controls/cis_debian13: fix section 5 title typos and complete 5.1.13 - #14983
Conversation
Verified against CIS Debian Linux 13 Benchmark v1.0.0 PDF: - 5.1.1: fix typo in title (access_to -> access to) - 5.2.6: fix title to match benchmark wording (sudo timestamp_timeout) - 5.3.3.2.2: fix title to match benchmark wording (password length) - 5.1.13: convert pending to automated. The post-quantum KEX audit checks the same KexAlgorithms line as 5.1.12, and the cis_debian13 value of sshd_strong_kex already lists mlkem768x25519-sha256 and sntrup761x25519-sha512@openssh.com first, so the existing rule mapping from 5.1.12 satisfies this control too.
|
Hi @israel-villar. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
2 participants
Description:
5.1.13(post-quantum SSH key exchange), converting it frompendingtoautomated.Rationale:
5.1.1: title had a typo,access_toinstead ofaccess to.5.2.6: title read "Ensure sudo authentication timeout is configured correctly"; the benchmark's actual title is "Ensure sudo timestamp_timeout is configured". Rule mapping (var_sudo_timestamp_timeout,sudo_require_reauthentication) was already correct, only the title was off.5.3.3.2.2: title read "Ensure minimum password length is configured"; the benchmark's actual title is "Ensure password length is configured". Rule mapping was already correct.5.1.13("Ensure sshd post-quantum cryptography key exchange algorithms are configured"): the PDF's Audit section for 5.1.13 checks the sameKexAlgorithmsline in/etc/ssh/sshd_configas control 5.1.12, just verifying that the post-quantum algorithms (sntrup761x25519-sha512, and for OpenSSH >= 9.9,mlkem768x25519-sha256) are present in it. Thecis_debian13value of thesshd_strong_kexvariable (linux_os/guide/services/ssh/sshd_strong_kex.var) already lists both of those algorithms first. So the same rule mapping used for 5.1.12 (sshd_strong_kex=cis_debian13+sshd_use_strong_kex) satisfies 5.1.13 too — there's no separate check or remediation needed. Added anotes:entry explaining the reuse, following the same pattern already used for 5.1.7'spartialstatus.Review Hints:
controls/cis_debian13.yml, section 5 (SSH Server / Privilege Escalation / PAM / User Accounts)../build_product --datastream-only debian13linux_os/guide/services/ssh/sshd_strong_kex.var(see thecis_debian13key).