Skip to content

Commit 8f0e0ed

Browse files
teacup-on-rockingchairteacup-on-rockingchair
committed
For sle16 enhance the check to cover cases with sshd_config in /usr and subfolders for sshd_set_maxstartups rule
1 parent 5de048f commit 8f0e0ed

9 files changed

Lines changed: 209 additions & 0 deletions

‎linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/oval/sle16.xml‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
<def-group>
2+
<definition class="compliance" id="{{{ rule_id }}}" version="2">
3+
{{{ oval_metadata("Ensure 'MaxStartups' is properly configured in SSH configuration files.", rule_title=rule_title) }}}
4+
<criteria operator="OR" comment="sshd MaxStartups parameter is properly configured if sshd is installed">
5+
<criteria operator="AND" comment="sshd is not installed">
6+
<extend_definition definition_ref="sshd_not_required_or_unset"
7+
comment="sshd is not required or requirement is unset"/>
8+
<extend_definition definition_ref="package_openssh-server_removed"
9+
comment="rpm package openssh-server is removed"/>
10+
</criteria>
11+
<criteria operator="OR">
12+
<criteria comment="MaxStartups is configured correctly in /etc/ssh/sshd_config" operator="AND">
13+
<criterion comment="SSH configuration /etc/ssh/sshd_config exists" test_ref="test_etc_ssh_sshd_config_exist"/>
14+
<criterion test_ref="tst_maxstartups_start_parameter" comment="SSH MaxStartups start parameter is less than or equal to 10"/>
15+
<criterion test_ref="tst_maxstartups_rate_parameter" comment="SSH MaxStartups rate parameter is greater than or equal to 30"/>
16+
<criterion test_ref="tst_maxstartups_full_parameter" comment="SSH MaxStartups full parameter is less than or equal to 100"/>
17+
</criteria>
18+
<criteria comment="MaxStartups is configured correctly in /usr/etc/ssh/sshd_config" operator="AND">
19+
<criterion comment="SSH configuration /etc/ssh/sshd_config does not exists" test_ref="test_etc_ssh_sshd_config_exist" negate="true"/>
20+
<criterion test_ref="tst_maxstartups_start_parameter_usr" comment="SSH MaxStartups start parameter is less than or equal to 10"/>
21+
<criterion test_ref="tst_maxstartups_rate_parameter_usr" comment="SSH MaxStartups rate parameter is greater than or equal to 30"/>
22+
<criterion test_ref="tst_maxstartups_full_parameter_usr" comment="SSH MaxStartups full parameter is less than or equal to 100"/>
23+
</criteria>
24+
</criteria>
25+
</criteria>
26+
</definition>
27+
28+
<unix:file_test check="all" check_existence="all_exist"
29+
comment="SSH configuration /etc/ssh/sshd_config exists"
30+
id="test_etc_ssh_sshd_config_exist"
31+
state_operator="AND" version="1">
32+
<unix:object object_ref="obj_etc_ssh_sshd_config_exist"/>
33+
</unix:file_test>
34+
<unix:file_object
35+
comment="SSH configuration /etc/ssh/sshd_config exists"
36+
id="obj_etc_ssh_sshd_config_exist" version="1">
37+
<unix:filepath operation="pattern match">^/etc/ssh/sshd_config</unix:filepath>
38+
</unix:file_object>
39+
40+
<ind:textfilecontent54_test id="tst_maxstartups_start_parameter" version="2"
41+
check="all" check_existence="at_least_one_exists"
42+
comment="SSH MaxStartups start parameter is less than or equal to the expected value">
43+
<ind:object object_ref="obj_sshd_config_maxstartups_first_parameter"/>
44+
<ind:state state_ref="ste_sshd_config_start_parameter_valid"/>
45+
</ind:textfilecontent54_test>
46+
<ind:textfilecontent54_test id="tst_maxstartups_rate_parameter" version="2"
47+
check="all" check_existence="at_least_one_exists"
48+
comment="SSH MaxStartups rate parameter is greater than or equal to the expected value">
49+
<ind:object object_ref="obj_sshd_config_maxstartups_second_parameter"/>
50+
<ind:state state_ref="ste_sshd_config_rate_parameter_valid"/>
51+
</ind:textfilecontent54_test>
52+
<ind:textfilecontent54_test id="tst_maxstartups_full_parameter" version="2"
53+
check="all" check_existence="at_least_one_exists"
54+
comment="SSH MaxStartups full parameter is less than or equal to the expected value">
55+
<ind:object object_ref="obj_sshd_config_maxstartups_third_parameter"/>
56+
<ind:state state_ref="ste_sshd_config_full_parameter_valid"/>
57+
</ind:textfilecontent54_test>
58+
59+
<ind:textfilecontent54_object id="obj_sshd_config_maxstartups_first_parameter" version="2">
60+
<ind:path operation="pattern match">^(/etc/ssh|/etc/ssh/sshd_config.d|/usr/etc/ssh/sshd_config.d)</ind:path>
61+
<ind:filename operation="pattern match">(sshd_config|.*\.conf)$</ind:filename>
62+
<ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+(\d+):\d+:\d+\s*$</ind:pattern>
63+
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
64+
</ind:textfilecontent54_object>
65+
<ind:textfilecontent54_object id="obj_sshd_config_maxstartups_second_parameter" version="2">
66+
<ind:path operation="pattern match">^(/etc/ssh|/etc/ssh/sshd_config.d|/usr/etc/ssh/sshd_config.d)</ind:path>
67+
<ind:filename operation="pattern match">(sshd_config|.*\.conf)$</ind:filename>
68+
<ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+\d+:(\d+):\d+\s*$</ind:pattern>
69+
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
70+
</ind:textfilecontent54_object>
71+
<ind:textfilecontent54_object id="obj_sshd_config_maxstartups_third_parameter" version="2">
72+
<ind:path operation="pattern match">^(/etc/ssh|/etc/ssh/sshd_config.d|/usr/etc/ssh/sshd_config.d)</ind:path>
73+
<ind:filename operation="pattern match">(sshd_config|.*\.conf)$</ind:filename>
74+
<ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+\d+:\d+:(\d+)\s*$</ind:pattern>
75+
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
76+
</ind:textfilecontent54_object>
77+
78+
<ind:textfilecontent54_test id="tst_maxstartups_start_parameter_usr" version="2"
79+
check="all" check_existence="at_least_one_exists"
80+
comment="SSH MaxStartups start parameter is less than or equal to the expected value">
81+
<ind:object object_ref="obj_sshd_config_maxstartups_first_parameter_usr"/>
82+
<ind:state state_ref="ste_sshd_config_start_parameter_valid"/>
83+
</ind:textfilecontent54_test>
84+
<ind:textfilecontent54_test id="tst_maxstartups_rate_parameter_usr" version="2"
85+
check="all" check_existence="at_least_one_exists"
86+
comment="SSH MaxStartups rate parameter is greater than or equal to the expected value">
87+
<ind:object object_ref="obj_sshd_config_maxstartups_second_parameter_usr"/>
88+
<ind:state state_ref="ste_sshd_config_rate_parameter_valid"/>
89+
</ind:textfilecontent54_test>
90+
<ind:textfilecontent54_test id="tst_maxstartups_full_parameter_usr" version="2"
91+
check="all" check_existence="at_least_one_exists"
92+
comment="SSH MaxStartups full parameter is less than or equal to the expected value">
93+
<ind:object object_ref="obj_sshd_config_maxstartups_third_parameter_usr"/>
94+
<ind:state state_ref="ste_sshd_config_full_parameter_valid"/>
95+
</ind:textfilecontent54_test>
96+
97+
<ind:textfilecontent54_object id="obj_sshd_config_maxstartups_first_parameter_usr" version="2">
98+
<ind:path operation="pattern match">^(/usr/etc/ssh|/etc/ssh/sshd_config.d|/usr/etc/ssh/sshd_config.d)</ind:path>
99+
<ind:filename operation="pattern match">(sshd_config|.*\.conf)$</ind:filename>
100+
<ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+(\d+):\d+:\d+\s*$</ind:pattern>
101+
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
102+
</ind:textfilecontent54_object>
103+
<ind:textfilecontent54_object id="obj_sshd_config_maxstartups_second_parameter_usr" version="2">
104+
<ind:path operation="pattern match">^(/usr/etc/ssh|/etc/ssh/sshd_config.d|/usr/etc/ssh/sshd_config.d)</ind:path>
105+
<ind:filename operation="pattern match">(sshd_config|.*\.conf)$</ind:filename>
106+
<ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+\d+:(\d+):\d+\s*$</ind:pattern>
107+
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
108+
</ind:textfilecontent54_object>
109+
<ind:textfilecontent54_object id="obj_sshd_config_maxstartups_third_parameter_usr" version="2">
110+
<ind:path operation="pattern match">^(/usr/etc/ssh|/etc/ssh/sshd_config.d|/usr/etc/ssh/sshd_config.d)</ind:path>
111+
<ind:filename operation="pattern match">(sshd_config|.*\.conf)$</ind:filename>
112+
<ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+\d+:\d+:(\d+)\s*$</ind:pattern>
113+
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
114+
</ind:textfilecontent54_object>
115+
116+
<external_variable id="var_sshd_set_maxstartups" version="1"
117+
datatype="string" comment="Expected value for MaxStartups parameter"/>
118+
119+
<local_variable id="var_sshd_set_maxstartups_first" version="1" datatype="int"
120+
comment="First number from MaxStartup parameter value.">
121+
<regex_capture pattern="(\d+):\d+:\d+">
122+
<variable_component var_ref="var_sshd_set_maxstartups"/>
123+
</regex_capture>
124+
</local_variable>
125+
<local_variable id="var_sshd_set_maxstartups_second" version="1" datatype="int"
126+
comment="Second number from MaxStartup parameter value.">
127+
<regex_capture pattern="\d+:(\d+):\d+">
128+
<variable_component var_ref="var_sshd_set_maxstartups"/>
129+
</regex_capture>
130+
</local_variable>
131+
<local_variable id="var_sshd_set_maxstartups_third" version="1" datatype="int"
132+
comment="Third number from MaxStartup parameter value.">
133+
<regex_capture pattern="\d+:\d+:(\d+)">
134+
<variable_component var_ref="var_sshd_set_maxstartups" />
135+
</regex_capture>
136+
</local_variable>
137+
138+
<ind:textfilecontent54_state id="ste_sshd_config_start_parameter_valid" version="2">
139+
<ind:subexpression datatype="int" operation="less than or equal"
140+
var_ref="var_sshd_set_maxstartups_first"/>
141+
</ind:textfilecontent54_state>
142+
<ind:textfilecontent54_state id="ste_sshd_config_rate_parameter_valid" version="2">
143+
<ind:subexpression datatype="int" operation="greater than or equal"
144+
var_ref="var_sshd_set_maxstartups_second"/>
145+
</ind:textfilecontent54_state>
146+
<ind:textfilecontent54_state id="ste_sshd_config_full_parameter_valid" version="2">
147+
<ind:subexpression datatype="int" operation="less than or equal"
148+
var_ref="var_sshd_set_maxstartups_third"/>
149+
</ind:textfilecontent54_state>
150+
151+
</def-group>

‎linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/correct_value_etc_sshd_config_drop_in.pass.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
# variables = var_sshd_set_maxstartups=10:30:60
4+
source include.sh
5+
6+
echo "MaxStartups 10:30:60" >> /etc/ssh/sshd_config.d/01-complianceascode.conf

‎linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/correct_value_in_usr_etc_sshd_config_present.fail.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
# variables = var_sshd_set_maxstartups=10:30:60
4+
source include.sh
5+
6+
touch /etc/ssh/sshd_config
7+
echo "MaxStartups 10:30:60" >> /usr/etc/ssh/sshd_config

‎linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/correct_value_usr_etc_sshd_config.pass.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
# variables = var_sshd_set_maxstartups=10:30:60
4+
source include.sh
5+
6+
echo "MaxStartups 10:30:60" >> /usr/etc/ssh/sshd_config

‎linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/correct_value_usr_etc_sshd_config_drop_in.pass.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
# variables = var_sshd_set_maxstartups=10:30:60
4+
source include.sh
5+
6+
echo "MaxStartups 10:30:60" >> /usr/etc/ssh/sshd_config.d/01-complianceascode.conf

‎linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/include.sh‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
3+
declare -a SSHD_PATHS=("/etc/ssh/sshd_config")
4+
{{% if product == 'sle16' %}}
5+
SSHD_PATHS+=("/usr/etc/ssh/sshd_config" /usr/etc/ssh/sshd_config.d/* /etc/ssh/sshd_config.d/*)
6+
{{% endif %}}
7+
# clean up configurations
8+
sed -i '/^MaxStartups.*/d' "${SSHD_PATHS[@]}"
9+
10+
# restore to defaults for sle16
11+
{{% if product == 'sle16' %}}
12+
if [ -e "/etc/ssh/sshd_config" ] ; then
13+
rm /etc/ssh/sshd_config
14+
fi
15+
{{% endif %}}

‎linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/wrong_value_etc_sshd_config_drop_in.fail.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
# variables = var_sshd_set_maxstartups=10:30:60
4+
source include.sh
5+
6+
echo "MaxStartups 10:30:61" >> /etc/ssh/sshd_config.d/01-complianceascode.conf

‎linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/wrong_value_usr_etc_sshd_config.fail.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
# variables = var_sshd_set_maxstartups=10:30:60
4+
source include.sh
5+
6+
echo "MaxStartups 10:29:60" >> /usr/etc/ssh/sshd_config

‎linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/wrong_value_usr_etc_sshd_config_drop_in.fail.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
# platform = SUSE Linux Enterprise 16
3+
# variables = var_sshd_set_maxstartups=10:30:60
4+
source include.sh
5+
6+
echo "MaxStartups 11:30:60">> /usr/etc/ssh/sshd_config.d/01-complianceascode.conf

0 commit comments

Comments
 (0)