Skip to content

Commit e6fd405

Browse files
Mab879Mab879
authored
Merge pull request #14445 from Smouhoune/feat/ssh-path-overrides-product-vars
Parameterize SSH-related file paths via product properties (preserve current defaults)
2 parents a375443 + 86a1b66 commit e6fd405

80 files changed

Lines changed: 420 additions & 234 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎linux_os/guide/services/ssh/directory_groupowner_sshd_config_d/rule.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ documentation_complete: true
33
title: 'Verify Group Who Owns SSH Server Configuration Files'
44

55
description: |-
6-
{{{ describe_directory_group_owner(directory="/etc/ssh/sshd_config.d", group="root") }}}
6+
{{{ describe_directory_group_owner(directory=sshd_config_dir, group="root") }}}
77
88
rationale: |-
99
Service configuration files enable or disable features of their respective
@@ -28,19 +28,19 @@ references:
2828
nist-csf: PR.AC-4,PR.DS-5
2929
srg: SRG-OS-000480-GPOS-00227
3030

31-
ocil_clause: '{{{ ocil_clause_directory_group_owner(directory="/etc/ssh/sshd_config.d", group="root") }}}'
31+
ocil_clause: '{{{ ocil_clause_directory_group_owner(directory=sshd_config_dir, group="root") }}}'
3232

3333
ocil: |-
34-
{{{ ocil_directory_group_owner(directory="/etc/ssh/sshd_config.d", group="root") }}}
34+
{{{ ocil_directory_group_owner(directory=sshd_config_dir, group="root") }}}
3535
36-
fixtext: '{{{ fixtext_directory_group_owner(file="/etc/ssh/sshd_config.d", group="root") }}}'
36+
fixtext: '{{{ fixtext_directory_group_owner(file=sshd_config_dir, group="root") }}}'
3737

38-
srg_requirement: '{{{ srg_requirement_directory_group_owner(file="/etc/ssh/sshd_config.d", group="root") }}}'
38+
srg_requirement: '{{{ srg_requirement_directory_group_owner(file=sshd_config_dir, group="root") }}}'
3939

4040
template:
4141
name: file_groupowner
4242
vars:
43-
filepath: '/etc/ssh/sshd_config.d/'
43+
filepath: '{{{ sshd_config_dir }}}/'
4444
gid_or_name: '0'
4545

4646
platform: system_with_kernel

‎linux_os/guide/services/ssh/directory_owner_sshd_config_d/rule.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ documentation_complete: true
33
title: 'Verify Owner on SSH Server Configuration Files'
44

55
description: |-
6-
{{{ describe_directory_owner(directory="/etc/ssh/sshd_config.d", owner="root") }}}
6+
{{{ describe_directory_owner(directory=sshd_config_dir, owner="root") }}}
77
88
rationale: |-
99
Service configuration files enable or disable features of their respective
@@ -28,19 +28,19 @@ references:
2828
nist-csf: PR.AC-4,PR.DS-5
2929
srg: SRG-OS-000480-GPOS-00227
3030

31-
ocil_clause: '{{{ ocil_clause_directory_owner(directory="/etc/ssh/sshd_config.d", owner="root") }}}'
31+
ocil_clause: '{{{ ocil_clause_directory_owner(directory=sshd_config_dir, owner="root") }}}'
3232

3333
ocil: |-
34-
{{{ ocil_directory_owner(directory="/etc/ssh/sshd_config.d", owner="root") }}}
34+
{{{ ocil_directory_owner(directory=sshd_config_dir, owner="root") }}}
3535
36-
fixtext: '{{{ fixtext_directory_owner(file="/etc/ssh/sshd_config.d", owner="root") }}}'
36+
fixtext: '{{{ fixtext_directory_owner(file=sshd_config_dir, owner="root") }}}'
3737

38-
srg_requirement: '{{{ srg_requirement_directory_owner(file="/etc/ssh/sshd_config.d", owner="root") }}}'
38+
srg_requirement: '{{{ srg_requirement_directory_owner(file=sshd_config_dir, owner="root") }}}'
3939

4040
template:
4141
name: file_owner
4242
vars:
43-
filepath: '/etc/ssh/sshd_config.d/'
43+
filepath: '{{{ sshd_config_dir }}}/'
4444
uid_or_name: '0'
4545

4646
platform: system_with_kernel

‎linux_os/guide/services/ssh/directory_permissions_sshd_config_d/rule.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ documentation_complete: true
33
title: 'Verify Permissions on SSH Server Config File'
44

55
description: |-
6-
{{{ describe_directory_permissions(directory="/etc/ssh/sshd_config.d", perms="0700") }}}
6+
{{{ describe_directory_permissions(directory=sshd_config_dir, perms="0700") }}}
77
88
rationale: |-
99
Service configuration files enable or disable features of their respective
@@ -28,19 +28,19 @@ references:
2828
nist-csf: PR.AC-4,PR.DS-5
2929
srg: SRG-OS-000480-GPOS-00227
3030

31-
ocil_clause: '{{{ ocil_clause_directory_permissions(directory="/etc/ssh/sshd_config.d", perms="-rwx------") }}}'
31+
ocil_clause: '{{{ ocil_clause_directory_permissions(directory=sshd_config_dir, perms="-rwx------") }}}'
3232

3333
ocil: |-
34-
{{{ ocil_directory_permissions(directory="/etc/ssh/sshd_config.d", perms="-rwx------") }}}
34+
{{{ ocil_directory_permissions(directory=sshd_config_dir, perms="-rwx------") }}}
3535
36-
fixtext: '{{{ fixtext_directory_permissions(file="/etc/ssh/sshd_config.d", mode="0700") }}}'
36+
fixtext: '{{{ fixtext_directory_permissions(file=sshd_config_dir, mode="0700") }}}'
3737

38-
srg_requirement: '{{{ srg_requirement_directory_permission(file="/etc/ssh/sshd_config.d", mode="0700") }}}'
38+
srg_requirement: '{{{ srg_requirement_directory_permission(file=sshd_config_dir, mode="0700") }}}'
3939

4040
template:
4141
name: file_permissions
4242
vars:
43-
filepath: /etc/ssh/sshd_config.d/
43+
filepath: '{{{ sshd_config_dir }}}/'
4444
filemode: '0700'
4545

4646
platform: system_with_kernel

‎linux_os/guide/services/ssh/file_groupowner_sshd_config/rule.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ documentation_complete: true
44
title: 'Verify Group Who Owns SSH Server config file'
55

66
description: |-
7-
{{{ describe_file_group_owner(file="/etc/ssh/sshd_config", group="root") }}}
7+
{{{ describe_file_group_owner(file=sshd_main_config_file, group="root") }}}
88
99
rationale: |-
1010
Service configuration files enable or disable features of their respective
@@ -36,19 +36,19 @@ references:
3636
nist-csf: PR.AC-4,PR.DS-5
3737
srg: SRG-OS-000480-GPOS-00227
3838

39-
ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/ssh/sshd_config", group="root") }}}'
39+
ocil_clause: '{{{ ocil_clause_file_group_owner(file=sshd_main_config_file, group="root") }}}'
4040

4141
ocil: |-
42-
{{{ ocil_file_group_owner(file="/etc/ssh/sshd_config", group="root") }}}
42+
{{{ ocil_file_group_owner(file=sshd_main_config_file, group="root") }}}
4343
44-
fixtext: '{{{ fixtext_file_group_owner(file="/etc/ssh/sshd_config", group="root") }}}'
44+
fixtext: '{{{ fixtext_file_group_owner(file=sshd_main_config_file, group="root") }}}'
4545

46-
srg_requirement: '{{{ srg_requirement_file_group_owner(file="/etc/ssh/sshd_config", group="root") }}}'
46+
srg_requirement: '{{{ srg_requirement_file_group_owner(file=sshd_main_config_file, group="root") }}}'
4747

4848
template:
4949
name: file_groupowner
5050
vars:
51-
filepath: /etc/ssh/sshd_config
51+
filepath: '{{{ sshd_main_config_file }}}'
5252
gid_or_name: '0'
5353

5454
platform: system_with_kernel

‎linux_os/guide/services/ssh/file_groupowner_sshd_drop_in_config/rule.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ documentation_complete: true
33
title: 'Verify Group Who Owns SSH Server Configuration Files'
44

55
description: |-
6-
{{{ describe_files_in_directory_group_owner(directory="/etc/ssh/sshd_config.d", group="root") }}}
6+
{{{ describe_files_in_directory_group_owner(directory=sshd_config_dir, group="root") }}}
77
88
rationale: |-
99
Service configuration files enable or disable features of their respective
@@ -28,19 +28,19 @@ references:
2828
nist-csf: PR.AC-4,PR.DS-5
2929
srg: SRG-OS-000480-GPOS-00227
3030

31-
ocil_clause: '{{{ ocil_clause_files_in_directory_group_owner(directory="/etc/ssh/sshd_config.d", group="root") }}}'
31+
ocil_clause: '{{{ ocil_clause_files_in_directory_group_owner(directory=sshd_config_dir, group="root") }}}'
3232

3333
ocil: |-
34-
{{{ ocil_files_in_directory_group_owner(directory="/etc/ssh/sshd_config.d", group="root") }}}
34+
{{{ ocil_files_in_directory_group_owner(directory=sshd_config_dir, group="root") }}}
3535
36-
fixtext: '{{{ fixtext_files_in_directory_group_owner(directory="/etc/ssh/sshd_config.d", group="root") }}}'
36+
fixtext: '{{{ fixtext_files_in_directory_group_owner(directory=sshd_config_dir, group="root") }}}'
3737

38-
srg_requirement: '{{{ srg_requirement_files_in_directory_group_owner(directory="/etc/ssh/sshd_config.d", group="root") }}}'
38+
srg_requirement: '{{{ srg_requirement_files_in_directory_group_owner(directory=sshd_config_dir, group="root") }}}'
3939

4040
template:
4141
name: file_groupowner
4242
vars:
43-
filepath: '/etc/ssh/sshd_config.d/'
43+
filepath: '{{{ sshd_config_dir }}}/'
4444
file_regex: '^.*$'
4545
gid_or_name: '0'
4646

‎linux_os/guide/services/ssh/file_owner_sshd_config/rule.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ documentation_complete: true
44
title: 'Verify Owner on SSH Server config file'
55

66
description: |-
7-
{{{ describe_file_owner(file="/etc/ssh/sshd_config", owner="root") }}}
7+
{{{ describe_file_owner(file=sshd_main_config_file, owner="root") }}}
88
99
rationale: |-
1010
Service configuration files enable or disable features of their respective
@@ -36,19 +36,19 @@ references:
3636
nist-csf: PR.AC-4,PR.DS-5
3737
srg: SRG-OS-000480-GPOS-00227
3838

39-
ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/ssh/sshd_config", owner="root") }}}'
39+
ocil_clause: '{{{ ocil_clause_file_owner(file=sshd_main_config_file, owner="root") }}}'
4040

4141
ocil: |-
42-
{{{ ocil_file_owner(file="/etc/ssh/sshd_config", owner="root") }}}
42+
{{{ ocil_file_owner(file=sshd_main_config_file, owner="root") }}}
4343
44-
fixtext: '{{{ fixtext_file_owner(file="/etc/ssh/sshd_config", owner="root") }}}'
44+
fixtext: '{{{ fixtext_file_owner(file=sshd_main_config_file, owner="root") }}}'
4545

46-
srg_requirement: '{{{ srg_requirement_file_owner(file="/etc/ssh/sshd_config", owner="root") }}}'
46+
srg_requirement: '{{{ srg_requirement_file_owner(file=sshd_main_config_file, owner="root") }}}'
4747

4848
template:
4949
name: file_owner
5050
vars:
51-
filepath: /etc/ssh/sshd_config
51+
filepath: '{{{ sshd_main_config_file }}}'
5252
uid_or_name: '0'
5353

5454
platform: system_with_kernel

‎linux_os/guide/services/ssh/file_owner_sshd_drop_in_config/rule.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ documentation_complete: true
33
title: 'Verify Owner on SSH Server Configuration Files'
44

55
description: |-
6-
{{{ describe_files_in_directory_owner(directory="/etc/ssh/sshd_config.d", owner="root") }}}
6+
{{{ describe_files_in_directory_owner(directory=sshd_config_dir, owner="root") }}}
77
88
rationale: |-
99
Service configuration files enable or disable features of their respective
@@ -29,19 +29,19 @@ references:
2929
nist-csf: PR.AC-4,PR.DS-5
3030
srg: SRG-OS-000480-GPOS-00227
3131

32-
ocil_clause: '{{{ ocil_clause_files_in_directory_owner(directory="/etc/ssh/sshd_config.d", owner="root") }}}'
32+
ocil_clause: '{{{ ocil_clause_files_in_directory_owner(directory=sshd_config_dir, owner="root") }}}'
3333

3434
ocil: |-
35-
{{{ ocil_files_in_directory_owner(directory="/etc/ssh/sshd_config.d", owner="root") }}}
35+
{{{ ocil_files_in_directory_owner(directory=sshd_config_dir, owner="root") }}}
3636
37-
fixtext: '{{{ fixtext_files_in_directory_owner(directory="/etc/ssh/sshd_config.d", owner="root") }}}'
37+
fixtext: '{{{ fixtext_files_in_directory_owner(directory=sshd_config_dir, owner="root") }}}'
3838

39-
srg_requirement: '{{{ srg_requirement_files_in_directory_owner(directory="/etc/ssh/sshd_config.d", owner="root") }}}'
39+
srg_requirement: '{{{ srg_requirement_files_in_directory_owner(directory=sshd_config_dir, owner="root") }}}'
4040

4141
template:
4242
name: file_owner
4343
vars:
44-
filepath: '/etc/ssh/sshd_config.d/'
44+
filepath: '{{{ sshd_config_dir }}}/'
4545
file_regex: '^.*$'
4646
uid_or_name: '0'
4747

‎linux_os/guide/services/ssh/file_permissions_sshd_config/rule.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ documentation_complete: true
44
title: 'Verify Permissions on SSH Server config file'
55

66
description: |-
7-
{{{ describe_file_permissions(file="/etc/ssh/sshd_config", perms="0600") }}}
7+
{{{ describe_file_permissions(file=sshd_main_config_file, perms="0600") }}}
88
99
rationale: |-
1010
Service configuration files enable or disable features of their respective
@@ -36,20 +36,20 @@ references:
3636
nist-csf: PR.AC-4,PR.DS-5
3737
srg: SRG-OS-000480-GPOS-00227
3838

39-
ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/ssh/sshd_config", perms="-rw-------") }}}'
39+
ocil_clause: '{{{ ocil_clause_file_permissions(file=sshd_main_config_file, perms="-rw-------") }}}'
4040

4141
ocil: |-
42-
{{{ ocil_file_permissions(file="/etc/ssh/sshd_config", perms="-rw-------") }}}
42+
{{{ ocil_file_permissions(file=sshd_main_config_file, perms="-rw-------") }}}
4343
44-
fixtext: '{{{ fixtext_file_permissions(file="/etc/ssh/sshd_config", mode="0600") }}}'
44+
fixtext: '{{{ fixtext_file_permissions(file=sshd_main_config_file, mode="0600") }}}'
4545

46-
srg_requirement: '{{{ srg_requirement_file_permission(file="/etc/ssh/sshd_config", mode="0600") }}}'
46+
srg_requirement: '{{{ srg_requirement_file_permission(file=sshd_main_config_file, mode="0600") }}}'
4747

4848
template:
4949
name: file_permissions
5050
vars:
5151
filepath:
52-
- /etc/ssh/sshd_config
52+
- '{{{ sshd_main_config_file }}}'
5353
filemode: '0600'
5454

5555
platform: system_with_kernel

‎linux_os/guide/services/ssh/file_permissions_sshd_drop_in_config/rule.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ documentation_complete: true
33
title: 'Verify Permissions on SSH Server Config File'
44

55
description: |-
6-
{{{ describe_files_in_directory_permissions(directory="/etc/ssh/sshd_config.d", perms="0600") }}}
6+
{{{ describe_files_in_directory_permissions(directory=sshd_config_dir, perms="0600") }}}
77
88
rationale: |-
99
Service configuration files enable or disable features of their respective
@@ -28,19 +28,19 @@ references:
2828
nist-csf: PR.AC-4,PR.DS-5
2929
srg: SRG-OS-000480-GPOS-00227
3030

31-
ocil_clause: '{{{ ocil_clause_files_in_directory_permissions(directory="/etc/ssh/sshd_config.d", perms="-rw-------") }}}'
31+
ocil_clause: '{{{ ocil_clause_files_in_directory_permissions(directory=sshd_config_dir, perms="-rw-------") }}}'
3232

3333
ocil: |-
34-
{{{ ocil_files_in_directory_permissions(directory="/etc/ssh/sshd_config.d", perms="-rw-------") }}}
34+
{{{ ocil_files_in_directory_permissions(directory=sshd_config_dir, perms="-rw-------") }}}
3535
36-
fixtext: '{{{ fixtext_files_in_directory_permissions(directory="/etc/ssh/sshd_config.d", mode="0600") }}}'
36+
fixtext: '{{{ fixtext_files_in_directory_permissions(directory=sshd_config_dir, mode="0600") }}}'
3737

38-
srg_requirement: '{{{ srg_requirement_files_in_directory_permissions(directory="/etc/ssh/sshd_config.d", mode="0600") }}}'
38+
srg_requirement: '{{{ srg_requirement_files_in_directory_permissions(directory=sshd_config_dir, mode="0600") }}}'
3939

4040
template:
4141
name: file_permissions
4242
vars:
43-
filepath: '/etc/ssh/sshd_config.d/'
43+
filepath: '{{{ sshd_config_dir }}}/'
4444
file_regex: '^.*$'
4545
filemode: '0600'
4646

‎linux_os/guide/services/ssh/file_sshd_50_redhat_exists/rule.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
1+
{{% set sshd_redhat_drop_in_file = sshd_config_dir ~ "/50-redhat.conf" %}}
12
documentation_complete: true
23

3-
title: 'The File /etc/ssh/sshd_config.d/50-redhat.conf Must Exist'
4+
title: 'The File {{{ sshd_redhat_drop_in_file }}} Must Exist'
45

56
description: |-
6-
The <tt>/etc/ssh/sshd_config.d/50-redhat.conf</tt> file must exist as it contains important
7+
The <tt>{{{ sshd_redhat_drop_in_file }}}</tt> file must exist as it contains important
78
settings to secure SSH.
89
910
@@ -29,7 +30,7 @@ warnings:
2930
template:
3031
name: 'file_existence'
3132
vars:
32-
filepath: '/etc/ssh/sshd_config.d/50-redhat.conf'
33+
filepath: '{{{ sshd_redhat_drop_in_file }}}'
3334
exists: true
3435
backends:
3536
ansible: off

0 commit comments

Comments
 (0)