # Although these rules have a different behavior in RHEL>=8.6
+    # they still need to be selected so it follows exactly what STIG
+    # states.
+    # RHEL-08-010200
+    - sshd_set_keepalive_0
+    # RHEL-08-010201
+    - sshd_set_idle_timeout
 
     # RHEL-08-010210
     - file_permissions_var_log_messages
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index 47f53a9d02..6c75d0ae1b 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -369,6 +369,8 @@ selections:
 - sshd_enable_warning_banner
 - sshd_print_last_log
 - sshd_rekey_limit
+- sshd_set_idle_timeout
+- sshd_set_keepalive_0
 - sshd_use_strong_rng
 - sshd_x11_use_localhost
 - sssd_certificate_verification
diff --git a/tests/data/profile_stability/rhel8/stig_gui.profile b/tests/data/profile_stability/rhel8/stig_gui.profile
index c4e60ddcde..8a7a469b94 100644
--- a/tests/data/profile_stability/rhel8/stig_gui.profile
+++ b/tests/data/profile_stability/rhel8/stig_gui.profile
@@ -379,6 +379,8 @@ selections:
 - sshd_enable_warning_banner
 - sshd_print_last_log
 - sshd_rekey_limit
+- sshd_set_idle_timeout
+- sshd_set_keepalive_0
 - sshd_use_strong_rng
 - sshd_x11_use_localhost
 - sssd_certificate_verification
-- 
2.37.1