SLE fixes for sshd distributed config for approved macs and ciphers rules

[teacup-on-rockingchair]

Description:

• Add support for SSH distributed config in sshd_use_approved_macs, sshd_use_approved_macs_ordered_stig,sshd_use_approved_ciphers_ordered_stig,sshd_use_approved_ciphers

Rationale:

• Update oval, remediations and add tests for the drop-in config case so when drop-in configuration exists oval checks will make sure that all the ciphers/macs defined either in the main config or in drop-in configuration match the approved ones

• Remediations by default use drop-in configuration

• If configuration does not exist in /etc/ssh/ distro default is copied from /usr/etc/ssh with commented includes, not to complicate result configuration

• Fixes Some ssh rules write remediation to /etc/ssh/sshd_config.d/ but check /etc/ssh/sshd_config #14926

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers' differs.
--- oval:ssg-sshd_use_approved_ciphers:def:1
+++ oval:ssg-sshd_use_approved_ciphers:def:1
@@ -6,3 +6,4 @@
 extend_definition oval:ssg-sshd_required_or_unset:def:1
 extend_definition oval:ssg-package_openssh-server_installed:def:1
 criterion oval:ssg-test_sshd_use_approved_ciphers:tst:1
+criterion oval:ssg-test_sshd_ciphers_exists:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers' differs.
--- xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
+++ xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
@@ -2,6 +2,8 @@
 if rpm --quiet -q kernel-core; then
 
 sshd_approved_ciphers=''
+
+
 
 
 

OVAL for rule 'xccdf_org.ssgproject.content_rule_sshd_use_approved_macs' differs.
--- oval:ssg-sshd_use_approved_macs:def:1
+++ oval:ssg-sshd_use_approved_macs:def:1
@@ -6,3 +6,4 @@
 extend_definition oval:ssg-sshd_required_or_unset:def:1
 extend_definition oval:ssg-package_openssh-server_installed:def:1
 criterion oval:ssg-test_sshd_use_approved_macs:tst:1
+criterion oval:ssg-test_sshd_approved_macs_exists:tst:1

[Copilot]

Pull request overview

This PR updates the SLE/SLE-like SSHD MACs/ciphers rules to correctly handle distributed sshd configuration (main sshd_config plus drop-in files under sshd_config.d/), aligning OVAL checks, remediations, and tests so remediation and evaluation operate on the same effective configuration.

Changes:

• Extend OVAL checks for MACs/ciphers rules to also evaluate drop-in configs when sshd_distributed_config is enabled, and add tests covering drop-in scenarios.
• Adjust SLE16 product stability data and product properties to use /etc/ssh/sshd_config as the main config path.
• Update Bash/Ansible remediations to copy distro defaults on SLE16/SLMicro6 and remove an unwanted include directive before applying settings via distributed config.

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/data/product_stability/sle16.yml	Align SLE16 sshd config paths to /etc/ssh for stability tests.
products/sle16/product.yml	Remove explicit sshd_main_config_file override so defaults apply.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value.fail.sh	Expand platform coverage to include SLE.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_main_correct_config_dir.fail.sh	Add failing test covering mixed main + drop-in cases.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_config_dir.fail.sh	Add failing test covering incorrect drop-in config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/include.sh	Add shared test helper for MACs cleanup/reset.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value.pass.sh	Add passing test for correct MACs in main config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value_config_dir.pass.sh	Add passing test for correct MACs in drop-in config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/oval/shared.xml	Extend OVAL to validate MACs across main + drop-in configs and require presence.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/bash/shared.sh	Copy defaults/remove include on SLE16/SLMicro6 before applying remediation.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/ansible/shared.yml	Copy defaults/remove include on SLE16/SLMicro6; set MACs with distributed support.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_config_dir.fail.sh	Add failing test for ordered-STIG MACs in drop-in config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value_config_dir.pass.sh	Expand platform coverage and validate ordered-STIG drop-in pass case.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list_config_dir.pass.sh	Add passing test for reduced ordered-STIG list in drop-in config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml	Extend ordered-STIG MACs OVAL to include distributed config presence checks.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/ubuntu.sh	Remove ubuntu-specific bash remediation in favor of shared implementation.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh	Consolidate ubuntu + SLE handling; add default-copy/include removal for SLE16/SLMicro6.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml	Add default-copy/include removal for SLE16/SLMicro6 in ordered-STIG remediation path.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/wrong_value_conifg_dir.fail.sh	Add failing test for incorrect drop-in cipher config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/include.sh	Add shared test helper for ciphers cleanup/reset.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_variable_config_dir.pass.sh	Add passing test for variable-driven ciphers in drop-in config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_value_config_dir.pass.sh	Add passing test for correct ciphers in drop-in config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_reduced_list_config_dir.pass.sh	Add passing test for reduced cipher list in drop-in config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml	Extend OVAL to validate ciphers across main + drop-in configs and require presence.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/bash/shared.sh	Copy defaults/remove include on SLE16/SLMicro6 before applying remediation.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/ansible/shared.yml	Copy defaults/remove include on SLE16/SLMicro6; set ciphers with distributed support.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_config_dir.fail.sh	Add failing test for ordered-STIG ciphers in drop-in config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value_config_dir.pass.sh	Add passing test for ordered-STIG ciphers in drop-in config.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml	Refactor/extend ordered-STIG ciphers OVAL to include distributed config checks.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh	Copy defaults/remove include on SLE16/SLMicro6 before applying remediation.
linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml	Add default-copy/include removal for SLE16/SLMicro6 in ordered-STIG remediation path.
Dockerfiles/test_suite-sle15	Update openSUSE Leap repo used by the SLE15 test suite container.

Suppressed comments (2)

linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml:67

• Same issue for drop-in configs: the restrictive Ciphers regex is embedded in the object and the test lacks a state. A drop-in file containing a non-approved Ciphers line won’t produce any collected items, so it can be ignored if some other file contains a compliant line.

Recommendation: match any Ciphers directive in sshd_config.d/*.conf in the object, and enforce the approved/ordered list in a textfilecontent54_state (mirroring sshd_use_approved_kex_ordered_stig/oval/shared.xml).

  {{%- if sshd_distributed_config == "true" %}}
  <ind:textfilecontent54_test check="all" check_existence="any_exist"
    comment="tests the value of ciphers setting in the {{{ sshd_drop_in_dir }}} file"
    id="test_{{{ rule_id }}}_config_dir" version="1">
    <ind:object object_ref="obj_{{{ rule_id }}}_config_dir" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}_config_dir" version="1">
    <ind:path>{{{ sshd_drop_in_dir }}}</ind:path>
    <ind:filename operation="pattern match">.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+(?=[\w]+)(aes256-ctr(?=[\w,]+|$),?)?(aes192-ctr(?=[\w,]+|$),?)?(aes128-ctr)?[\s]*(?:#.*)?$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml:64

• Same potential false-negative applies to the drop-in directory test: the object’s restrictive pattern means a MACs line with unapproved values in one .conf can be ignored if another .conf contains an approved line.

Recommendation: have the object match any MACs directive in sshd_config.d/*.conf and use a textfilecontent54_state to validate the ordered/allowed subset, as done in sshd_use_approved_kex_ordered_stig/oval/shared.xml.

  {{%- if sshd_distributed_config == "true" %}}
  <ind:textfilecontent54_test check="all" check_existence="any_exist"
  comment="tests the value of MACs setting in {{{ sshd_drop_in_dir }}} configs"
  id="test_sshd_use_approved_macs_ordered_stig_config_dir" version="1">
    <ind:object object_ref="obj_sshd_use_approved_macs_ordered_stig_config_dir" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_sshd_use_approved_macs_ordered_stig_config_dir" version="1">
    <ind:path>{{{ sshd_drop_in_dir }}}</ind:path>
    <ind:filename operation="pattern match">.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*(?i)MACs(?-i)[\s]+(?=[\w]+)(hmac-sha2-512(?=[\w,]+|$),?)?(hmac-sha2-256)?[\s]*(?:#.*)?$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[openshift-ci]

@teacup-on-rockingchair: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	afd5252	link	true	/test e2e-aws-openshift-platform-compliance
ci/prow/e2e-aws-openshift-node-compliance	afd5252	link	false	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.