Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ensure that var_sshd_set_keepalive is not set to 0 in rhel8 and rhel9 profiles #11851

Merged

Conversation

vojtapolasek
Copy link
Collaborator

Description:

  • modify all instances of var_sshd_set_keepalive variable so that it is not set to 0
  • focus on rhel8 and rhel9 products, but in case it is common in a control file, modify rather the control file
  • update profile stability tests

Rationale:

  • context: after merging of Set the requires to sshd_set_keepalive on sshd_set_idle_timeout #11815 the rule sshd_set_keepalive starts being active in many profiles.
  • that is fine, but the interpretation of the value "0" of this variable by sshd changed. In recent versions of ssh, if the value is set to "0", it disables the connection termination. That effectively goes against the reason why this configuration is used in hardening scenarios.

Review Hints:

  • build rhel8 and rhel9 products
  • check compiled profiles if there is not a case when var_sshd_set_keepalive is set to 0

@vojtapolasek vojtapolasek added RHEL9 Red Hat Enterprise Linux 9 product related. Update Profile Issues or pull requests related to Profiles updates. RHEL8 Red Hat Enterprise Linux 8 product related. labels Apr 18, 2024
@vojtapolasek vojtapolasek added this to the 0.1.73 milestone Apr 18, 2024
@vojtapolasek vojtapolasek requested a review from a team as a code owner April 18, 2024 08:52
@vojtapolasek vojtapolasek changed the title ensure that var_sshd_set_keepalive is not se to 0 in rhel8 and rhel9 profiles ensure that var_sshd_set_keepalive is not set to 0 in rhel8 and rhel9 profiles Apr 18, 2024
Copy link

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

Copy link

github-actions bot commented Apr 18, 2024

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11851
This image was built from commit: 474d405

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11851

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11851 make deploy-local

@Mab879 Mab879 self-assigned this Apr 18, 2024
Copy link
Member

@Mab879 Mab879 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please update the stable profile tests.

Copy link

codeclimate bot commented Apr 19, 2024

Code Climate has analyzed commit 474d405 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.2% (0.0% change).

View more on Code Climate.

@vojtapolasek
Copy link
Collaborator Author

fixed @Mab879

@Mab879 Mab879 merged commit 3448e46 into ComplianceAsCode:master Apr 19, 2024
44 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
RHEL8 Red Hat Enterprise Linux 8 product related. RHEL9 Red Hat Enterprise Linux 9 product related. Update Profile Issues or pull requests related to Profiles updates.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants