Skip to content

Commit 37a01fb

Browse files
dodysdodys
authored
Merge pull request #14449 from Smouhoune/feat/ssh-client-path-overrides
Parameterize SSH client configuration paths via product properties (preserve defaults)
2 parents 87573a8 + 33824ed commit 37a01fb

41 files changed

Lines changed: 158 additions & 71 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/ansible/shared.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,15 @@
44
# complexity = low
55
# disruption = low
66
{{{ ansible_instantiate_variables("var_ssh_client_rekey_limit_size", "var_ssh_client_rekey_limit_time") }}}
7+
{{%- set sshc_main_config = ssh_client_main_config_file -%}}
8+
{{%- set sshc_config_dir = ssh_client_config_dir -%}}
9+
{{%- set sshc_rekey_config = ssh_client_config_dir ~ "/02-rekey-limit.conf" -%}}
710

8-
{{{ ansible_lineinfile(msg='Ensure RekeyLimit is not configured in /etc/ssh/ssh_config', path='/etc/ssh/ssh_config', regex='^\s*RekeyLimit.*$', insensitive=false, create='no', state='absent', rule_title=rule_title) }}}
11+
{{{ ansible_lineinfile(msg='Ensure RekeyLimit is not configured in ' ~ sshc_main_config, path=sshc_main_config, regex='^\s*RekeyLimit.*$', insensitive=false, create='no', state='absent', rule_title=rule_title) }}}
912

1013
- name: Collect all include config files for ssh client which configure RekeyLimit
1114
ansible.builtin.find:
12-
paths: "/etc/ssh/ssh_config.d/"
15+
paths: "{{{ sshc_config_dir }}}"
1316
contains: '^[\s]*RekeyLimit.*$'
1417
patterns: "*.config"
1518
register: ssh_config_include_files
@@ -21,4 +24,4 @@
2124
state: "absent"
2225
loop: "{{ ssh_config_include_files.files }}"
2326

24-
{{{ ansible_lineinfile(msg='Ensure that rekey limit is set to {{ var_ssh_client_rekey_limit_size }} {{ var_ssh_client_rekey_limit_time }} in /etc/ssh/ssh_config.d/02-rekey-limit.conf', path='/etc/ssh/ssh_config.d/02-rekey-limit.conf', regex='^\s*RekeyLimit.*$', insensitive=false, new_line='RekeyLimit {{ var_ssh_client_rekey_limit_size }} {{ var_ssh_client_rekey_limit_time }}', create='yes', state='present', rule_title=rule_title) }}}
27+
{{{ ansible_lineinfile(msg='Ensure that rekey limit is set to {{ var_ssh_client_rekey_limit_size }} {{ var_ssh_client_rekey_limit_time }} in ' ~ sshc_rekey_config, path=sshc_rekey_config, regex='^\s*RekeyLimit.*$', insensitive=false, new_line='RekeyLimit {{ var_ssh_client_rekey_limit_size }} {{ var_ssh_client_rekey_limit_time }}', create='yes', state='present', rule_title=rule_title) }}}

‎linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/bash/shared.sh‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
# platform = multi_platform_all
22

33
{{{ bash_instantiate_variables("var_ssh_client_rekey_limit_size", "var_ssh_client_rekey_limit_time") }}}
4+
{{%- set sshc_rekey_config = ssh_client_config_dir ~ "/02-rekey-limit.conf" -%}}
45

5-
main_config="/etc/ssh/ssh_config"
6-
include_directory="/etc/ssh/ssh_config.d"
6+
main_config="{{{ ssh_client_main_config_file }}}"
7+
include_directory="{{{ ssh_client_config_dir }}}"
78

89
if grep -q '^[\s]*RekeyLimit.*$' "$main_config"; then
910
sed -i '/^[\s]*RekeyLimit.*/d' "$main_config"
@@ -15,4 +16,4 @@ for file in "$include_directory"/*.conf; do
1516
fi
1617
done
1718

18-
{{{ set_config_file(path="/etc/ssh/ssh_config.d/02-rekey-limit.conf", parameter="RekeyLimit", value='$var_ssh_client_rekey_limit_size $var_ssh_client_rekey_limit_time', create=true, insert_before="", insert_after="", insensitive=false, separator=" ", separator_regex="\s\+", prefix_regex="^\s*", rule_id=rule_id) }}}
19+
{{{ set_config_file(path=sshc_rekey_config, parameter="RekeyLimit", value='$var_ssh_client_rekey_limit_size $var_ssh_client_rekey_limit_time', create=true, insert_before="", insert_after="", insensitive=false, separator=" ", separator_regex="\s\+", prefix_regex="^\s*", rule_id=rule_id) }}}

‎linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/oval/shared.xml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
11

2+
{{%- set sshc_main_config = ssh_client_main_config_file -%}}
3+
{{%- set sshc_config_dir = ssh_client_config_dir -%}}
4+
25
<def-group>
36
<definition class="compliance" id="{{{ rule_id }}}" version="1">
4-
{{{ oval_metadata("Ensure 'RekeyLimit' is configured with the correct value in /etc/ssh/ssh_config and /etc/ssh/ssh_config.d/*.conf", rule_title=rule_title) }}}
7+
{{{ oval_metadata("Ensure 'RekeyLimit' is configured with the correct value in " ~ sshc_main_config ~ " and " ~ sshc_config_dir ~ "/*.conf", rule_title=rule_title) }}}
58
<criteria comment="RekeyLimit is correctly configured for ssh client" operator="AND">
6-
<criterion comment="check that RekeyLimit is not configured in /etc/ssh/ssh_config" test_ref="test_ssh_client_rekey_limit_main_config" negate="true" />
7-
<criterion comment="check correct RekeyLimit configuration in /etc/ssh/ssh_config.d/*.conf" test_ref="test_ssh_client_rekey_limit_include_configs" />
9+
<criterion comment="check that RekeyLimit is not configured in {{{ sshc_main_config }}}" test_ref="test_ssh_client_rekey_limit_main_config" negate="true" />
10+
<criterion comment="check correct RekeyLimit configuration in {{{ sshc_config_dir }}}/*.conf" test_ref="test_ssh_client_rekey_limit_include_configs" />
811
</criteria>
912
</definition>
1013

@@ -22,22 +25,23 @@
2225
<external_variable comment="Time component of the rekey limit" datatype="string" id="var_ssh_client_rekey_limit_time" version="1" />
2326

2427

25-
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in /etc/ssh/ssh_config file" id="test_ssh_client_rekey_limit_main_config" version="1">
28+
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in {{{ sshc_main_config }}}" id="test_ssh_client_rekey_limit_main_config" version="1">
2629
<ind:object object_ref="obj_ssh_client_rekey_limit_main_config"/>
2730
</ind:textfilecontent54_test>
2831

2932
<ind:textfilecontent54_object id="obj_ssh_client_rekey_limit_main_config" version="1">
30-
<ind:filepath>/etc/ssh/ssh_config</ind:filepath>
33+
<ind:filepath>{{{ sshc_main_config }}}</ind:filepath>
3134
<ind:pattern operation="pattern match">^[\s]*RekeyLimit.*$</ind:pattern>
3235
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
3336
</ind:textfilecontent54_object>
3437

35-
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in /etc/ssh/ssh_config.d/*.conf" id="test_ssh_client_rekey_limit_include_configs" version="1">
38+
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in {{{ sshc_config_dir }}}/*.conf" id="test_ssh_client_rekey_limit_include_configs" version="1">
3639
<ind:object object_ref="obj_ssh_client_rekey_limit_include_configs"/>
3740
</ind:textfilecontent54_test>
3841

3942
<ind:textfilecontent54_object id="obj_ssh_client_rekey_limit_include_configs" version="1">
40-
<ind:filepath operation="pattern match">^/etc/ssh/ssh_config\.d/.*\.conf$</ind:filepath>
43+
<ind:path>{{{ sshc_config_dir }}}</ind:path>
44+
<ind:filename operation="pattern match">.*\.conf$</ind:filename>
4145
<ind:pattern var_ref="ssh_client_line_regex" operation="pattern match"></ind:pattern>
4246
<ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
4347
</ind:textfilecontent54_object>

‎linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
documentation_complete: true
22

3+
{{% set sshc_main_config = ssh_client_main_config_file %}}
4+
{{% set sshc_config_dir = ssh_client_config_dir %}}
5+
{{% set sshc_rekey_config = ssh_client_config_dir ~ "/02-rekey-limit.conf" %}}
36

47
title: 'Configure session renegotiation for SSH client'
58

@@ -8,11 +11,11 @@ description: |-
811
the session key is renegotiated, both in terms of
912
amount of data that may be transmitted and the time
1013
elapsed. To decrease the default limits, put line
11-
<tt>RekeyLimit {{{ xccdf_value("var_ssh_client_rekey_limit_size") }}} {{{ xccdf_value("var_ssh_client_rekey_limit_time") }}}</tt> to file <tt>/etc/ssh/ssh_config.d/02-rekey-limit.conf</tt>.
14+
<tt>RekeyLimit {{{ xccdf_value("var_ssh_client_rekey_limit_size") }}} {{{ xccdf_value("var_ssh_client_rekey_limit_time") }}}</tt> to file <tt>{{{ sshc_rekey_config }}}</tt>.
1215
Make sure that there is no other <tt>RekeyLimit</tt> configuration preceding
1316
the <tt>include</tt> directive in the main config file
14-
<tt>/etc/ssh/ssh_config</tt>. Check also other files in
15-
<tt>/etc/ssh/ssh_config.d</tt> directory. Files are processed according to
17+
<tt>{{{ sshc_main_config }}}</tt>. Check also other files in
18+
<tt>{{{ sshc_config_dir }}}</tt> directory. Files are processed according to
1619
lexicographical order of file names. Make sure that there is no file
1720
processed before <tt>02-rekey-limit.conf</tt> containing definition of
1821
<tt>RekeyLimit</tt>.
@@ -37,12 +40,12 @@ ocil_clause: 'it is commented out or is not set'
3740

3841
ocil: |-
3942
To check if RekeyLimit is set correctly, run the following command:
40-
<pre>$ sudo grep RekeyLimit /etc/ssh/ssh_config.d/*.conf</pre>
43+
<pre>$ sudo grep RekeyLimit {{{ sshc_config_dir }}}/*.conf</pre>
4144
If configured properly, output should be
42-
<pre>/etc/ssh/ssh_config.d/02-rekey-limit.conf:
45+
<pre>{{{ sshc_rekey_config }}}:
4346
RekeyLimit {{{ xccdf_value("var_ssh_client_rekey_limit_size") }}} {{{ xccdf_value("var_ssh_client_rekey_limit_time") }}}</pre>
4447
Check also the main configuration file with the following command:
45-
<pre>$ sudo grep RekeyLimit /etc/ssh/ssh_config</pre>
48+
<pre>$ sudo grep RekeyLimit {{{ sshc_main_config }}}</pre>
4649
The command should not return any output.
4750
4851
fixtext: |-
@@ -53,4 +56,3 @@ fixtext: |-
5356
Restart the SSH daemon for the settings to take effect.
5457
5558
$ sudo systemctl restart sshd.service
56-

‎linux_os/guide/services/ssh/ssh_client/ssh_client_use_approved_ciphers_ordered_stig/bash/shared.sh‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11
# platform = multi_platform_ubuntu
22

33
ssh_approved_ciphers="aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr"
4+
{{% set sshc_cipher_list_config = ssh_client_config_dir ~ "/00-cipher-list.conf" %}}
45

5-
main_config="/etc/ssh/ssh_config"
6-
include_directory="/etc/ssh/ssh_config.d"
6+
main_config="{{{ ssh_client_main_config_file }}}"
7+
include_directory="{{{ ssh_client_config_dir }}}"
8+
cipher_list_config="$include_directory/00-cipher-list.conf"
79

810
sed -i '/^\s*[Cc]iphers.*/d' "$main_config" "$include_directory"/*.conf || true
911

10-
if ! grep -qE '^[Hh]ost\s+\*$' /etc/ssh/ssh_config.d/00-cipher-list.conf; then
11-
echo 'Host *' >> /etc/ssh/ssh_config.d/00-cipher-list.conf
12+
if ! grep -qE '^[Hh]ost\s+\*$' "$cipher_list_config"; then
13+
echo 'Host *' >> "$cipher_list_config"
1214
fi
1315

14-
{{{ set_config_file(path="/etc/ssh/ssh_config.d/00-cipher-list.conf", parameter="Ciphers", value='$ssh_approved_ciphers', create=true, insert_before="", insert_after="^Host\s+\*$", insensitive=false, separator=" ", separator_regex="\s\+", prefix_regex="^\s*", rule_id=rule_id) }}}
16+
{{{ set_config_file(path=sshc_cipher_list_config, parameter="Ciphers", value='$ssh_approved_ciphers', create=true, insert_before="", insert_after="^Host\s+\*$", insensitive=false, separator=" ", separator_regex="\s\+", prefix_regex="^\s*", rule_id=rule_id) }}}

‎linux_os/guide/services/ssh/ssh_client/ssh_client_use_approved_ciphers_ordered_stig/oval/shared.xml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,42 @@
11
{{%- if product == 'ubuntu2404' %}}
22
{{%- set ssh_approved_ciphers="aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr" %}}
33
{{%- endif %}}
4+
{{%- set sshc_main_config = ssh_client_main_config_file -%}}
5+
{{%- set sshc_config_dir = ssh_client_config_dir -%}}
46
<def-group>
57
<definition class="compliance" id="{{{ rule_id }}}" version="1">
68
{{{ oval_metadata("Limit the ciphers to those which are FIPS-approved.", rule_title=rule_title) }}}
79
<criteria comment="the configuration is correct if it exists" operator="AND">
8-
<criterion comment="Check the ciphers in /etc/ssh/ssh_config if any"
10+
<criterion comment="Check the ciphers in {{{ sshc_main_config }}} if any"
911
test_ref="test_{{{ rule_id }}}" />
10-
<criterion comment="Check the ciphers in /etc/ssh/ssh_config.d if any"
12+
<criterion comment="Check the ciphers in {{{ sshc_config_dir }}} if any"
1113
test_ref="test_{{{ rule_id }}}_config_dir" />
1214
<criterion comment="the configuration exists" test_ref="test_ciphers_present_{{{ rule_id }}}" />
1315
</criteria>
1416
</definition>
1517

1618
<ind:textfilecontent54_test check="all" check_existence="any_exist"
17-
comment="tests the value of ciphers setting in the /etc/ssh/ssh_config file"
19+
comment="tests the value of ciphers setting in {{{ sshc_main_config }}}"
1820
id="test_{{{ rule_id }}}" version="1">
1921
<ind:object object_ref="obj_{{{ rule_id }}}" />
2022
<ind:state state_ref="state_{{{ rule_id }}}" />
2123
</ind:textfilecontent54_test>
2224

2325
<ind:textfilecontent54_object id="obj_{{{ rule_id }}}" version="1">
24-
<ind:filepath>/etc/ssh/ssh_config</ind:filepath>
26+
<ind:filepath>{{{ sshc_main_config }}}</ind:filepath>
2527
<ind:pattern operation="pattern match">^[ \t]*(?i)ciphers(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
2628
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
2729
</ind:textfilecontent54_object>
2830

2931
<ind:textfilecontent54_test check="all" check_existence="any_exist"
30-
comment="tests the value of ciphers setting in the /etc/ssh/ssh_config.d file"
32+
comment="tests the value of ciphers setting in {{{ sshc_config_dir }}}"
3133
id="test_{{{ rule_id }}}_config_dir" version="1">
3234
<ind:object object_ref="obj_{{{ rule_id }}}_config_dir" />
3335
<ind:state state_ref="state_{{{ rule_id }}}" />
3436
</ind:textfilecontent54_test>
3537

3638
<ind:textfilecontent54_object id="obj_{{{ rule_id }}}_config_dir" version="1">
37-
<ind:path>/etc/ssh/ssh_config.d</ind:path>
39+
<ind:path>{{{ sshc_config_dir }}}</ind:path>
3840
<ind:filename operation="pattern match">.*\.conf$</ind:filename>
3941
<ind:pattern operation="pattern match">^[ \t]*(?i)ciphers(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
4042
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>

‎linux_os/guide/services/ssh/ssh_client/ssh_client_use_approved_ciphers_ordered_stig/rule.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
{{%- if product == 'ubuntu2404' %}}
22
{{%- set ssh_approved_ciphers = "aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr" %}}
33
{{%- endif %}}
4+
{{%- set sshc_main_config = ssh_client_main_config_file -%}}
45
documentation_complete: true
56

67
title: 'Use Only FIPS 140-3 Validated Ciphers in SSH Client Configuration'
78

89
description: |-
910
Limit the ciphers to those algorithms which are FIPS-approved.
10-
The following line in <tt>/etc/ssh/ssh_config</tt>
11+
The following line in <tt>{{{ sshc_main_config }}}</tt>
1112
demonstrates use of FIPS-approved ciphers:
1213
{{%- if 'ubuntu' in product %}}
1314
<pre>Ciphers {{{ ssh_approved_ciphers }}}</pre>

‎linux_os/guide/services/ssh/ssh_client/ssh_use_approved_macs_ordered_stig/bash/shared.sh‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,16 @@
11
# platform = multi_platform_ubuntu
22

33
{{{ bash_instantiate_variables("ssh_approved_macs") }}}
4+
{{%- set sshc_mac_list_config = ssh_client_config_dir ~ "/00-mac-list.conf" -%}}
45

5-
main_config="/etc/ssh/ssh_config"
6-
include_directory="/etc/ssh/ssh_config.d"
6+
main_config="{{{ ssh_client_main_config_file }}}"
7+
include_directory="{{{ ssh_client_config_dir }}}"
8+
mac_list_config="$include_directory/00-mac-list.conf"
79

810
sed -i '/^\s*MACs.*/d' "$main_config" "$include_directory"/*.conf || true
911

10-
if ! grep -qE '^[Hh]ost\s+\*$' /etc/ssh/ssh_config.d/00-mac-list.conf; then
11-
echo 'Host *' >> /etc/ssh/ssh_config.d/00-mac-list.conf
12+
if ! grep -qE '^[Hh]ost\s+\*$' "$mac_list_config"; then
13+
echo 'Host *' >> "$mac_list_config"
1214
fi
1315

14-
{{{ set_config_file(path="/etc/ssh/ssh_config.d/00-mac-list.conf", parameter="MACs", value='$ssh_approved_macs', create=true, insert_before="", insert_after="^Host\s+\*$", insensitive=false, separator=" ", separator_regex="\s\+", prefix_regex="^\s*", rule_id=rule_id) }}}
16+
{{{ set_config_file(path=sshc_mac_list_config, parameter="MACs", value='$ssh_approved_macs', create=true, insert_before="", insert_after="^Host\s+\*$", insensitive=false, separator=" ", separator_regex="\s\+", prefix_regex="^\s*", rule_id=rule_id) }}}

‎linux_os/guide/services/ssh/ssh_client/ssh_use_approved_macs_ordered_stig/oval/shared.xml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,42 @@
1+
{{%- set sshc_main_config = ssh_client_main_config_file -%}}
2+
{{%- set sshc_config_dir = ssh_client_config_dir -%}}
3+
14
<def-group>
25
<definition class="compliance" id="{{{ rule_id }}}" version="1">
36
{{{ oval_metadata("Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.", rule_title=rule_title) }}}
47
<criteria comment="ssh is configured correctly" operator="AND">
58
<criteria comment="the configuration is correct if it exists" operator="AND">
6-
<criterion comment="Check the MACs in /etc/ssh/ssh_config if any"
9+
<criterion comment="Check the MACs in {{{ sshc_main_config }}} if any"
710
test_ref="test_{{{ rule_id }}}" />
8-
<criterion comment="Check the MACs in /etc/ssh/ssh_config.d if any"
11+
<criterion comment="Check the MACs in {{{ sshc_config_dir }}} if any"
912
test_ref="test_{{{ rule_id }}}_config_dir" />
1013
</criteria>
1114
<criterion comment="the configuration exists" test_ref="test_MACs_present_{{{ rule_id }}}" />
1215
</criteria>
1316
</definition>
1417

1518
<ind:textfilecontent54_test check="all" check_existence="any_exist"
16-
comment="tests the value of MACs setting in the /etc/ssh/ssh_config file"
19+
comment="tests the value of MACs setting in {{{ sshc_main_config }}}"
1720
id="test_{{{ rule_id }}}" version="1">
1821
<ind:object object_ref="obj_{{{ rule_id }}}" />
1922
<ind:state state_ref="state_{{{ rule_id }}}" />
2023
</ind:textfilecontent54_test>
2124

2225
<ind:textfilecontent54_object id="obj_{{{ rule_id }}}" version="1">
23-
<ind:filepath>/etc/ssh/ssh_config</ind:filepath>
26+
<ind:filepath>{{{ sshc_main_config }}}</ind:filepath>
2427
<ind:pattern operation="pattern match">^[ \t]*(?i)MACs(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
2528
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
2629
</ind:textfilecontent54_object>
2730

2831
<ind:textfilecontent54_test check="all" check_existence="any_exist"
29-
comment="tests the value of MACs setting in the /etc/ssh/ssh_config.d file"
32+
comment="tests the value of MACs setting in {{{ sshc_config_dir }}}"
3033
id="test_{{{ rule_id }}}_config_dir" version="1">
3134
<ind:object object_ref="obj_{{{ rule_id }}}_config_dir" />
3235
<ind:state state_ref="state_{{{ rule_id }}}" />
3336
</ind:textfilecontent54_test>
3437

3538
<ind:textfilecontent54_object id="obj_{{{ rule_id }}}_config_dir" version="1">
36-
<ind:path>/etc/ssh/ssh_config.d</ind:path>
39+
<ind:path>{{{ sshc_config_dir }}}</ind:path>
3740
<ind:filename operation="pattern match">.*\.conf$</ind:filename>
3841
<ind:pattern operation="pattern match">^[ \t]*(?i)MACs(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
3942
<ind:instance operation="greater than or equal" datatype="int">1</ind:instance>

‎linux_os/guide/services/ssh/ssh_client/ssh_use_approved_macs_ordered_stig/rule.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
documentation_complete: true
2+
{{% set sshc_main_config = ssh_client_main_config_file %}}
3+
{{%- set sshc_config_dir = ssh_client_config_dir -%}}
24

35
title: 'Use Only FIPS 140-3 Validated MACs'
46

57
description: |-
68
Limit the MACs to those hash algorithms which are FIPS-approved.
7-
The following line in <tt>/etc/ssh/ssh_config</tt>
9+
The following line in <tt>{{{ sshc_main_config }}}</tt>
810
demonstrates use of FIPS-approved MACs:
911
1012
<pre>MACs {{{ ssh_approved_macs }}}</pre>
@@ -22,11 +24,10 @@ ocil_clause: 'MACs option is commented out or not using FIPS-approved hash algor
2224
ocil: |-
2325
Only FIPS-approved MACs should be used. To verify that only FIPS-approved
2426
MACs are in use, run the following command:
25-
<pre>$ sudo grep -ir macs /etc/ssh/ssh_config*</pre>
27+
<pre>$ sudo grep -ir macs {{{ sshc_main_config }}} {{{ sshc_config_dir }}}</pre>
2628
The output should contain only following MACs:
2729
<pre>MACs {{{ xccdf_value("ssh_approved_macs") }}}</pre>
2830
2931
warnings:
3032
- general: |-
3133
The system needs to be rebooted for these changes to take effect.
32-

0 commit comments

Comments
 (0)