LinuxSshServerSecurityBaseline_AINE.json

{
  "properties": {
    "displayName": "[Preview]: Audit SSH Posture Control on Linux machines",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "description": "Requires that prerequisites are deployed to the policy assignment scope. For details, visit https://aka.ms/gcpol. Machines are non-compliant if SSH Server is not securely configured on the Linux machines.",
    "metadata": {
      "version": "1.0.0-preview",
      "category": "Guest Configuration",
      "preview": true,
      "requiredProviders": [
        "Microsoft.GuestConfiguration"
      ],
      "guestConfiguration": {
        "name": "LinuxSshServerSecurityBaseline",
        "version": "1.*",
        "configurationParameter": {
          "accessPermissionsForSshdConfig": "Ensure that permissions on /etc/ssh/sshd_config are configured;DesiredObjectValue",
          "ignoreHosts": "Ensure that the SSH IgnoreRhosts is configured;DesiredObjectValue",
          "logLevel": "Ensure that the SSH LogLevel is configured;DesiredObjectValue",
          "maxAuthTries": "Ensure that the SSH MaxAuthTries is configured;DesiredObjectValue",
          "allowUsers": "Ensure that the allowed users for SSH access are configured;DesiredObjectValue",
          "denyUsers": "Ensure that the denied users for SSH are configured;DesiredObjectValue",
          "allowGroups": "Ensure that the allowed groups for SSH are configured;DesiredObjectValue",
          "denyGroups": "Ensure that the denied groups for SSH are configured;DesiredObjectValue",
          "hostBasedAuthentication": "Ensure that the SSH HostBasedAuthentication is configured;DesiredObjectValue",
          "permitRootLogin": "Ensure that the SSH PermitRootLogin is configured;DesiredObjectValue",
          "permitEmptyPasswords": "Ensure that the SSH PermitEmptyPasswords is configured;DesiredObjectValue",
          "clientAliveCountMax": "Ensure that the SSH ClientAliveCountMax is configured;DesiredObjectValue",
          "clientAliveInterval": "Ensure that the SSH ClientAliveInterval is configured;DesiredObjectValue",
          "loginGraceTime": "Ensure that the SSH LoginGraceTime is configured;DesiredObjectValue",
          "messageAuthenticationCodeAlgorithms": "Ensure that only approved MAC algorithms are used;DesiredObjectValue",
          "banner": "Ensure that the SSH warning banner is configured;DesiredObjectValue",
          "permitUserEnvironment": "Ensure that the SSH PermitUserEnvironment is configured;DesiredObjectValue",
          "ciphers": "Ensure that appropriate ciphers are used for SSH;DesiredObjectValue",
          "port": "Ensure that the SSH port is configured;DesiredObjectValue"
        }
      }
    },
    "version": "1.0.0-preview",
    "parameters": {
      "IncludeArcMachines": {
        "type": "string",
        "metadata": {
          "displayName": "Include Arc connected servers",
          "description": "By selecting this option, you agree to be charged monthly per Arc connected machine.",
          "portalReview": "true"
        },
        "allowedValues": [
          "true",
          "false"
        ],
        "defaultValue": "false"
      },
      "effect": {
        "type": "string",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of this policy"
        },
        "allowedValues": [
          "AuditIfNotExists",
          "Disabled"
        ],
        "defaultValue": "AuditIfNotExists"
      },
      "accessPermissionsForSshdConfig": {
        "type": "string",
        "metadata": {
          "displayName": "Access permissions for sshd_config",
          "description": "File access permissions for /etc/ssh/sshd_config. Default is '600'"
        },
        "defaultValue": "600"
      },
      "ignoreHosts": {
        "type": "string",
        "metadata": {
          "displayName": "Ignore rhosts and shosts",
          "description": "Whether to ignore per-user .rhosts and .shosts files during HostbasedAuthentication. Default is 'yes'"
        },
        "defaultValue": "yes"
      },
      "logLevel": {
        "type": "string",
        "metadata": {
          "displayName": "Log verbosity level",
          "description": "The verbosity level for the sshd logging. Default is 'INFO'"
        },
        "defaultValue": "INFO"
      },
      "maxAuthTries": {
        "type": "string",
        "metadata": {
          "displayName": "Maximum number of authentication attempts",
          "description": "The maximum number of authentication attempts permitted per connection. Default is '6'"
        },
        "defaultValue": "6"
      },
      "allowUsers": {
        "type": "string",
        "metadata": {
          "displayName": "Allowed users for SSH",
          "description": "List of users to be allowed to connect with SSH. Default is all authenticated users ('*@*')"
        },
        "defaultValue": "*@*"
      },
      "denyUsers": {
        "type": "string",
        "metadata": {
          "displayName": "Denied users for SSH",
          "description": "List of users to be denied to connect with SSH. Default is 'root'"
        },
        "defaultValue": "root"
      },
      "allowGroups": {
        "type": "string",
        "metadata": {
          "displayName": "Allowed groups for SSH",
          "description": "List of user groups to be allowed to connect with SSH. Default is all groups ('*')"
        },
        "defaultValue": "*"
      },
      "denyGroups": {
        "type": "string",
        "metadata": {
          "displayName": "Denied groups for SSH",
          "description": "List of user groups to be denied to connect with SSH. Default is 'root'"
        },
        "defaultValue": "root"
      },
      "hostBasedAuthentication": {
        "type": "string",
        "metadata": {
          "displayName": "Host-based authentication",
          "description": "Host-based authentication. Default is 'no'"
        },
        "defaultValue": "no"
      },
      "permitRootLogin": {
        "type": "string",
        "metadata": {
          "displayName": "Whether root can log in using ssh",
          "description": "Whether root can log in using ssh. Default is 'no'"
        },
        "defaultValue": "no"
      },
      "permitEmptyPasswords": {
        "type": "string",
        "metadata": {
          "displayName": "Whether the server allows login to accounts with empty password strings",
          "description": "Whether the server allows login to accounts with empty password strings. Default is 'no'"
        },
        "defaultValue": "no"
      },
      "clientAliveCountMax": {
        "type": "string",
        "metadata": {
          "displayName": "The number of client alive messages which may be sent without sshd receiving any messages back from the client",
          "description": "The number of client alive messages which may be sent without sshd receiving any messages back from the client. Default is '0'"
        },
        "defaultValue": "0"
      },
      "clientAliveInterval": {
        "type": "string",
        "metadata": {
          "displayName": "Timeout interval in seconds after which if no data has been received from the client, sshd will send a message to request a response",
          "description": "Timeout interval in seconds after which if no data has been received from the client, sshd will send a message to request a response. Default is  1 hour ('3600')"
        },
        "defaultValue": "3600"
      },
      "loginGraceTime": {
        "type": "string",
        "metadata": {
          "displayName": "The time in seconds after which the server disconnects if the user has not successfully logged in",
          "description": "The time in seconds after which the server disconnects if the user has not successfully logged in. Default is 1 minute ('60')"
        },
        "defaultValue": "60"
      },
      "messageAuthenticationCodeAlgorithms": {
        "type": "string",
        "metadata": {
          "displayName": "The list of available message authentication code (MAC) algorithms",
          "description": "The list of available message authentication code (MAC) algorithms. Default is 'hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com'"
        },
        "defaultValue": "hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com"
      },
      "banner": {
        "type": "string",
        "metadata": {
          "displayName": "The contents of the banner file that is sent to the remote user before authentication is allowed",
          "description": "The contents of the banner file that is sent to the remote user before authentication is allowed. Default is '#######################################################################\n\nAuthorized access only!\n\nIf you are not authorized to access or use this system, disconnect now!\n\n#######################################################################\n'"
        },
        "defaultValue": "#######################################################################\n\nAuthorized access only!\n\nIf you are not authorized to access or use this system, disconnect now!\n\n#######################################################################\n"
      },
      "permitUserEnvironment": {
        "type": "string",
        "metadata": {
          "displayName": "Whether ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd",
          "description": "Whether ~/.ssh/environment and environment= options in ~/.ssh/authorized_keys are processed by sshd. Default is 'no'"
        },
        "defaultValue": "no"
      },
      "ciphers": {
        "type": "string",
        "metadata": {
          "displayName": "The list of allowed ciphers",
          "description": "The list of allowed ciphers. Default is 'aes128-ctr,aes192-ctr,aes256-ctr'"
        },
        "defaultValue": "aes128-ctr,aes192-ctr,aes256-ctr"
      },
      "port": {
        "type": "string",
        "metadata": {
          "displayName": "The SSH port",
          "description": "The SSH port. Default is '22'"
        },
        "defaultValue": "22"
      }
    },
    "policyRule": {
      "if": {
        "anyOf": [
          {
            "allOf": [
              {
                "anyOf": [
                  {
                    "field": "type",
                    "equals": "Microsoft.Compute/virtualMachines"
                  },
                  {
                    "field": "type",
                    "equals": "Microsoft.Compute/virtualMachineScaleSets"
                  }
                ]
              },
              {
                "field": "tags['aks-managed-orchestrator']",
                "exists": false
              },
              {
                "field": "tags['aks-managed-poolName']",
                "exists": false
              },
              {
                "anyOf": [
                  {
                    "field": "Microsoft.Compute/imagePublisher",
                    "in": [
                      "microsoft-aks",
                      "qubole-inc",
                      "datastax",
                      "couchbase",
                      "scalegrid",
                      "checkpoint",
                      "paloaltonetworks",
                      "debian",
                      "credativ"
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "field": "Microsoft.Compute/imagePublisher",
                        "equals": "OpenLogic"
                      },
                      {
                        "field": "Microsoft.Compute/imageSKU",
                        "notLike": "6*"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "field": "Microsoft.Compute/imagePublisher",
                        "equals": "Oracle"
                      },
                      {
                        "field": "Microsoft.Compute/imageSKU",
                        "notLike": "6*"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "field": "Microsoft.Compute/imagePublisher",
                        "equals": "RedHat"
                      },
                      {
                        "field": "Microsoft.Compute/imageSKU",
                        "notLike": "6*"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "field": "Microsoft.Compute/imagePublisher",
                        "equals": "center-for-internet-security-inc"
                      },
                      {
                        "field": "Microsoft.Compute/imageOffer",
                        "notLike": "cis-win*"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "field": "Microsoft.Compute/imagePublisher",
                        "equals": "Suse"
                      },
                      {
                        "field": "Microsoft.Compute/imageSKU",
                        "notLike": "11*"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "field": "Microsoft.Compute/imagePublisher",
                        "equals": "Canonical"
                      },
                      {
                        "field": "Microsoft.Compute/imageSKU",
                        "notLike": "12*"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "field": "Microsoft.Compute/imagePublisher",
                        "equals": "microsoft-dsvm"
                      },
                      {
                        "field": "Microsoft.Compute/imageOffer",
                        "notLike": "dsvm-win*"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "field": "Microsoft.Compute/imagePublisher",
                        "equals": "cloudera"
                      },
                      {
                        "field": "Microsoft.Compute/imageSKU",
                        "notLike": "6*"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "field": "Microsoft.Compute/imagePublisher",
                        "equals": "microsoft-ads"
                      },
                      {
                        "field": "Microsoft.Compute/imageOffer",
                        "like": "linux*"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "anyOf": [
                          {
                            "field": "Microsoft.Compute/virtualMachines/osProfile.linuxConfiguration",
                            "exists": true
                          },
                          {
                            "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
                            "like": "Linux*"
                          }
                        ]
                      },
                      {
                        "anyOf": [
                          {
                            "field": "Microsoft.Compute/imagePublisher",
                            "exists": false
                          },
                          {
                            "field": "Microsoft.Compute/imagePublisher",
                            "notIn": [
                              "OpenLogic",
                              "RedHat",
                              "credativ",
                              "Suse",
                              "Canonical",
                              "microsoft-dsvm",
                              "cloudera",
                              "microsoft-ads",
                              "center-for-internet-security-inc",
                              "Oracle",
                              "AzureDatabricks",
                              "azureopenshift"
                            ]
                          }
                        ]
                      }
                    ]
                  }
                ]
              }
            ]
          },
          {
            "allOf": [
              {
                "value": "[parameters('IncludeArcMachines')]",
                "equals": true
              },
              {
                "anyOf": [
                  {
                    "allOf": [
                      {
                        "field": "type",
                        "equals": "Microsoft.HybridCompute/machines"
                      },
                      {
                        "field": "Microsoft.HybridCompute/imageOffer",
                        "like": "linux*"
                      }
                    ]
                  },
                  {
                    "allOf": [
                      {
                        "field": "type",
                        "equals": "Microsoft.ConnectedVMwarevSphere/virtualMachines"
                      },
                      {
                        "field": "Microsoft.ConnectedVMwarevSphere/virtualMachines/osProfile.osType",
                        "like": "linux*"
                      }
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
          "name": "[concat('LinuxSshServerSecurityBaseline$pid', uniqueString(policy().assignmentId, policy().definitionReferenceId))]",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/complianceStatus",
                "equals": "Compliant"
              },
              {
                "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash",
                "equals": "[base64(concat('Ensure that permissions on /etc/ssh/sshd_config are configured;DesiredObjectValue', '=', parameters('accessPermissionsForSshdConfig'), ',', 'Ensure that the SSH IgnoreRhosts is configured;DesiredObjectValue', '=', parameters('ignoreHosts'), ',', 'Ensure that the SSH LogLevel is configured;DesiredObjectValue', '=', parameters('logLevel'), ',', 'Ensure that the SSH MaxAuthTries is configured;DesiredObjectValue', '=', parameters('maxAuthTries'), ',', 'Ensure that the allowed users for SSH access are configured;DesiredObjectValue', '=', parameters('allowUsers'), ',', 'Ensure that the denied users for SSH are configured;DesiredObjectValue', '=', parameters('denyUsers'), ',', 'Ensure that the allowed groups for SSH are configured;DesiredObjectValue', '=', parameters('allowGroups'), ',', 'Ensure that the denied groups for SSH are configured;DesiredObjectValue', '=', parameters('denyGroups'), ',', 'Ensure that the SSH HostBasedAuthentication is configured;DesiredObjectValue', '=', parameters('hostBasedAuthentication'), ',', 'Ensure that the SSH PermitRootLogin is configured;DesiredObjectValue', '=', parameters('permitRootLogin'), ',', 'Ensure that the SSH PermitEmptyPasswords is configured;DesiredObjectValue', '=', parameters('permitEmptyPasswords'), ',', 'Ensure that the SSH ClientAliveCountMax is configured;DesiredObjectValue', '=', parameters('clientAliveCountMax'), ',', 'Ensure that the SSH ClientAliveInterval is configured;DesiredObjectValue', '=', parameters('clientAliveInterval'), ',', 'Ensure that the SSH LoginGraceTime is configured;DesiredObjectValue', '=', parameters('loginGraceTime'), ',', 'Ensure that only approved MAC algorithms are used;DesiredObjectValue', '=', parameters('messageAuthenticationCodeAlgorithms'), ',', 'Ensure that the SSH warning banner is configured;DesiredObjectValue', '=', parameters('banner'), ',', 'Ensure that the SSH PermitUserEnvironment is configured;DesiredObjectValue', '=', parameters('permitUserEnvironment'), ',', 'Ensure that appropriate ciphers are used for SSH;DesiredObjectValue', '=', parameters('ciphers'), ',', 'Ensure that the SSH port is configured;DesiredObjectValue', '=', parameters('port')))]"
              }
            ]
          }
        }
      }
    },
    "versions": [
      "1.0.0-PREVIEW"
    ]
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/a8f3e6a6-dcd2-434c-b0f7-6f309ce913b4",
  "name": "a8f3e6a6-dcd2-434c-b0f7-6f309ce913b4"
}