Skip to content

Commit 3860d2a

Browse files
realstuffierealstuffie
committed
Add Ubuntu 26.04 sshd check adjustments
Scope missing_parameter_pass on sshd_disable_empty_passwords to ubuntu2604 so the STIG-mapped presence requirement is preserved on other products. Add ubuntu2604 OVAL overrides for sshd_set_keepalive and sshd_use_strong_kex, and a cis_ubuntu2604 option to sshd_strong_kex.var.
1 parent 84c762f commit 3860d2a

6 files changed

Lines changed: 64 additions & 0 deletions

File tree

‎linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/rule.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,3 +67,6 @@ template:
6767
value: 'no'
6868
datatype: string
6969
is_default_value: 'true'
70+
{{% if product in ["ubuntu2604"] %}}
71+
missing_parameter_pass: 'true'
72+
{{% endif %}}

‎linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/tests/line_not_there.pass.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
3+
# platform = multi_platform_ubuntu
4+
5+
SSHD_PARAM={{{ PARAMETER }}}
6+
7+
mkdir -p "{{{ sshd_config_dir }}}"
8+
touch "{{{ sshd_config_dir }}}/nothing"
9+
declare -a SSHD_PATHS=({{{ sshd_main_config_file }}} {{{ sshd_config_dir }}}/*)
10+
11+
{{% if product in ['sle16', 'slmicro6'] %}}
12+
touch "{{{ sshd_main_config_file }}}"
13+
{{% endif %}}
14+
15+
if grep -q "^\s*${SSHD_PARAM}" "${SSHD_PATHS[@]}" ; then
16+
sed -i "/^\s*${SSHD_PARAM}.*/Id" "${SSHD_PATHS[@]}"
17+
fi

‎linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/tests/test_config.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
deny_templated_scenarios:
2+
- line_not_there.fail.sh

‎linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/oval/ubuntu2604.xml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{%- set sshd_main_config = sshd_main_config_file -%}}
2+
<def-group>
3+
<definition class="compliance" id="{{{ rule_id }}}" version="1">
4+
{{{ oval_metadata("ClientAliveCountMax is greater than zero, including the compliant OpenSSH default of 3.", rule_title=rule_title) }}}
5+
<criteria>
6+
<criterion comment="ClientAliveCountMax is not explicitly set to zero"
7+
test_ref="test_{{{ rule_id }}}_not_zero" />
8+
</criteria>
9+
</definition>
10+
11+
<ind:textfilecontent54_test check="all" check_existence="none_exist"
12+
id="test_{{{ rule_id }}}_not_zero" version="1"
13+
comment="No active ClientAliveCountMax zero setting exists">
14+
<ind:object object_ref="obj_{{{ rule_id }}}_zero" />
15+
</ind:textfilecontent54_test>
16+
<ind:textfilecontent54_object id="obj_{{{ rule_id }}}_zero" version="1">
17+
<ind:filepath operation="pattern match">{{{ sshd_main_config }}}(\.d/.*\.conf)?$</ind:filepath>
18+
<ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax(?-i)[\s]+0[\s]*(#.*)?$</ind:pattern>
19+
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
20+
</ind:textfilecontent54_object>
21+
</def-group>

‎linux_os/guide/services/ssh/ssh_server/sshd_use_strong_kex/oval/ubuntu2604.xml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<def-group>
2+
<definition class="compliance" id="{{{ rule_id }}}" version="1">
3+
{{{ oval_metadata("SSH key exchange excludes the algorithms prohibited by CIS Ubuntu 26.04.", rule_title=rule_title) }}}
4+
<criteria>
5+
<criterion comment="No active KexAlgorithms directive enables a prohibited SHA-1 algorithm"
6+
test_ref="test_{{{ rule_id }}}_no_weak_kex" />
7+
</criteria>
8+
</definition>
9+
10+
<ind:textfilecontent54_test check="all" check_existence="none_exist"
11+
id="test_{{{ rule_id }}}_no_weak_kex" version="1"
12+
comment="No prohibited key exchange algorithm is enabled">
13+
<ind:object object_ref="obj_{{{ rule_id }}}_weak_kex" />
14+
</ind:textfilecontent54_test>
15+
<ind:textfilecontent54_object id="obj_{{{ rule_id }}}_weak_kex" version="1">
16+
<ind:filepath operation="pattern match">/etc/ssh/sshd_config(\.d/.*\.conf)?$</ind:filepath>
17+
<ind:pattern operation="pattern match">^[\s]*(?i)KexAlgorithms(?-i)[\s]+(?!-)[^#\n]*(diffie-hellman-group1-sha1|diffie-hellman-group14-sha1|diffie-hellman-group-exchange-sha1)(,|[\s#]|$).*$</ind:pattern>
18+
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
19+
</ind:textfilecontent54_object>
20+
</def-group>

‎linux_os/guide/services/ssh/sshd_strong_kex.var‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ options:
2020
cis_sle15: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
2121
cis_ubuntu2204: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
2222
cis_ubuntu2404: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
23+
cis_ubuntu2604: mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
2324
std_openeuler: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
2425
std_kylinsecserver6: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256
2526
cis_debian12: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256

0 commit comments

Comments
 (0)