From b2d0ce0a53dc6ec1481d1f2eaa2c3d7d0c423775 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 20 Aug 2026 09:05:07 +0300 Subject: [PATCH 1/8] Add support for SSH distributed config in sshd_use_approved_ciphers rule Adapt oval, remediations and add some tests to cover it --- .../ansible/shared.yml | 26 ++++++- .../sshd_use_approved_ciphers/bash/shared.sh | 8 ++- .../sshd_use_approved_ciphers/oval/shared.xml | 70 +++++++++++++++++-- .../correct_reduced_list_config_dir.pass.sh | 13 ++++ .../tests/correct_value_config_dir.pass.sh | 12 ++++ .../tests/correct_variable_config_dir.pass.sh | 14 ++++ .../tests/include.sh | 15 ++++ .../tests/wrong_value_conifg_dir.fail.sh | 13 ++++ 8 files changed, 164 insertions(+), 7 deletions(-) create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_reduced_list_config_dir.pass.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_value_config_dir.pass.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_variable_config_dir.pass.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/include.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/wrong_value_conifg_dir.fail.sh diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/ansible/shared.yml index 9c5892fcda67..b19325ff5cbe 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/ansible/shared.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/ansible/shared.yml @@ -5,4 +5,28 @@ # disruption = low {{{ ansible_instantiate_variables("sshd_approved_ciphers") }}} -{{{ ansible_sshd_set(parameter="Ciphers", value="{{ sshd_approved_ciphers }}", rule_title=rule_title) }}} +{{% if product in [ 'sle16', 'slmicro6' ] %}} +{{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}} +- name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists + ansible.builtin.stat: + path: {{{ sshd_main_config_file }}} + register: sshd_main_config_file_{{{ rule_id }}} +{{{ + ansible_lineinfile( + rule_title + ' - Remove /usr/etc/ssh/sshd_config.d/*.conf include directive from ' + sshd_main_config_file, + path=sshd_main_config_file, + regex='^\s*Include\s+\/usr\/etc\/ssh\/sshd_config\.d/\*\.conf', + state='absent', + when='sshd_main_config_file_' + rule_id + '.stat.exists' + ) +}}} +{{% endif %}} + +{{{ + ansible_sshd_set( + parameter="Ciphers", + value="{{ sshd_approved_ciphers }}", + config_is_distributed=sshd_distributed_config, + rule_title=rule_title + ) +}}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/bash/shared.sh index 0c9d1b452478..e966bf8ebcb3 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/bash/shared.sh +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/bash/shared.sh @@ -2,8 +2,14 @@ {{{ bash_instantiate_variables("sshd_approved_ciphers") }}} +{{% if product in ['sle16', 'slmicro6'] %}} + {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}} + {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}} +{{% endif %}} + {{{ bash_sshd_remediation( parameter="Ciphers", value="$sshd_approved_ciphers", config_is_distributed=sshd_distributed_config, - rule_id=rule_id) }}} + rule_id=rule_id) +}}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml index 52ca8097c258..dc64d5156a6d 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml @@ -1,4 +1,5 @@ {{%- set sshd_main_config = sshd_main_config_file -%}} +{{%- set sshd_drop_in_dir = sshd_config_dir -%}} {{{ oval_metadata("Limit the ciphers to those which are FIPS-approved.", rule_title=rule_title) }}} @@ -15,14 +16,29 @@ definition_ref="sshd_required_or_unset" /> - + {{% endif %}} + + {{%- if sshd_distributed_config == "true" %}} + + {{%- endif %}} + - @@ -32,8 +48,8 @@ var_sshd_config_ciphers - - + + @@ -48,6 +64,50 @@ + {{%- if sshd_distributed_config == "true" %}} + + + + + + + var_sshd_config_ciphers_config_dir + + + + + + + + {{{ sshd_drop_in_dir }}} + .*\.conf$ + ^[\s]*(?i)Ciphers(?-i)[\s]+([\w,-@]+)+[\s]*(?:#.*)?$ + 1 + + + + + + + + {{%- endif %}} + + + + + + + + obj_sshd_config_ciphers + {{% if sshd_distributed_config == "true" %}} + obj_sshd_config_ciphers_config_dir + {{% endif %}} + + + diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_reduced_list_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_reduced_list_config_dir.pass.sh new file mode 100644 index 000000000000..0a25871b380a --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_reduced_list_config_dir.pass.sh @@ -0,0 +1,13 @@ +#!/bin/bash +{{% if sshd_distributed_config == "false" %}} +# platform = Not Applicable +{{% else %}} +# platform = multi_platform_sle +{{% endif %}} + +source include.sh +{{% if product in [ 'sle16', 'slmicro6' ] %}} +touch "{{{ sshd_main_config_file }}}" +{{% endif %}} + +echo 'Ciphers aes128-ctr,aes192-ctr' >> "{{{ sshd_config_dir }}}/00-test.conf" diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_value_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_value_config_dir.pass.sh new file mode 100644 index 000000000000..9d41bd64569e --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_value_config_dir.pass.sh @@ -0,0 +1,12 @@ +#!/bin/bash +{{% if sshd_distributed_config == "false" %}} +# platform = Not Applicable +{{% else %}} +# platform = multi_platform_sle +{{% endif %}} + +source include.sh +{{% if product in [ 'sle16', 'slmicro6' ] %}} +touch "{{{ sshd_main_config_file }}}" +{{% endif %}} +echo 'Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc,rijndael-cbc@lysator.liu.se' >> "{{{ sshd_config_dir }}}/00-test.conf" diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_variable_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_variable_config_dir.pass.sh new file mode 100644 index 000000000000..1f879d5fcc97 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/correct_variable_config_dir.pass.sh @@ -0,0 +1,14 @@ +#!/bin/bash +{{% if sshd_distributed_config == "false" %}} +# platform = Not Applicable +{{% else %}} +# platform = multi_platform_sle +{{% endif %}} +# variables = sshd_approved_ciphers=ijkl158,sits,wwq-98,kl24 + +source include.sh +{{% if product in [ 'sle16', 'slmicro6' ] %}} +touch "{{{ sshd_main_config_file }}}" +{{% endif %}} + +echo 'Ciphers ijkl158,sits,wwq-98,kl24' >> "{{{ sshd_config_dir }}}/00-test.conf" diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/include.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/include.sh new file mode 100644 index 000000000000..f0c38e18588b --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/include.sh @@ -0,0 +1,15 @@ +#!/bin/bash + +declare -a SSHD_PATHS=({{{ sshd_main_config_file }}}) +{{% if product in [ 'sle16', 'slmicro6' ] %}} +SSHD_PATHS+=({{{ sshd_config_dir }}}/*) +{{% endif %}} +# clean up configurations +sed -i '/^Ciphers.*/d' "${SSHD_PATHS[@]}" + +# restore to defaults for sle16 and slmicro6 +{{% if product in [ 'sle16', 'slmicro6' ] %}} +if [ -e "{{{ sshd_main_config_file }}}" ] ; then + rm "{{{ sshd_main_config_file }}}" +fi +{{% endif %}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/wrong_value_conifg_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/wrong_value_conifg_dir.fail.sh new file mode 100644 index 000000000000..ec59cfc3f0ee --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/tests/wrong_value_conifg_dir.fail.sh @@ -0,0 +1,13 @@ +#!/bin/bash +{{% if sshd_distributed_config == "false" %}} +# platform = Not Applicable +{{% else %}} +# platform = multi_platform_sle +{{% endif %}} + +source include.sh +{{% if product in [ 'sle16', 'slmicro6' ] %}} +touch "{{{ sshd_main_config_file }}}" +{{% endif %}} +echo 'Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc,rijndael-cbc@lysator.liu.se' >> {{{ sshd_main_config_file }}} +echo 'Ciphers weak-cipher' >> "{{{ sshd_config_dir }}}/00-test.conf" From c62c09d119001383f2ba9b06a2fa8effb702df23 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 20 Aug 2026 09:06:11 +0300 Subject: [PATCH 2/8] Add support for SSH distributed config in sshd_use_approved_ciphers_ordered_stig Update oval, remediations and add tests for the drop-in config cases --- .../ansible/shared.yml | 16 ++++ .../bash/shared.sh | 5 ++ .../oval/shared.xml | 82 +++++++++++++++---- .../tests/correct_value_config_dir.pass.sh | 5 ++ .../tests/wrong_value_config_dir.fail.sh | 5 ++ 5 files changed, 97 insertions(+), 16 deletions(-) create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value_config_dir.pass.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_config_dir.fail.sh diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml index c642d4c55fb4..d6e27e7aed3f 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/ansible/shared.yml @@ -8,5 +8,21 @@ {{{ ansible_instantiate_variables('sshd_approved_ciphers') }}} {{{ ansible_sshd_set(parameter="Ciphers", value="{{ sshd_approved_ciphers }}", config_is_distributed=sshd_distributed_config, rule_title=rule_title) }}} {{%- else %}} +{{% if product in [ 'sle16', 'slmicro6' ] %}} +{{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}} +- name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists + ansible.builtin.stat: + path: {{{ sshd_main_config_file }}} + register: sshd_main_config_file_{{{ rule_id }}} +{{{ + ansible_lineinfile( + rule_title + ' - Remove /usr/etc/ssh/sshd_config.d/*.conf include directive from ' + sshd_main_config_file, + path=sshd_main_config_file, + regex='^\s*Include\s+\/usr\/etc\/ssh\/sshd_config\.d/\*\.conf', + state='absent', + when='sshd_main_config_file_' + rule_id + '.stat.exists' + ) +}}} +{{% endif %}} {{{ ansible_sshd_set(parameter="Ciphers", value="aes256-ctr,aes192-ctr,aes128-ctr", config_is_distributed=sshd_distributed_config, rule_title=rule_title) }}} {{%- endif %}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh index cedc3c42510b..317f7437b305 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/bash/shared.sh @@ -1,5 +1,10 @@ # platform = Oracle Linux 7,multi_platform_sle,multi_platform_slmicro +{{% if product in ['sle16', 'slmicro6'] %}} + {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}} + {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}} +{{% endif %}} + {{{ bash_sshd_remediation( parameter="Ciphers", value="aes256-ctr,aes192-ctr,aes128-ctr", diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml index 452e2c8e1d0f..e412a9d21903 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml @@ -1,36 +1,86 @@ {{%- set sshd_main_config = sshd_main_config_file -%}} +{{%- set sshd_drop_in_dir = sshd_config_dir -%}} - + {{{ oval_metadata("Limit the ciphers to those which are FIPS-approved.", rule_title=rule_title) }}} - + - + definition_ref="sshd_not_required_or_unset" /> + + - - + definition_ref="sshd_required_or_unset" /> + + + + {{% if product in [ 'sle16', 'slmicro6' ] %}} + + {{% endif %}} + + {{%- if sshd_distributed_config == "true" %}} + + {{%- endif %}} + + + + - - + {{% if product in [ 'sle16', 'slmicro6' ] %}} + {{{ oval_config_file_exists_test(sshd_main_config, rule_id=rule_id) }}} + {{{ oval_config_file_exists_object(sshd_main_config, rule_id=rule_id) }}} + {{% endif %}} + + - + {{{ sshd_main_config }}} ^[\s]*(?i)Ciphers(?-i)[\s]+(?=[\w]+)(aes256-ctr(?=[\w,]+|$),?)?(aes192-ctr(?=[\w,]+|$),?)?(aes128-ctr)?[\s]*(?:#.*)?$ 1 + {{%- if sshd_distributed_config == "true" %}} + + + + + + {{{ sshd_drop_in_dir }}} + .*\.conf$ + ^[\s]*(?i)Ciphers(?-i)[\s]+(?=[\w]+)(aes256-ctr(?=[\w,]+|$),?)?(aes192-ctr(?=[\w,]+|$),?)?(aes128-ctr)?[\s]*(?:#.*)?$ + 1 + + {{%- endif %}} + + + + + obj_{{{ rule_id }}} + {{% if sshd_distributed_config == "true" %}} + obj_{{{ rule_id }}}_config_dir + {{% endif %}} + + + + + + + diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value_config_dir.pass.sh new file mode 100644 index 000000000000..3fe6442102cd --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value_config_dir.pass.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +source common.sh + +echo "Ciphers $sshd_approved_ciphers" >> "{{{ sshd_config_dir }}}/00-test.conf" diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_config_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_config_dir.fail.sh new file mode 100644 index 000000000000..b7152191b8cf --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_config_dir.fail.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +source common.sh + +echo "Ciphers $sshd_approved_ciphers,weak-cipher" >> "{{{ sshd_config_dir }}}/00-test.conf" From 6bd658eca9835a8c0d8f674d8eafd8ba0c51ef2e Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 20 Aug 2026 09:08:48 +0300 Subject: [PATCH 3/8] Add support for SSH distributed config in sshd_use_approved_macs Update oval, remediations and add tests for the drop-in config cases --- .../sshd_use_approved_macs/ansible/shared.yml | 19 +++- .../sshd_use_approved_macs/bash/shared.sh | 5 ++ .../sshd_use_approved_macs/oval/shared.xml | 86 ++++++++++++++++--- .../tests/correct_value.pass.sh | 9 ++ .../tests/correct_value_config_dir.pass.sh | 13 +++ .../sshd_use_approved_macs/tests/include.sh | 15 ++++ .../tests/wrong_value.fail.sh | 2 +- .../tests/wrong_value_config_dir.fail.sh | 14 +++ ...rong_value_main_correct_config_dir.fail.sh | 14 +++ 9 files changed, 165 insertions(+), 12 deletions(-) create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value.pass.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value_config_dir.pass.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/include.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_config_dir.fail.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_main_correct_config_dir.fail.sh diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/ansible/shared.yml index e3648f27db61..fa0982687018 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/ansible/shared.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/ansible/shared.yml @@ -5,4 +5,21 @@ # disruption = low {{{ ansible_instantiate_variables("sshd_approved_macs") }}} -{{{ ansible_sshd_set(parameter="MACs", value="{{ sshd_approved_macs }}", rule_title=rule_title) }}} +{{% if product in [ 'sle16', 'slmicro6' ] %}} +{{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}} +- name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists + ansible.builtin.stat: + path: {{{ sshd_main_config_file }}} + register: sshd_main_config_file_{{{ rule_id }}} +{{{ + ansible_lineinfile( + rule_title + ' - Remove /usr/etc/ssh/sshd_config.d/*.conf include directive from ' + sshd_main_config_file, + path=sshd_main_config_file, + regex='^\s*Include\s+\/usr\/etc\/ssh\/sshd_config\.d/\*\.conf', + state='absent', + when='sshd_main_config_file_' + rule_id + '.stat.exists' + ) +}}} +{{% endif %}} + +{{{ ansible_sshd_set(parameter="MACs", value="{{ sshd_approved_macs }}", config_is_distributed=sshd_distributed_config, rule_title=rule_title) }}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/bash/shared.sh index 6eee376dbf96..584aef7c4a42 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/bash/shared.sh +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/bash/shared.sh @@ -2,6 +2,11 @@ {{{ bash_instantiate_variables("sshd_approved_macs") }}} +{{% if product in ['sle16', 'slmicro6'] %}} + {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}} + {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}} +{{% endif %}} + {{{ bash_sshd_remediation( parameter="MACs", value="$sshd_approved_macs", diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/oval/shared.xml index ce8530423105..64f074c12a16 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/oval/shared.xml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/oval/shared.xml @@ -1,4 +1,5 @@ {{%- set sshd_main_config = sshd_main_config_file -%}} +{{%- set sshd_drop_in_dir = sshd_config_dir -%}} {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.", rule_title=rule_title) }}} @@ -25,45 +26,110 @@ {{% endif %}} - + {{% endif %}} + + {{%- if sshd_distributed_config == "true" %}} + + {{%- endif %}} + - + {{% if product in [ 'sle16', 'slmicro6' ] %}} + {{{ oval_config_file_exists_test(sshd_main_config, rule_id=rule_id) }}} + {{{ oval_config_file_exists_object(sshd_main_config, rule_id=rule_id) }}} + {{% endif %}} + + - var_sshd_config_macs + var_sshd_config_approved_macs - + {{{ sshd_main_config }}} ^[\s]*(?i)MACs(?-i)[\s]+([\w,-@]+)+[\s]*(?:#.*)?$ 1 - + - + - + {{%- if sshd_distributed_config == "true" %}} + + + + + + + var_sshd_config_approved_macs_config_dir + + + + + + + + {{{ sshd_drop_in_dir }}} + .*\.conf$ + ^[\s]*(?i)MACs(?-i)[\s]+([\w,-@]+)+[\s]*(?:#.*)?$ + 1 + + + - + + {{%- endif %}} + + + + + + + + + + + + + obj_sshd_config_approved_macs + {{% if sshd_distributed_config == "true" %}} + obj_sshd_config_approved_macs_config_dir + {{% endif %}} + + + diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value.pass.sh new file mode 100644 index 000000000000..080e4934aa60 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value.pass.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# platform = multi_platform_sle +# variables = sshd_approved_macs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 + +source include.sh +{{% if product in [ 'sle16', 'slmicro6' ] %}} +touch "{{{ sshd_main_config_file }}}" +{{% endif %}} +echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' >> "{{{ sshd_main_config_file }}}" diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value_config_dir.pass.sh new file mode 100644 index 000000000000..cd3ee6b5fb39 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/correct_value_config_dir.pass.sh @@ -0,0 +1,13 @@ +#!/bin/bash +{{% if sshd_distributed_config == "false" %}} +# platform = Not Applicable +{{% else %}} +# platform = multi_platform_sle +{{% endif %}} +# variables = sshd_approved_macs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 + +source include.sh +{{% if product in [ 'sle16', 'slmicro6' ] %}} +touch "{{{ sshd_main_config_file }}}" +{{% endif %}} +echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' >> "{{{ sshd_config_dir }}}/00-test.conf" diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/include.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/include.sh new file mode 100644 index 000000000000..0bdac5e3dcd7 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/include.sh @@ -0,0 +1,15 @@ +#!/bin/bash + +declare -a SSHD_PATHS=({{{ sshd_main_config_file }}}) +{{% if product in [ 'sle16', 'slmicro6' ] %}} +SSHD_PATHS+=({{{ sshd_config_dir }}}/*) +{{% endif %}} +# clean up configurations +sed -i '/^MACs.*/d' "${SSHD_PATHS[@]}" + +# restore to defaults for sle16 and slmicro6 +{{% if product in [ 'sle16', 'slmicro6' ] %}} +if [ -e "{{{ sshd_main_config_file }}}" ] ; then + rm "{{{ sshd_main_config_file }}}" +fi +{{% endif %}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value.fail.sh index 905ec3caefda..c898a102d259 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value.fail.sh +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ol,multi_platform_rhel,multi_platform_almalinux +# platform = multi_platform_almalinux,multi_platform_ol,multi_platform_rhel,multi_platform_sle {{% if product == 'rhel8' -%}} # remediation = none {{%- endif %}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_config_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_config_dir.fail.sh new file mode 100644 index 000000000000..296c2e51d79c --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_config_dir.fail.sh @@ -0,0 +1,14 @@ +#!/bin/bash +{{% if sshd_distributed_config == "false" %}} +# platform = Not Applicable +{{% else %}} +# platform = multi_platform_sle +{{% endif %}} +# variables = sshd_approved_macs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 + +source include.sh +{{% if product in [ 'sle16', 'slmicro6' ] %}} +touch "{{{ sshd_main_config_file }}}" +{{% endif %}} +echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' >> "{{{ sshd_main_config_file }}}" +echo 'MACs weak-hmac' >> "{{{ sshd_config_dir }}}/00-test.conf" diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_main_correct_config_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_main_correct_config_dir.fail.sh new file mode 100644 index 000000000000..0d0b5232f815 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/tests/wrong_value_main_correct_config_dir.fail.sh @@ -0,0 +1,14 @@ +#!/bin/bash +{{% if sshd_distributed_config == "false" %}} +# platform = Not Applicable +{{% else %}} +# platform = multi_platform_sle +{{% endif %}} +# variables = sshd_approved_macs=hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 + +source include.sh +{{% if product in [ 'sle16', 'slmicro6' ] %}} +touch "{{{ sshd_main_config_file }}}" +{{% endif %}} +echo 'MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256' >> "{{{ sshd_config_dir }}}/00-test.conf" +echo 'MACs weak-hmac' >> "{{{ sshd_main_config_file }}}" From b6208797c653f358486fb03a3b6d65b2685be228 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 20 Aug 2026 09:39:17 +0300 Subject: [PATCH 4/8] Add support for SSH distributed config in sshd_use_approved_macs_ordered_stig Update oval, remediations and add tests for the drop-in config cases --- .../ansible/shared.yml | 16 ++++++ .../bash/shared.sh | 20 ++++++-- .../bash/ubuntu.sh | 11 ---- .../oval/shared.xml | 51 +++++++++++++++++-- .../correct_reduced_list_config_dir.pass.sh | 6 +++ .../tests/correct_value_config_dir.pass.sh | 2 +- .../tests/wrong_value_config_dir.fail.sh | 5 ++ 7 files changed, 93 insertions(+), 18 deletions(-) delete mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/ubuntu.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list_config_dir.pass.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_config_dir.fail.sh diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml index c3e236f2fcf6..fd1c274660b4 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/ansible/shared.yml @@ -8,5 +8,21 @@ {{{ ansible_instantiate_variables('sshd_approved_macs') }}} {{{ ansible_sshd_set(parameter="Macs", value="{{ sshd_approved_macs }}", config_is_distributed=sshd_distributed_config, rule_title=rule_title) }}} {{%- else %}} +{{% if product in [ 'sle16', 'slmicro6' ] %}} +{{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}} +- name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists + ansible.builtin.stat: + path: {{{ sshd_main_config_file }}} + register: sshd_main_config_file_{{{ rule_id }}} +{{{ + ansible_lineinfile( + rule_title + ' - Remove /usr/etc/ssh/sshd_config.d/*.conf include directive from ' + sshd_main_config_file, + path=sshd_main_config_file, + regex='^\s*Include\s+\/usr\/etc\/ssh\/sshd_config\.d/\*\.conf', + state='absent', + when='sshd_main_config_file_' + rule_id + '.stat.exists' + ) +}}} +{{% endif %}} {{{ ansible_sshd_set(parameter="MACs", value="hmac-sha2-512,hmac-sha2-256", config_is_distributed=sshd_distributed_config, rule_title=rule_title) }}} {{%- endif %}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh index 83cb8cb6e1c9..80d54ba980e8 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/shared.sh @@ -1,7 +1,21 @@ -# platform = Oracle Linux 7,multi_platform_sle,multi_platform_slmicro +# platform = Oracle Linux 7,multi_platform_sle,multi_platform_slmicro,multi_platform_ubuntu + +{{%- if product == 'ubuntu2404' %}} +sshd_approved_macs="hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256" +{{%- elif product == 'ubuntu2204' %}} +sshd_approved_macs="hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com" +{{%- else %}} +sshd_approved_macs="hmac-sha2-512,hmac-sha2-256" +{{%- endif %}} + +{{% if product in ['sle16', 'slmicro6'] %}} + {{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}} + {{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}} +{{% endif %}} {{{ bash_sshd_remediation( parameter="MACs", - value="hmac-sha2-512,hmac-sha2-256", + value="$sshd_approved_macs", config_is_distributed=sshd_distributed_config, - rule_id=rule_id) }}} + rule_id=rule_id) +}}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/ubuntu.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/ubuntu.sh deleted file mode 100644 index d8c80b2e2147..000000000000 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/bash/ubuntu.sh +++ /dev/null @@ -1,11 +0,0 @@ -# platform = multi_platform_ubuntu - -{{%- if product == 'ubuntu2404' %}} -sshd_approved_macs="hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256" -{{%- elif product == 'ubuntu2204' %}} -sshd_approved_macs="hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com" -{{%- else %}} -sshd_approved_macs="hmac-sha2-512,hmac-sha2-256" -{{%- endif %}} - -{{{ bash_sshd_remediation(parameter="MACs", value="$sshd_approved_macs", config_is_distributed=sshd_distributed_config, rule_id=rule_id) }}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml index 158d94d30e2b..0d2192373193 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml @@ -1,4 +1,5 @@ {{%- set sshd_main_config = sshd_main_config_file -%}} +{{%- set sshd_drop_in_dir = sshd_config_dir -%}} {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.", rule_title=rule_title) }}} @@ -15,14 +16,29 @@ definition_ref="sshd_required_or_unset" /> - + {{% endif %}} + {{%- if sshd_distributed_config == "true" %}} + + {{%- endif %}} + + - @@ -33,4 +49,33 @@ 1 + {{%- if sshd_distributed_config == "true" %}} + + + + + + {{{ sshd_drop_in_dir }}} + .*\.conf$ + ^[\s]*(?i)MACs(?-i)[\s]+(?=[\w]+)(hmac-sha2-512(?=[\w,]+|$),?)?(hmac-sha2-256)?[\s]*(?:#.*)?$ + 1 + + {{%- endif %}} + + + + obj_sshd_use_approved_macs_ordered_stig + {{%- if sshd_distributed_config == "true" %}} + obj_sshd_use_approved_macs_ordered_stig_config_dir + {{%- endif %}} + + + + + + diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list_config_dir.pass.sh new file mode 100644 index 000000000000..6e0c0bf3dc8c --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_reduced_list_config_dir.pass.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# platform = multi_platform_ol,multi_platform_rhel,multi_platform_sle,multi_platform_slmicro,multi_platform_almalinux + +source common.sh + +echo "MACs hmac-sha2-256" >> /etc/ssh/sshd_config.d/test.conf diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value_config_dir.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value_config_dir.pass.sh index 37e9c47b57c6..3a1b819cccad 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value_config_dir.pass.sh +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/correct_value_config_dir.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_ubuntu +# platform = multi_platform_sle,multi_platform_ubuntu source common.sh diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_config_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_config_dir.fail.sh new file mode 100644 index 000000000000..03930b0c33d0 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_config_dir.fail.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +source common.sh + +echo "MACs ${sshd_approved_macs},weak-hmac" >> /etc/ssh/sshd_config.d/test.conf From 41c65a08d81cbd192953b7b8db12099354bef0d7 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 20 Aug 2026 10:37:08 +0300 Subject: [PATCH 5/8] Upgrade SLE15 test docker to support ssh distributed config --- Dockerfiles/test_suite-sle15 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfiles/test_suite-sle15 b/Dockerfiles/test_suite-sle15 index 56067151ba0e..071625e5415f 100644 --- a/Dockerfiles/test_suite-sle15 +++ b/Dockerfiles/test_suite-sle15 @@ -5,7 +5,7 @@ ENV AUTH_KEYS=/root/.ssh/authorized_keys ARG CLIENT_PUBLIC_KEY ARG ADDITIONAL_PACKAGES -RUN zypper ar --no-gpgcheck http://download.opensuse.org/distribution/leap/15.5/repo/oss/ oss +RUN zypper ar --no-gpgcheck http://download.opensuse.org/distribution/leap/15.6/repo/oss/ oss RUN zypper refresh RUN true \ From 953d7c381d5e3a3babf07db69bb89436cc53fee4 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 20 Aug 2026 09:58:57 +0300 Subject: [PATCH 6/8] Fix definition of defalt main sshd config file for sle16 --- products/sle16/product.yml | 1 - tests/data/product_stability/sle16.yml | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/products/sle16/product.yml b/products/sle16/product.yml index 7d54fe73c5f7..d38ce86bdaa5 100644 --- a/products/sle16/product.yml +++ b/products/sle16/product.yml @@ -47,4 +47,3 @@ journald_conf_dir_path: /etc/systemd/journal.d xwindows_packages: - xwayland -sshd_main_config_file: /usr/etc/ssh/sshd_config diff --git a/tests/data/product_stability/sle16.yml b/tests/data/product_stability/sle16.yml index 19f74d303472..6de569a30a70 100644 --- a/tests/data/product_stability/sle16.yml +++ b/tests/data/product_stability/sle16.yml @@ -106,11 +106,11 @@ reference_uris: rsyslog_cafile: /etc/pki/tls/cert.pem ssh_client_config_dir: /etc/ssh/ssh_config.d ssh_client_main_config_file: /etc/ssh/ssh_config -sshd_config_base_dir: /usr/etc/ssh +sshd_config_base_dir: /etc/ssh sshd_config_dir: /etc/ssh/sshd_config.d sshd_distributed_config: 'true' sshd_hardening_config_basename: 00-complianceascode-hardening.conf -sshd_main_config_file: /usr/etc/ssh/sshd_config +sshd_main_config_file: /etc/ssh/sshd_config sshd_runtime_check: 'false' sshd_sysconfig_file: /etc/sysconfig/sshd sysctl_remediate_drop_in_file: 'true' From a9ead0e7f23bbf216732999a13c8792ec84525ae Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 20 Aug 2026 15:51:53 +0300 Subject: [PATCH 7/8] Improve oval checks for sshd_use_approved_macs_ordered_stig and sshd_use_approved_ciphers_ordered_stig --- .../oval/shared.xml | 19 ++++++++++++++----- .../oval/shared.xml | 18 ++++++++++++++---- 2 files changed, 28 insertions(+), 9 deletions(-) diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml index e412a9d21903..4c6cb59d92fb 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/oval/shared.xml @@ -1,5 +1,9 @@ {{%- set sshd_main_config = sshd_main_config_file -%}} {{%- set sshd_drop_in_dir = sshd_config_dir -%}} +{{% set sufix_conf="(\s.*)?" %}} +{{% set prefix_conf="^\s*Ciphers\s*" %}} +{{% set ciphers=["aes256-ctr","aes192-ctr","aes128-ctr"] %}} +{{% set ciphers_regex=prefix_conf ~ "(?=[\w-])" "(\\b" ~ ciphers|join("\\b,?)?(\\b") ~ ")?" ~ sufix_conf ~ "[\\s]*(?:#.*)?$" %}} {{{ oval_metadata("Limit the ciphers to those which are FIPS-approved.", rule_title=rule_title) }}} @@ -44,12 +48,17 @@ comment="tests the value of ciphers setting in the {{{ sshd_main_config }}} file" id="test_{{{ rule_id }}}" version="1"> + + + {{{ ciphers_regex }}} + + {{{ sshd_main_config }}} - ^[\s]*(?i)Ciphers(?-i)[\s]+(?=[\w]+)(aes256-ctr(?=[\w,]+|$),?)?(aes192-ctr(?=[\w,]+|$),?)?(aes128-ctr)?[\s]*(?:#.*)?$ - 1 + {{{ prefix_conf }}}.* + 1 {{%- if sshd_distributed_config == "true" %}} @@ -57,17 +66,17 @@ comment="tests the value of ciphers setting in the {{{ sshd_drop_in_dir }}} file" id="test_{{{ rule_id }}}_config_dir" version="1"> + {{{ sshd_drop_in_dir }}} .*\.conf$ - ^[\s]*(?i)Ciphers(?-i)[\s]+(?=[\w]+)(aes256-ctr(?=[\w,]+|$),?)?(aes192-ctr(?=[\w,]+|$),?)?(aes128-ctr)?[\s]*(?:#.*)?$ - 1 + {{{ prefix_conf }}}.* + 1 {{%- endif %}} - obj_{{{ rule_id }}} diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml index 0d2192373193..632cf6b340bd 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/oval/shared.xml @@ -1,5 +1,9 @@ {{%- set sshd_main_config = sshd_main_config_file -%}} {{%- set sshd_drop_in_dir = sshd_config_dir -%}} +{{% set sufix_conf="(\s.*)?" %}} +{{% set prefix_conf="^\s*MACs\s*" %}} +{{% set macs=["hmac-sha2-512","hmac-sha2-256"] %}} +{{% set macs_regex=prefix_conf ~ "(?=[\w-])" "(\\b" ~ macs|join("\\b,?)?(\\b") ~ ")?" ~ sufix_conf ~ "[\\s]*(?:#.*)?$" %}} {{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.", rule_title=rule_title) }}} @@ -41,12 +45,17 @@ comment="tests the value of MACs setting in {{{ sshd_main_config }}} config" id="test_sshd_use_approved_macs_ordered_stig" version="1"> + + + {{{ macs_regex }}} + + {{{ sshd_main_config }}} - ^[\s]*(?i)MACs(?-i)[\s]+(?=[\w]+)(hmac-sha2-512(?=[\w,]+|$),?)?(hmac-sha2-256)?[\s]*(?:#.*)?$ - 1 + {{{ prefix_conf }}}.* + 1 {{%- if sshd_distributed_config == "true" %}} @@ -54,13 +63,14 @@ comment="tests the value of MACs setting in {{{ sshd_drop_in_dir }}} configs" id="test_sshd_use_approved_macs_ordered_stig_config_dir" version="1"> + {{{ sshd_drop_in_dir }}} .*\.conf$ - ^[\s]*(?i)MACs(?-i)[\s]+(?=[\w]+)(hmac-sha2-512(?=[\w,]+|$),?)?(hmac-sha2-256)?[\s]*(?:#.*)?$ - 1 + {{{ prefix_conf }}}.* + 1 {{%- endif %}} From afd5252ce0b5271c538a4e1d4315c5a9f35f8c90 Mon Sep 17 00:00:00 2001 From: teacup-on-rockingchair <315160+teacup-on-rockingchair@users.noreply.github.com> Date: Thu, 20 Aug 2026 15:53:03 +0300 Subject: [PATCH 8/8] Add more tests to cover possible bad configuration with multple lines of Ciphers or Macs config --- .../tests/correct_value.pass.sh | 2 +- .../tests/wrong_value_multiple_configs_dir.fail.sh | 6 ++++++ .../tests/wrong_value_multiple_times.fail.sh | 6 ++++++ .../tests/wrong_value_multiple_configs_dir.fail.sh | 6 ++++++ .../tests/wrong_value_multiple_times.fail.sh | 6 ++++++ 5 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_times.fail.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh create mode 100644 linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_times.fail.sh diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh index 336bbf06eb0e..a4595eb09de4 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/correct_value.pass.sh @@ -2,4 +2,4 @@ source common.sh -echo "ciphers $sshd_approved_ciphers" >> /etc/ssh/sshd_config +echo "Ciphers $sshd_approved_ciphers" >> /etc/ssh/sshd_config diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh new file mode 100644 index 000000000000..722bbae9aa91 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# platform = multi_platform_sle +source common.sh + +echo "Ciphers $sshd_approved_ciphers" >> "{{{ sshd_config_dir }}}/00-test.conf" +echo "Ciphers weak-cipher" >> "{{{ sshd_config_dir }}}/01-test.conf" diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_times.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_times.fail.sh new file mode 100644 index 000000000000..abe9a4caf115 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers_ordered_stig/tests/wrong_value_multiple_times.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# platform = multi_platform_sle +source common.sh + +echo "Ciphers $sshd_approved_ciphers" >> "{{{ sshd_main_config_file }}}" +echo "Ciphers weak-cipher" >> "{{{ sshd_main_config_file }}}" diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh new file mode 100644 index 000000000000..00049c971977 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_configs_dir.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# platform = multi_platform_sle +source common.sh + +echo "MACs ${sshd_approved_macs}" >> /etc/ssh/sshd_config.d/01.conf +echo "MACs weak-hmac" >> /etc/ssh/sshd_config.d/00.conf diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_times.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_times.fail.sh new file mode 100644 index 000000000000..8a1ad21a33fd --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/tests/wrong_value_multiple_times.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# platform = multi_platform_sle +source common.sh + +echo "MACs ${sshd_approved_macs}" >> /etc/ssh/sshd_config +echo "MACs weak-hmac" >> /etc/ssh/sshd_config