SLE16 check permissions /usr/etc/ssh/sshd_config

[teacup-on-rockingchair]

Description:

• Vanilla installation of sshd on sle16 might have only /usr/etc/ssh/sshd_config configuration file

Rationale:

• Make sure oval check handles permissions of /usr/etc/ssh/sshd_config file, together with /etc/ssh/sshd_config

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_cron_logging' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_cron_logging
+++ xccdf_org.ssgproject.content_rule_rsyslog_cron_logging
@@ -170,6 +170,24 @@
   - no_reboot_needed
   - rsyslog_cron_logging
 
+- name: Ensure cron Is Logging To Rsyslog - Check if /etc/rsyslog.conf exists
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: _config_file_exists
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"rsyslog" in ansible_facts.packages'
+  tags:
+  - CCE-80859-2
+  - DISA-STIG-RHEL-08-030010
+  - NIST-800-53-CM-6(a)
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rsyslog_cron_logging
+
 - name: Ensure cron Is Logging To Rsyslog - Check if the parameter cron.* is configured
     correctly in /etc/rsyslog.conf
   ansible.builtin.lineinfile:
@@ -182,6 +200,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_exists.stat.exists
   tags:
   - CCE-80859-2
   - DISA-STIG-RHEL-08-030010
@@ -257,6 +276,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_correctly is not skipped
   - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
     ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
     | int)) != 1

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode
+++ xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode
@@ -134,6 +134,25 @@
   - no_reboot_needed
   - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
 
+- name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Check if /etc/rsyslog.conf
+    exists
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: _config_file_exists
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"rsyslog" in ansible_facts.packages'
+  tags:
+  - CCE-86339-9
+  - DISA-STIG-RHEL-08-030720
+  - NIST-800-53-AU-4(1)
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
+
 - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Check if the parameter
     $ActionSendStreamDriverAuthMode is configured correctly in /etc/rsyslog.conf
   ansible.builtin.lineinfile:
@@ -146,6 +165,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_exists.stat.exists
   tags:
   - CCE-86339-9
   - DISA-STIG-RHEL-08-030720
@@ -221,6 +241,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_correctly is not skipped
   - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
     ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
     | int)) != 1

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode
+++ xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode
@@ -134,6 +134,25 @@
   - no_reboot_needed
   - rsyslog_encrypt_offload_actionsendstreamdrivermode
 
+- name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if /etc/rsyslog.conf
+    exists
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: _config_file_exists
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"rsyslog" in ansible_facts.packages'
+  tags:
+  - CCE-86098-1
+  - DISA-STIG-RHEL-08-030710
+  - NIST-800-53-AU-4(1)
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rsyslog_encrypt_offload_actionsendstreamdrivermode
+
 - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
     $ActionSendStreamDriverMode is configured correctly in /etc/rsyslog.conf
   ansible.builtin.lineinfile:
@@ -146,6 +165,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_exists.stat.exists
   tags:
   - CCE-86098-1
   - DISA-STIG-RHEL-08-030710
@@ -221,6 +241,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_correctly is not skipped
   - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
     ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
     | int)) != 1

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver
+++ xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver
@@ -134,6 +134,25 @@
   - no_reboot_needed
   - rsyslog_encrypt_offload_defaultnetstreamdriver
 
+- name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if /etc/rsyslog.conf
+    exists
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: _config_file_exists
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"rsyslog" in ansible_facts.packages'
+  tags:
+  - CCE-85992-6
+  - DISA-STIG-RHEL-08-030710
+  - NIST-800-53-AU-4(1)
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rsyslog_encrypt_offload_defaultnetstreamdriver
+
 - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
     $DefaultNetstreamDriver is configured correctly in /etc/rsyslog.conf
   ansible.builtin.lineinfile:
@@ -146,6 +165,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_exists.stat.exists
   tags:
   - CCE-85992-6
   - DISA-STIG-RHEL-08-030710
@@ -221,6 +241,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_correctly is not skipped
   - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
     ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
     | int)) != 1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_use_strong_kex' differs.
--- xccdf_org.ssgproject.content_rule_sshd_use_strong_kex
+++ xccdf_org.ssgproject.content_rule_sshd_use_strong_kex
@@ -2,6 +2,9 @@
 if rpm --quiet -q kernel-core; then
 
 sshd_strong_kex=''
+
+
+
 
 if [ -e "/etc/ssh/sshd_config" ] ; then
     LC_ALL=C sed -i "/^\s*KexAlgorithms\s\+/Id" "/etc/ssh/sshd_config"

[openshift-ci]

@teacup-on-rockingchair: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	f2d2f82	link	true	/test e2e-aws-openshift-node-compliance
ci/prow/e2e-aws-openshift-platform-compliance	f2d2f82	link	true	/test e2e-aws-openshift-platform-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[teacup-on-rockingchair]

@Mab879 , @jan-cerny , @matusmarhefka or @vojtapolasek can you check this out