rpms / scap-security-guide

Clone
Source Code
GIT

Files

  1.   f8899dc431d93f8111ec18b6783c8e69fdb47c56
  2.   SOURCES
  3.   scap-security-guide-0.1.54-add_rhel8_ospp_ssh_client_strong_entropy-PR_6404.diff
Blob Blame History Raw 
diff --git a/linux_os/guide/services/ssh/ssh_client/group.yml b/linux_os/guide/services/ssh/ssh_client/group.yml
new file mode 100644
index 0000000000..62ead28ee1
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/group.yml
@@ -0,0 +1,11 @@
+documentation_complete: true
+
+title: 'Configure OpenSSH Client if Necessary'
+
+description: |-
+    The following configuration changes apply to the SSH client. They can
+    improve security parameters relwevant to the client user, e.g. increasing
+    entropy while generating initialization vectors. Note that these changes
+    influence only the default SSH client configuration. Changes in this group
+    can be overridden by the client user by modifying files within the
+    <pre>~/.ssh</pre> directory or by supplying parameters on the command line.
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml
new file mode 100644
index 0000000000..a9f579ae04
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml
@@ -0,0 +1,19 @@
+# platform = Red Hat Enterprise Linux 8
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
+
+- name: "Ensure that correct variable is exported in /etc/profile.d/cc-ssh-strong-rng.csh"
+  lineinfile:
+    path: /etc/profile.d/cc-ssh-strong-rng.csh
+    regexp: '^[\s]*setenv[\s]+SSH_USE_STRONG_RNG.*$'
+    line: 'setenv SSH_USE_STRONG_RNG 32'
+    state: present
+    create: yes
+
+- name: "Ensure that the configuration is not overridden in /etc/profile"
+  lineinfile:
+    path: /etc/profile
+    regexp: '^[\s]*setenv[\s]+SSH_USE_STRONG_RNG.*$'
+    state: absent
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh
new file mode 100644
index 0000000000..a3b0b3a9c6
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 8
+
+# put line into the file
+echo "setenv SSH_USE_STRONG_RNG 32" > /etc/profile.d/cc-ssh-strong-rng.csh
+
+# remove eventual override in /etc/profile
+sed -i '/^[[:space:]]*setenv[[:space:]]\+SSH_USE_STRONG_RNG.*$/d' /etc/profile
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/oval/shared.xml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/oval/shared.xml
new file mode 100644
index 0000000000..fe6d3a5f25
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/oval/shared.xml
@@ -0,0 +1,36 @@
+<def-group>
+  <definition class="compliance" id="{{{ rule_id }}}" version="1">
+    {{{ oval_metadata("Ensure the SSH_USE_STRONG_RNG environment variable is exported in /etc/profile.d/cc-ssh-strong-rng.csh and is not overridden in /etc/profile") }}}
+    <criteria comment="ssh client is configured to use strong entropy" operator="AND">
+      <criterion comment="check configuration in /etc/profile.d/cc-ssh-strong-rng.csh" test_ref="test_ssh_client_strong_rng_csh" />
+      <criterion comment="check that the configuration is not overridden in /etc/profile" test_ref="test_ssh_client_strong_rng_csh_not_overridden" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check correct entropy configuration in /etc/profile.d/cc-ssh-strong-rng.csh" id="test_ssh_client_strong_rng_csh" version="1">
+    <ind:object object_ref="obj_ssh_client_strong_rng_csh"/>
+    <ind:state state_ref="state_ssh_client_strong_rng_csh" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_ssh_client_strong_rng_csh" version="1">
+    <ind:filepath>/etc/profile.d/cc-ssh-strong-rng.csh</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*setenv[\s]+SSH_USE_STRONG_RNG[\s]+([\d]+)$</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check that the configuration is not overridden in /etc/profile" id="test_ssh_client_strong_rng_csh_not_overridden" version="1">
+    <ind:object object_ref="obj_ssh_client_strong_rng_csh_not_overridden"/>
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_ssh_client_strong_rng_csh_not_overridden" version="1">
+    <ind:filepath>/etc/profile</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*setenv[\s]+SSH_USE_STRONG_RNG.*$</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_ssh_client_strong_rng_csh"
+  version="1">
+    <ind:subexpression datatype="int" operation="greater than or equal">32</ind:subexpression>
+  </ind:textfilecontent54_state>
+
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml
new file mode 100644
index 0000000000..a2b9bfa37d
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml
@@ -0,0 +1,36 @@
+documentation_complete: true
+
+prodtype: rhel8
+
+title: 'SSH client uses strong entropy to seed (for CSH like shells)'
+
+description: |-
+    To set up SSH client to use entropy from a high-quality source, make sure
+    that the appropriate shell environment variable is configured. The
+    <tt>SSH_USE_STRONG_RNG</tt> environment variable determines how many bytes
+    of entropy to use. Make sure that the file
+    <tt>/etc/profile.d/cc-ssh-strong-rng.csh</tt> contains line
+    <pre>setenv SSH_USE_STRONG_RNG 32</pre>.
+
+rationale: |-
+    Some SSH implementations use the openssl library for entropy, which by default, doesn't use high-entropy sources.
+    Randomness is needed to generate considerably more secure data-encryption keys. Plaintext padding, initialization vectors
+    in encryption algorithms, and high-quality entropy eliminates the possibility that the output of
+    the random number generator used by SSH would be known to potential attackers.
+
+severity: medium
+
+identifiers:
+    cce@rhel8: CCE-83349-1
+
+references:
+    ospp: FCS_CKM.1.1
+    srg: SRG-OS-000480-GPOS-00227
+
+ocil_clause: 'SSH client is not configured to use 32 bytes of entropy or more'
+
+ocil: |-
+    Run the following command to verify that SSH client is configured to use 32 bytes of entropy:
+    <pre>grep SSH_USE_STRONG_RNG /etc/profile.d/cc-ssh-strong-rng.csh</pre>
+    It should return the following output:
+    <pre>setenv SSH_USE_STRONG_RNG 32</pre>.
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/correct.pass.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/correct.pass.sh
new file mode 100644
index 0000000000..4cfafa9f96
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/correct.pass.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "setenv SSH_USE_STRONG_RNG 32" > /etc/profile.d/cc-ssh-strong-rng.csh
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/file_missing.fail.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/file_missing.fail.sh
new file mode 100644
index 0000000000..c2fead5697
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/file_missing.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+rm -f /etc/profile.d/cc-ssh-strong-rng.csh
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/line_commented.fail.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/line_commented.fail.sh
new file mode 100644
index 0000000000..4a0d26165b
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/line_commented.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "#setenv SSH_USE_STRONG_RNG 32" > /etc/profile.d/cc-ssh-strong-rng.csh
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/line_followed_by_wrong_line.fail.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/line_followed_by_wrong_line.fail.sh
new file mode 100644
index 0000000000..5fbccb5f29
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/line_followed_by_wrong_line.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+echo "setenv SSH_USE_STRONG_RNG 32" > /etc/profile.d/cc-ssh-strong-rng.csh
+echo "setenv SSH_USE_STRONG_RNG 8" >> /etc/profile.d/cc-ssh-strong-rng.csh
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/line_overridden_in_etc_profile.fail.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/line_overridden_in_etc_profile.fail.sh
new file mode 100644
index 0000000000..d93d1151f8
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/line_overridden_in_etc_profile.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+echo "setenv SSH_USE_STRONG_RNG 32" >> /etc/profile.d/cc-ssh-strong-rng.csh
+echo "setenv SSH_USE_STRONG_RNG 8" >> /etc/profile
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/use_more_entropy.pass.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/use_more_entropy.pass.sh
new file mode 100644
index 0000000000..d73f22ce5d
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/tests/use_more_entropy.pass.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "setenv SSH_USE_STRONG_RNG 64" > /etc/profile.d/cc-ssh-strong-rng.csh
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/ansible/shared.yml
new file mode 100644
index 0000000000..d19ee819c0
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/ansible/shared.yml
@@ -0,0 +1,19 @@
+# platform = Red Hat Enterprise Linux 8
+# reboot = false
+# strategy = configure
+# complexity = low
+# disruption = low
+
+- name: "Ensure that correct variable is exported in /etc/profile.d/cc-ssh-strong-rng.sh"
+  lineinfile:
+    path: /etc/profile.d/cc-ssh-strong-rng.sh
+    regexp: '^[\s]*export[\s]+SSH_USE_STRONG_RNG=.*$'
+    line: 'export SSH_USE_STRONG_RNG=32'
+    state: present
+    create: yes
+
+- name: "Ensure that the configuration is not overridden in /etc/profile"
+  lineinfile:
+    path: /etc/profile
+    regexp: '^[\s]*export[\s]+SSH_USE_STRONG_RNG=.*$'
+    state: absent
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/bash/shared.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/bash/shared.sh
new file mode 100644
index 0000000000..07e45f1dfa
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/bash/shared.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 8
+
+# put line into the file
+echo "export SSH_USE_STRONG_RNG=32" > /etc/profile.d/cc-ssh-strong-rng.sh
+
+# remove eventual override in /etc/profile
+sed -i '/^[[:space:]]*export[[:space:]]\+SSH_USE_STRONG_RNG=.*$/d' /etc/profile
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/oval/shared.xml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/oval/shared.xml
new file mode 100644
index 0000000000..23bda9bf83
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/oval/shared.xml
@@ -0,0 +1,36 @@
+<def-group>
+  <definition class="compliance" id="{{{ rule_id }}}" version="1">
+    {{{ oval_metadata("Ensure the SSH_USE_STRONG_RNG environment variable is exported in /etc/profile.d/cc-ssh-strong-rng.sh and is not overridden in /etc/profile") }}}
+    <criteria comment="ssh client is configured to use strong entropy" operator="AND">
+      <criterion comment="check configuration in /etc/profile.d/cc-ssh-strong-rng.sh" test_ref="test_ssh_client_strong_rng_sh" />
+      <criterion comment="check that the configuration is not overridden in /etc/profile" test_ref="test_ssh_client_strong_rng_sh_not_overridden" />
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check correct entropy configuration in /etc/profile.d/cc-ssh-strong-rng.sh" id="test_ssh_client_strong_rng_sh" version="1">
+    <ind:object object_ref="obj_ssh_client_strong_rng_sh"/>
+    <ind:state state_ref="state_ssh_client_strong_rng_sh" />
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_ssh_client_strong_rng_sh" version="1">
+    <ind:filepath>/etc/profile.d/cc-ssh-strong-rng.sh</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*export[\s]+SSH_USE_STRONG_RNG=([\d]+)$</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check that the configuration is not overridden in /etc/profile" id="test_ssh_client_strong_rng_sh_not_overridden" version="1">
+    <ind:object object_ref="obj_ssh_client_strong_rng_sh_not_overridden"/>
+  </ind:textfilecontent54_test>
+
+  <ind:textfilecontent54_object id="obj_ssh_client_strong_rng_sh_not_overridden" version="1">
+    <ind:filepath>/etc/profile</ind:filepath>
+    <ind:pattern operation="pattern match">^[\s]*export[\s]+SSH_USE_STRONG_RNG=.*$</ind:pattern>
+    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_state id="state_ssh_client_strong_rng_sh"
+  version="1">
+    <ind:subexpression datatype="int" operation="greater than or equal">32</ind:subexpression>
+  </ind:textfilecontent54_state>
+
+</def-group>
\ No newline at end of file
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/rule.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/rule.yml
new file mode 100644
index 0000000000..3de4df0a2e
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/rule.yml
@@ -0,0 +1,36 @@
+documentation_complete: true
+
+prodtype: rhel8
+
+title: 'SSH client uses strong entropy to seed (Bash-like shells)'
+
+description: |-
+    To set up SSH client to use entropy from a high-quality source, make sure
+    that the appropriate shell environment variable is configured. The
+    <tt>SSH_USE_STRONG_RNG</tt> environment variable determines how many bytes
+    of entropy to use. Make sure that the file
+    <tt>/etc/profile.d/cc-ssh-strong-rng.sh</tt> contains line
+    <pre>export SSH_USE_STRONG_RNG=32</pre>.
+
+rationale: |-
+    Some SSH implementations use the openssl library for entropy, which by default, doesn't use high-entropy sources.
+    Randomness is needed to generate considerably more secure data-encryption keys. Plaintext padding, initialization vectors
+    in encryption algorithms, and high-quality entropy eliminates the possibility that the output of
+    the random number generator used by SSH would be known to potential attackers.
+
+severity: medium
+
+identifiers:
+    cce@rhel8: CCE-83346-7
+
+references:
+    ospp: FCS_CKM.1.1
+    srg: SRG-OS-000480-GPOS-00227
+
+ocil_clause: 'SSH client is not configured to use 32 bytes of entropy or more'
+
+ocil: |-
+    Run the following command to verify that SSH client is configured to use 32 bytes of entropy:
+    <pre>grep SSH_USE_STRONG_RNG /etc/profile.d/cc-ssh-strong-rng.sh</pre>
+    The output should be:
+    <pre>export SSH_USE_STRONG_RNG=32</pre>
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/correct.pass.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/correct.pass.sh
new file mode 100644
index 0000000000..8dc01bb3b5
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/correct.pass.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "export SSH_USE_STRONG_RNG=32" > /etc/profile.d/cc-ssh-strong-rng.sh
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/file_missing.fail.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/file_missing.fail.sh
new file mode 100644
index 0000000000..feab751995
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/file_missing.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+rm -f /etc/profile.d/cc-ssh-strong-rng.sh
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/line_commented.fail.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/line_commented.fail.sh
new file mode 100644
index 0000000000..f77cfabfe4
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/line_commented.fail.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "#export SSH_USE_STRONG_RNG=32" > /etc/profile.d/cc-ssh-strong-rng.sh
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/line_followed_by_wrong_line.fail.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/line_followed_by_wrong_line.fail.sh
new file mode 100644
index 0000000000..acbe72da2c
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/line_followed_by_wrong_line.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+echo "export SSH_USE_STRONG_RNG=32" > /etc/profile.d/cc-ssh-strong-rng.sh
+echo "export SSH_USE_STRONG_RNG=8" >> /etc/profile.d/cc-ssh-strong-rng.sh
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/line_overridden_in_etc_profile.fail.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/line_overridden_in_etc_profile.fail.sh
new file mode 100644
index 0000000000..38ce27729d
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/line_overridden_in_etc_profile.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+echo "export SSH_USE_STRONG_RNG=32" > /etc/profile.d/cc-ssh-strong-rng.sh
+echo "export SSH_USE_STRONG_RNG=8" >> /etc/profile
diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/use_more_entropy.pass.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/use_more_entropy.pass.sh
new file mode 100644
index 0000000000..2b3b0fbeca
--- /dev/null
+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/tests/use_more_entropy.pass.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo "export SSH_USE_STRONG_RNG=64" > /etc/profile.d/cc-ssh-strong-rng.sh
diff --git a/rhel8/profiles/ospp.profile b/rhel8/profiles/ospp.profile
index 687b948b34..755573a6f9 100644
--- a/rhel8/profiles/ospp.profile
+++ b/rhel8/profiles/ospp.profile
@@ -427,6 +427,10 @@ selections:
     - var_ssh_client_rekey_limit_size=1G
     - var_ssh_client_rekey_limit_time=1hour
 
+# configure ssh client to use strong entropy
+    - ssh_client_use_strong_rng_sh
+    - ssh_client_use_strong_rng_csh
+
     # zIPl specific rules
     - zipl_bls_entries_only
     - zipl_bootmap_is_up_to_date
diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile
index 8bbc01f0d5..4bfb91de9d 100644
--- a/tests/data/profile_stability/rhel8/ospp.profile
+++ b/tests/data/profile_stability/rhel8/ospp.profile
@@ -175,6 +175,8 @@ selections:
 - service_systemd-coredump_disabled
 - service_usbguard_enabled
 - ssh_client_rekey_limit
+- ssh_client_use_strong_rng_csh
+- ssh_client_use_strong_rng_sh
 - sshd_disable_empty_passwords
 - sshd_disable_gssapi_auth
 - sshd_disable_kerb_auth
diff --git a/tests/data/profile_stability/rhel8/stig.profile b/tests/data/profile_stability/rhel8/stig.profile
index e1915d648b..adace8fd54 100644
--- a/tests/data/profile_stability/rhel8/stig.profile
+++ b/tests/data/profile_stability/rhel8/stig.profile
@@ -199,6 +199,8 @@ selections:
 - service_usbguard_enabled
 - smartcard_configure_cert_checking
 - ssh_client_rekey_limit
+- ssh_client_use_strong_rng_csh
+- ssh_client_use_strong_rng_sh
 - sshd_disable_empty_passwords
 - sshd_disable_gssapi_auth
 - sshd_disable_kerb_auth

Powered by Pagure 5.14.1

SSH Hostkey/Fingerprint | Documentation