Require 0600 for group-owned SSH private keys in the OVAL check

[ggbecker]

Description:

• Require mode 0600 for group-owned SSH private host keys in the OVAL check, so root:<dedicated group> (e.g. root:ssh_keys) keys at 0640 are now flagged as a finding on non-immutable systems. The 0640 group-readable exception now applies to rhcos4 only.
• Align the rule description, the Puppet remediation (which hardcoded 0640), and the test scenarios with this behavior.

Rationale:

• PR Require 0600 permissions for SSH private keys on non-immutable systems #15015 restricted the 0640 exception to rhcos4, but the exception is implemented twice in the OVAL check — once for root:root and once for root:<dedicated group>. Only the root:root state was gated, so root:ssh_keys 0640 keys (the RHEL default) still passed even though the Bash/Ansible remediations already enforce 0600.
• This caused SSG to report pass while DISA's SCAP content reported fail for SV-230287 on stock RHEL. This change closes that gap and matches the DISA STIG.

Review Hints:

• The core fix is a single gread gate in oval/shared.xml; the built OVAL now sets gread=false for both the root and dedicated-group filter states.
• The default RHEL host keys ship as root:ssh_keys 0640, so the two whole-system pass scenarios (supercompliance.pass.sh, altcorrect_permissions.pass.sh) now harden pre-existing keys first. New dedicated_group_lenient.fail.sh covers the root:<group> 0640 regression.
• Run automatus tests for the affected rule

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key'.
--- xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
@@ -7,7 +7,7 @@
 [description]:
 SSH server private keys - files that match the /etc/ssh/*_key glob, have to have restricted permissions.
 If those files are owned by the root user and the root group, they have to have the 0600 permission or stricter.
-If they are owned by the root user, but by a dedicated group ssh_keys, they can have the 0640 permission or stricter.
+If they are owned by the root user, but by a dedicated group ssh_keys, they still have to have the 0600 permission or stricter.
 
 [warning]:
 Remediation is not possible at bootable container build time because SSH host

puppet remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
@@ -1,8 +1,11 @@
+
+
+
 include ssh_private_key_perms
 
 class ssh_private_key_perms {
   exec { 'sshd_priv_key':
-    command => "chmod 0640 /etc/ssh/*_key",
+    command => "chmod 0600 /etc/ssh/*_key",
     path    => '/bin:/usr/bin'
   }
 }

[openshift-ci]

@ggbecker: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	ee6bcc8	link	true	/test e2e-aws-openshift-platform-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.