Skip to content

Commit f2d2f82

Browse files
teacup-on-rockingchairteacup-on-rockingchair
committed
Update sshd_lineinfile template to better fit SLE16 platform
- ansible copy distro defaults and remove Include /usr/etc/ssh/sshd_config.d/*.conf from main config - bash copy distro defaults and remove Include /usr/etc/ssh/sshd_config.d/*.conf from main config - removed no longer needed tests checking /usr/etc/ssh stuff - tests now use sshd_main_config_file and sshd_config_dir(oracle specific test remain unchanged)
1 parent 798483b commit f2d2f82

18 files changed

Lines changed: 134 additions & 205 deletions

‎shared/templates/sshd_lineinfile/ansible.template‎

Lines changed: 31 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -4,46 +4,38 @@
44
# complexity = low
55
# disruption = low
66

7+
{{% if product in [ 'sle16', 'slmicro6' ] %}}
8+
{{{ ansible_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file, rule_title=rule_title) }}}
9+
- name: Check if SSH {{{ sshd_main_config_file }}} configuration file exists
10+
ansible.builtin.stat:
11+
path: {{{ sshd_main_config_file }}}
12+
register: sshd_main_config_file_{{{ rule_id }}}
13+
{{{
14+
ansible_lineinfile(
15+
rule_title + ' - Remove /usr/etc/ssh/sshd_config.d/*.conf include directive from ' + sshd_main_config_file,
16+
path=sshd_main_config_file,
17+
regex='^\s*Include\s+\/usr\/etc\/ssh\/sshd_config\.d/\*\.conf',
18+
state='absent',
19+
when='sshd_main_config_file_' + rule_id + '.stat.exists'
20+
)
21+
}}}
22+
{{% endif %}}
23+
724
{{% if XCCDF_VARIABLE %}}
825
{{{ ansible_instantiate_variables(XCCDF_VARIABLE) }}}
9-
{{%- if product == 'sle16' -%}}
10-
{{{
11-
ansible_sshd_set_usr(
12-
parameter=PARAMETER,
13-
value="{{ "+XCCDF_VARIABLE+" }}",
14-
copy_defaults='true',
15-
config_basename=CONFIG_BASENAME,
16-
rule_title=rule_title
17-
)
18-
}}}
19-
{{%- else -%}}
20-
{{{
21-
ansible_sshd_set(
22-
parameter=PARAMETER,
23-
value="{{ "+XCCDF_VARIABLE+" }}",
24-
config_is_distributed=sshd_distributed_config,
25-
config_basename=CONFIG_BASENAME, rule_title=rule_title)
26-
}}}
27-
{{%- endif -%}}
26+
{{{
27+
ansible_sshd_set(
28+
parameter=PARAMETER,
29+
value="{{ "+XCCDF_VARIABLE+" }}",
30+
config_is_distributed=sshd_distributed_config,
31+
config_basename=CONFIG_BASENAME, rule_title=rule_title)
32+
}}}
2833
{{% else %}}
29-
{{%- if product == 'sle16' -%}}
30-
{{{
31-
ansible_sshd_set_usr(
32-
parameter=PARAMETER,
33-
value=VALUE,
34-
copy_defaults='true',
35-
config_basename=CONFIG_BASENAME,
36-
rule_title=rule_title
37-
)
38-
}}}
39-
{{%- else -%}}
40-
{{{
41-
ansible_sshd_set(
42-
parameter=PARAMETER,
43-
value=VALUE,
44-
config_is_distributed=sshd_distributed_config,
45-
config_basename=CONFIG_BASENAME, rule_title=rule_title)
46-
}}}
47-
{{%- endif -%}}
48-
34+
{{{
35+
ansible_sshd_set(
36+
parameter=PARAMETER,
37+
value=VALUE,
38+
config_is_distributed=sshd_distributed_config,
39+
config_basename=CONFIG_BASENAME, rule_title=rule_title)
40+
}}}
4941
{{% endif %}}

‎shared/templates/sshd_lineinfile/bash.template‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,14 @@
44
# complexity = low
55
# disruption = low
66

7+
{{% if product in ['sle16', 'slmicro6'] %}}
8+
{{{ bash_copy_distro_defaults("/usr/etc/ssh/sshd_config", sshd_main_config_file) }}}
9+
{{{ lineinfile_absent(sshd_main_config_file, "^\s*Include\s*/usr/etc/ssh/sshd_config\.d/\*\.conf", sed_path_separator="#", rule_id=rule_id) }}}
10+
{{% endif %}}
11+
712
{{% if XCCDF_VARIABLE %}}
813
{{{- bash_instantiate_variables(XCCDF_VARIABLE) -}}}
9-
{{%- if product == 'sle16' -%}}
10-
{{{- bash_sshd_remediation_usr(parameter=PARAMETER, value="$" ~ XCCDF_VARIABLE, copy_defaults=true, config_basename=CONFIG_BASENAME, rule_id=rule_id) -}}}
11-
{{%- else -%}}
12-
{{{- bash_sshd_remediation(parameter=PARAMETER, value="$" ~ XCCDF_VARIABLE, config_is_distributed=sshd_distributed_config, config_basename=CONFIG_BASENAME, rule_id=rule_id) -}}}
13-
{{%- endif -%}}
14+
{{{- bash_sshd_remediation(parameter=PARAMETER, value="$" ~ XCCDF_VARIABLE, config_is_distributed=sshd_distributed_config, config_basename=CONFIG_BASENAME, rule_id=rule_id) -}}}
1415
{{%- else -%}}
15-
{{%- if product == 'sle16' -%}}
16-
{{{- bash_sshd_remediation_usr(parameter=PARAMETER, value=VALUE, copy_defaults=true, config_basename=CONFIG_BASENAME, rule_id=rule_id) -}}}
17-
{{%- else -%}}
18-
{{{- bash_sshd_remediation(parameter=PARAMETER, value=VALUE, config_is_distributed=sshd_distributed_config, config_basename=CONFIG_BASENAME, rule_id=rule_id) -}}}
19-
{{%- endif -%}}
16+
{{{- bash_sshd_remediation(parameter=PARAMETER, value=VALUE, config_is_distributed=sshd_distributed_config, config_basename=CONFIG_BASENAME, rule_id=rule_id) -}}}
2017
{{%- endif -%}}

‎shared/templates/sshd_lineinfile/oval.template‎

Lines changed: 19 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,27 @@
1-
{{%- if product == 'sle16' -%}}
2-
{{%- if XCCDF_VARIABLE -%}}
3-
{{{
4-
sshd_oval_check_usr(
5-
parameter=PARAMETER,
6-
xccdf_variable=XCCDF_VARIABLE,
7-
missing_parameter_pass=MISSING_PARAMETER_PASS,
8-
datatype=DATATYPE,
9-
rule_id=rule_id,
10-
rule_title=rule_title
11-
)
12-
}}}
13-
{{%- else -%}}
14-
{{{
15-
sshd_oval_check_usr(
1+
{{%- if XCCDF_VARIABLE -%}}
2+
{{{
3+
sshd_oval_check(
164
parameter=PARAMETER,
17-
value=VALUE,
18-
missing_parameter_pass=MISSING_PARAMETER_PASS,
19-
datatype=DATATYPE,
20-
rule_id=rule_id,
21-
rule_title=rule_title
22-
)
23-
}}}
24-
{{%- endif -%}}
25-
{{%- else -%}}
26-
{{%- if XCCDF_VARIABLE -%}}
27-
{{{
28-
sshd_oval_check(
29-
parameter=PARAMETER,
30-
xccdf_variable=XCCDF_VARIABLE,
31-
missing_parameter_pass=MISSING_PARAMETER_PASS,
32-
config_is_distributed=sshd_distributed_config,
33-
runtime_check=sshd_runtime_check,
34-
datatype=DATATYPE,
35-
rule_id=rule_id,
36-
rule_title=rule_title
37-
)
38-
}}}
39-
{{%- else -%}}
40-
{{{
41-
sshd_oval_check(
42-
parameter=PARAMETER,
43-
value=VALUE,
5+
xccdf_variable=XCCDF_VARIABLE,
446
missing_parameter_pass=MISSING_PARAMETER_PASS,
457
config_is_distributed=sshd_distributed_config,
468
runtime_check=sshd_runtime_check,
479
datatype=DATATYPE,
4810
rule_id=rule_id,
4911
rule_title=rule_title
50-
)
51-
}}}
52-
{{%- endif -%}}
12+
)
13+
}}}
14+
{{%- else -%}}
15+
{{{
16+
sshd_oval_check(
17+
parameter=PARAMETER,
18+
value=VALUE,
19+
missing_parameter_pass=MISSING_PARAMETER_PASS,
20+
config_is_distributed=sshd_distributed_config,
21+
runtime_check=sshd_runtime_check,
22+
datatype=DATATYPE,
23+
rule_id=rule_id,
24+
rule_title=rule_title
25+
)
26+
}}}
5327
{{%- endif -%}}

‎shared/templates/sshd_lineinfile/tests/common.sh‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,12 @@
11
#!/bin/bash
22

3-
mkdir -p /etc/ssh/sshd_config.d
4-
touch /etc/ssh/sshd_config.d/nothing
3+
mkdir -p "{{{ sshd_config_dir }}}"
4+
touch "{{{ sshd_config_dir }}}/nothing"
55

6-
declare -a SSHD_PATHS=("/etc/ssh/sshd_config" /etc/ssh/sshd_config.d/*)
7-
{{% if product == 'sle16' %}}
8-
SSHD_PATHS+=("/usr/etc/ssh/sshd_config" /usr/etc/ssh/sshd_config.d/*)
9-
{{% endif %}}
6+
declare -a SSHD_PATHS=("{{{ sshd_main_config_file }}}" "{{{ sshd_config_dir }}}/*")
107

118
if grep -q "^\s*{{{ PARAMETER }}}" "${SSHD_PATHS[@]}" ; then
129
sed -i "s/^{{{ PARAMETER }}}.*/# {{{ PARAMETER }}} {{{ CORRECT_VALUE }}}/g" "${SSHD_PATHS[@]}"
1310
else
14-
echo "# {{{ PARAMETER }}} {{{ CORRECT_VALUE }}}" >> /etc/ssh/sshd_config
11+
echo "# {{{ PARAMETER }}} {{{ CORRECT_VALUE }}}" >> "{{{ sshd_main_config_file }}}"
1512
fi

‎shared/templates/sshd_lineinfile/tests/correct_value_directory.pass.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
source common.sh
99

1010
{{% if product in ["ol8", "ol9"] %}}
11-
{{{ bash_replace_or_append("/etc/ssh/sshd_config", "Include", "/etc/ssh/sshd_config.d/*.conf", "%s %s", cce_identifiers=cce_identifiers) }}}
11+
{{{ bash_replace_or_append("{{{ sshd_main_config_file }}}", "Include", "{{{ sshd_config_dir }}}/*.conf", "%s %s", cce_identifiers=cce_identifiers) }}}
1212
{{% endif %}}
1313

1414
{{{ bash_sshd_remediation(parameter=PARAMETER, value=CORRECT_VALUE, config_is_distributed=sshd_distributed_config, rule_id=rule_id) -}}}

‎shared/templates/sshd_lineinfile/tests/correct_value_usr_config_dir.pass.sh‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎shared/templates/sshd_lineinfile/tests/correct_value_usr_config_path.pass.sh‎

Lines changed: 0 additions & 13 deletions
This file was deleted.

‎shared/templates/sshd_lineinfile/tests/duplicated_param.pass.sh‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,9 @@
11
#!/bin/bash
22

3-
declare -a SSHD_PATHS=("/etc/ssh/sshd_config" /etc/ssh/sshd_config.d/*)
4-
{{% if product == 'sle16' %}}
5-
SSHD_PATHS+=("/usr/etc/ssh/sshd_config" /usr/etc/ssh/sshd_config.d/*)
6-
{{% endif %}}
3+
declare -a SSHD_PATHS=("{{{ sshd_main_config_file }}}" "{{{ sshd_config_dir }}}/*")
74

8-
mkdir -p /etc/ssh/sshd_config.d
9-
touch /etc/ssh/sshd_config.d/nothing
5+
mkdir -p "{{{ sshd_config_dir }}}"
6+
touch "{{{ sshd_config_dir }}}/nothing"
107

118
if grep -q "^\s*{{{ PARAMETER }}}" "${SSHD_PATHS[@]}" ; then
129
sed -i "/^\s*{{{ PARAMETER }}}.*/Id" "${SSHD_PATHS[@]}"

‎shared/templates/sshd_lineinfile/tests/duplicated_param_directory.pass.sh‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,14 @@
22

33
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 9,Red Hat Enterprise Linux 10,SUSE Linux Enterprise 16,multi_platform_fedora,multi_platform_ubuntu
44

5-
mkdir -p /etc/ssh/sshd_config.d
6-
touch /etc/ssh/sshd_config.d/nothing
5+
mkdir -p "{{{ sshd_config_dir }}}"
6+
touch "{{{ sshd_config_dir }}}/nothing"
77

88
{{% if product in ["ol8", "ol9"] %}}
99
{{{ bash_replace_or_append("/etc/ssh/sshd_config", "Include", "/etc/ssh/sshd_config.d/*.conf", "%s %s", cce_identifiers=cce_identifiers) }}}
1010
{{% endif %}}
1111

12-
declare -a SSHD_PATHS=("/etc/ssh/sshd_config" /etc/ssh/sshd_config.d/*)
13-
{{% if product == 'sle16' %}}
14-
SSHD_PATHS+=("/usr/etc/ssh/sshd_config" /usr/etc/ssh/sshd_config.d/*)
15-
{{% endif %}}
12+
declare -a SSHD_PATHS=("{{{ sshd_main_config_file }}}" "{{{ sshd_config_dir }}}/*")
1613

1714
if grep -q "^\s*{{{ PARAMETER }}}" "${SSHD_PATHS[@]}" ; then
1815
sed -i "/^\s*{{{ PARAMETER }}}.*/Id" "${SSHD_PATHS[@]}"
@@ -22,5 +19,9 @@ fi
2219
# variables = {{{ XCCDF_VARIABLE }}}={{{ CORRECT_VALUE }}}
2320
{{% endif %}}
2421

25-
echo "{{{ PARAMETER }}} {{{ CORRECT_VALUE }}}" >> /etc/ssh/sshd_config.d/first.conf
26-
echo "{{{ PARAMETER }}} {{{ CORRECT_VALUE }}}" >> /etc/ssh/sshd_config.d/second.conf
22+
{{% if product in ["sle16", "slmicro6"] %}}
23+
touch "{{{ sshd_main_config_file }}}"
24+
{{% endif %}}
25+
26+
echo "{{{ PARAMETER }}} {{{ CORRECT_VALUE }}}" >> "{{{ sshd_config_dir }}}/first.conf"
27+
echo "{{{ PARAMETER }}} {{{ CORRECT_VALUE }}}" >> "{{{ sshd_config_dir }}}/second.conf"

‎shared/templates/sshd_lineinfile/tests/line_not_there.fail.sh‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,14 @@
22

33
SSHD_PARAM={{{ PARAMETER }}}
44

5-
mkdir -p /etc/ssh/sshd_config.d
6-
touch /etc/ssh/sshd_config.d/nothing
7-
8-
{{% if product == 'sle16' %}}
9-
touch /etc/ssh/sshd_config
10-
sed -i "/^\s*${SSHD_PARAM}.*/Id" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* /usr/etc/ssh/sshd_config /usr/etc/ssh/sshd_config.d/*
11-
{{% else %}}
12-
sed -i "/^\s*${SSHD_PARAM}.*/Id" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*
5+
declare -a SSHD_PATHS=("{{{ sshd_main_config_file }}}" "{{{ sshd_config_dir }}}/*")
6+
mkdir -p "{{{ sshd_config_dir }}}"
7+
touch "{{{ sshd_config_dir }}}/nothing"
8+
9+
{{% if product in ['sle16', 'slmicro6'] %}}
10+
touch "{{{ sshd_main_config_file }}}"
1311
{{% endif %}}
12+
13+
if grep -q "^\s*${SSHD_PARAM}" "${SSHD_PATHS[@]}" ; then
14+
sed -i "/^\s*${SSHD_PARAM}.*/Id" "${SSHD_PATHS[@]}"
15+
fi

0 commit comments

Comments
 (0)