Skip to content

Commit 5aedfa6

Browse files
teacup-on-rockingchairteacup-on-rockingchair
committed
For sle16 enhance the check to cover cases with sshd_config in /usr and subfolders for sshd_set_login_grace_time rule
1 parent 4e938f7 commit 5aedfa6

12 files changed

Lines changed: 207 additions & 3 deletions

‎linux_os/guide/services/ssh/ssh_server/sshd_set_login_grace_time/oval/sle16.xml‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
<def-group>
2+
<definition class="compliance" id="{{{rule_id}}}" version="1">
3+
{{{ oval_metadata("The SSH number seconds for login grace time should be set to an appropriate value.", rule_title=rule_title) }}}
4+
<criteria comment="SSH is configured correctly or is not installed" operator="OR">
5+
<criteria comment="sshd is not installed" operator="AND">
6+
<extend_definition comment="sshd is not required or requirement is unset" definition_ref="sshd_not_required_or_unset"/>
7+
<extend_definition comment="rpm package openssh-server removed" definition_ref="package_openssh-server_removed"/>
8+
</criteria>
9+
<criteria comment="sshd is installed and configured using /etc/ssh/sshd_config" operator="AND">
10+
<extend_definition comment="sshd is required or requirement is unset" definition_ref="sshd_required_or_unset"/>
11+
<extend_definition comment="rpm package openssh-server installed" definition_ref="package_openssh-server_installed"/>
12+
<criteria comment="LoginGraceTime is configured correctly in /etc/ssh/sshd_config" operator="AND">
13+
<criterion comment="SSH configuration /etc/ssh/sshd_config exists" test_ref="test_etc_ssh_sshd_config_exist"/>
14+
<criterion comment="Check LoginGraceTime in /usr/etc/ssh/sshd_config" test_ref="test_sshd_login_grace_time_etc" />
15+
<criterion comment="Check LoginGraceTime in /etc/ssh/sshd_config.d/" test_ref="test_sshd_login_grace_time_config_dir"/>
16+
<criterion comment="Check LoginGraceTime in /usr/etc/ssh/sshd_config.d/" test_ref="test_sshd_login_grace_time_usr_config_dir"/>
17+
<criterion comment="the configuration exists" test_ref="test_login_grace_time_present_etc" />
18+
</criteria>
19+
</criteria>
20+
<criteria comment="sshd is installed and configured using /usr/etc/ssh/sshd_config" operator="AND">
21+
<extend_definition comment="sshd is required or requirement is unset" definition_ref="sshd_required_or_unset" />
22+
<extend_definition comment="rpm package openssh-server installed" definition_ref="package_openssh-server_installed" />
23+
<criteria comment="LoginGraceTime is configured correctly in /usr/etc/ssh/sshd_config" operator="AND">
24+
<criterion comment="SSH configuration /etc/ssh/sshd_config does not exists" test_ref="test_etc_ssh_sshd_config_exist" negate="true"/>
25+
<criterion comment="Check LoginGraceTime in /usr/etc/ssh/sshd_config" test_ref="test_sshd_login_grace_time_usr" />
26+
<criterion comment="Check LoginGraceTime in /etc/ssh/sshd_config.d/" test_ref="test_sshd_login_grace_time_config_dir"/>
27+
<criterion comment="Check LoginGraceTime in /usr/etc/ssh/sshd_config.d/" test_ref="test_sshd_login_grace_time_usr_config_dir"/>
28+
<criterion comment="the configuration exists" test_ref="test_login_grace_time_present_usr" />
29+
</criteria>
30+
</criteria>
31+
</criteria>
32+
</definition>
33+
34+
<unix:file_test check="all" check_existence="all_exist"
35+
comment="SSH configuration /etc/ssh/sshd_config exists"
36+
id="test_etc_ssh_sshd_config_exist"
37+
state_operator="AND" version="1">
38+
<unix:object object_ref="obj_etc_ssh_sshd_config_exist"/>
39+
</unix:file_test>
40+
<unix:file_object
41+
comment="SSH configuration /etc/ssh/sshd_config exists"
42+
id="obj_etc_ssh_sshd_config_exist" version="1">
43+
<unix:filepath operation="pattern match">^/etc/ssh/sshd_config</unix:filepath>
44+
</unix:file_object>
45+
46+
<ind:textfilecontent54_test check="all" check_existence="any_exist"
47+
comment="LoginGraceTime is configured in /etc/ssh/sshd_config"
48+
id="test_sshd_login_grace_time_etc" version="1">
49+
<ind:object object_ref="object_sshd_login_grace_time_etc" />
50+
<ind:state state_ref="state_login_grace_time_value_upper_bound" />
51+
<ind:state state_ref="state_login_grace_time_value_lower_bound" />
52+
</ind:textfilecontent54_test>
53+
54+
<ind:textfilecontent54_object id="object_sshd_login_grace_time_etc" version="2">
55+
<ind:filepath>/etc/ssh/sshd_config</ind:filepath>
56+
<ind:pattern operation="pattern match">^[\s]*(?i)LoginGraceTime[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
57+
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
58+
</ind:textfilecontent54_object>
59+
60+
<ind:textfilecontent54_test check="all" check_existence="any_exist"
61+
comment="LoginGraceTime is configured in /usr/etc/ssh/sshd_config"
62+
id="test_sshd_login_grace_time_usr" version="1">
63+
<ind:object object_ref="object_sshd_login_grace_time_usr" />
64+
<ind:state state_ref="state_login_grace_time_value_upper_bound" />
65+
<ind:state state_ref="state_login_grace_time_value_lower_bound" />
66+
</ind:textfilecontent54_test>
67+
68+
<ind:textfilecontent54_object id="object_sshd_login_grace_time_usr" version="2">
69+
<ind:filepath>/usr/etc/ssh/sshd_config</ind:filepath>
70+
<ind:pattern operation="pattern match">^[\s]*(?i)LoginGraceTime[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
71+
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
72+
</ind:textfilecontent54_object>
73+
74+
<ind:textfilecontent54_test check="all" check_existence="any_exist"
75+
comment="LoginGraceTime is configured in drop-in directory /etc/ssh/sshd_config.d"
76+
id="test_sshd_login_grace_time_config_dir" version="1">
77+
<ind:object object_ref="object_sshd_login_grace_time_config_dir" />
78+
<ind:state state_ref="state_login_grace_time_value_upper_bound" />
79+
<ind:state state_ref="state_login_grace_time_value_lower_bound" />
80+
</ind:textfilecontent54_test>
81+
82+
<ind:textfilecontent54_object id="object_sshd_login_grace_time_config_dir" version="2">
83+
<ind:path>/etc/ssh/sshd_config.d</ind:path>
84+
<ind:filename operation="pattern match">.*\.conf$</ind:filename>
85+
<ind:pattern operation="pattern match">^[\s]*(?i)LoginGraceTime[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
86+
<ind:instance datatype="int">1</ind:instance>
87+
</ind:textfilecontent54_object>
88+
89+
<ind:textfilecontent54_test check="all" check_existence="any_exist"
90+
comment="LoginGraceTime is configured in included directory /usr/etc/ssh/sshd_config.d"
91+
id="test_sshd_login_grace_time_usr_config_dir" version="1">
92+
<ind:object object_ref="object_sshd_login_grace_time_usr_config_dir" />
93+
<ind:state state_ref="state_login_grace_time_value_upper_bound" />
94+
<ind:state state_ref="state_login_grace_time_value_lower_bound" />
95+
</ind:textfilecontent54_test>
96+
97+
<ind:textfilecontent54_object id="object_sshd_login_grace_time_usr_config_dir" version="2">
98+
<ind:path>/usr/etc/ssh/sshd_config.d</ind:path>
99+
<ind:filename operation="pattern match">.*\.conf$</ind:filename>
100+
<ind:pattern operation="pattern match">^[\s]*(?i)LoginGraceTime[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
101+
<ind:instance datatype="int">1</ind:instance>
102+
</ind:textfilecontent54_object>
103+
104+
<ind:textfilecontent54_state comment="upper bound of LoginGraceTime in seconds"
105+
id="state_login_grace_time_value_upper_bound" version="1">
106+
<ind:subexpression datatype="int" operation="less than or equal" var_check="all"
107+
var_ref="var_sshd_set_login_grace_time" />
108+
</ind:textfilecontent54_state>
109+
110+
<ind:textfilecontent54_state comment="lower bound of LoginGraceTime in seconds"
111+
id="state_login_grace_time_value_lower_bound" version="1">
112+
<ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
113+
</ind:textfilecontent54_state>
114+
115+
<ind:textfilecontent54_test id="test_login_grace_time_present_etc" version="1"
116+
check="all" check_existence="at_least_one_exists"
117+
comment="Verify that the value of LoginGraceTime is present">
118+
<ind:object object_ref="obj_collection_obj_sshd_set_login_grace_time" />
119+
</ind:textfilecontent54_test>
120+
121+
<ind:textfilecontent54_object comment="All confs collection" id="obj_collection_obj_sshd_set_login_grace_time" version="1">
122+
<set set_operator="UNION">
123+
<set set_operator="UNION">
124+
<object_reference>object_sshd_login_grace_time_etc</object_reference>
125+
</set>
126+
<set set_operator="UNION">
127+
<object_reference>object_sshd_login_grace_time_config_dir</object_reference>
128+
<object_reference>object_sshd_login_grace_time_usr_config_dir</object_reference>
129+
</set>
130+
</set>
131+
</ind:textfilecontent54_object>
132+
133+
<ind:textfilecontent54_test id="test_login_grace_time_present_usr" version="1"
134+
check="all" check_existence="at_least_one_exists"
135+
comment="Verify that the value of LoginGraceTime is present">
136+
<ind:object object_ref="obj_collection_obj_sshd_set_login_grace_time_usr" />
137+
</ind:textfilecontent54_test>
138+
139+
<ind:textfilecontent54_object comment="All confs collection" id="obj_collection_obj_sshd_set_login_grace_time_usr" version="1">
140+
<set set_operator="UNION">
141+
<set set_operator="UNION">
142+
<object_reference>object_sshd_login_grace_time_usr</object_reference>
143+
</set>
144+
<set set_operator="UNION">
145+
<object_reference>object_sshd_login_grace_time_config_dir</object_reference>
146+
<object_reference>object_sshd_login_grace_time_usr_config_dir</object_reference>
147+
</set>
148+
</set>
149+
</ind:textfilecontent54_object>
150+
151+
<external_variable comment="logingracetime value" datatype="int" id="var_sshd_set_login_grace_time" version="1" />
152+
153+
</def-group>

‎linux_os/guide/services/ssh/ssh_server/sshd_set_login_grace_time/tests/correct_value_etc_sshd_config_drop_in.pass.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
source include.sh
4+
5+
echo "LoginGraceTime 60" >> /etc/ssh/sshd_config.d/01-complianceascode.conf

‎linux_os/guide/services/ssh/ssh_server/sshd_set_login_grace_time/tests/correct_value_in_usr_etc_sshd_config_present.fail.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
source include.sh
4+
5+
touch /etc/ssh/sshd_config
6+
echo "LoginGraceTime 1" >> /usr/etc/ssh/sshd_config

‎linux_os/guide/services/ssh/ssh_server/sshd_set_login_grace_time/tests/correct_value_usr_etc_sshd_config.pass.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
source include.sh
4+
5+
echo "LoginGraceTime 1" >> /usr/etc/ssh/sshd_config

‎linux_os/guide/services/ssh/ssh_server/sshd_set_login_grace_time/tests/correct_value_usr_etc_sshd_config_drop_in.pass.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
source include.sh
4+
5+
echo "LoginGraceTime 60" >> /usr/etc/ssh/sshd_config.d/01-complianceascode.conf

‎linux_os/guide/services/ssh/ssh_server/sshd_set_login_grace_time/tests/include.sh‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
3+
declare -a SSHD_PATHS=("/etc/ssh/sshd_config")
4+
{{% if product == 'sle16' %}}
5+
SSHD_PATHS+=("/usr/etc/ssh/sshd_config" /usr/etc/ssh/sshd_config.d/* /etc/ssh/sshd_config.d/*)
6+
{{% endif %}}
7+
# clean up configurations
8+
sed -i '/^LoginGraceTime.*/d' "${SSHD_PATHS[@]}"
9+
10+
# restore to defaults for sle16
11+
{{% if product == 'sle16' %}}
12+
if [ -e "/etc/ssh/sshd_config" ] ; then
13+
rm /etc/ssh/sshd_config
14+
fi
15+
{{% endif %}}

‎linux_os/guide/services/ssh/ssh_server/sshd_set_login_grace_time/tests/lower_bound.pass.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/bin/bash
2-
# profiles = xccdf_org.ssgproject.content_profile_cis
2+
# profiles = xccdf_org.ssgproject.content_profile_cis,xccdf_org.ssgproject.content_profile_pci-dss-4
33
# platform = multi_platform_all
44

55
SSHD_CONFIG="/etc/ssh/sshd_config"

‎linux_os/guide/services/ssh/ssh_server/sshd_set_login_grace_time/tests/no_limit.fail.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/bin/bash
2-
# profiles = xccdf_org.ssgproject.content_profile_cis
2+
# profiles = xccdf_org.ssgproject.content_profile_cis,xccdf_org.ssgproject.content_profile_pci-dss-4
33
# platform = multi_platform_all
44

55
SSHD_CONFIG="/etc/ssh/sshd_config"

‎linux_os/guide/services/ssh/ssh_server/sshd_set_login_grace_time/tests/too_high.fail.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/bin/bash
2-
# profiles = xccdf_org.ssgproject.content_profile_cis
2+
# profiles = xccdf_org.ssgproject.content_profile_cis,xccdf_org.ssgproject.content_profile_pci-dss-4
33
# platform = multi_platform_all
44

55
SSHD_CONFIG="/etc/ssh/sshd_config"

‎linux_os/guide/services/ssh/ssh_server/sshd_set_login_grace_time/tests/too_high_etc_sshd_config_drop_in.fail.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
source include.sh
4+
5+
echo "LoginGraceTime 61" >> /etc/ssh/sshd_config.d/01-complianceascode.conf

0 commit comments

Comments
 (0)