Some ssh rules write remediation to /etc/ssh/sshd_config.d/ but check /etc/ssh/sshd_config

[jgleissner]

Description of problem:

Some ssh rules write remediation it a distributed configuration file in /etc/ssh/sshd_config.d/ (if system uses distributed files) but check for expected configuration settings in /etc/ssh/sshd_config, which fails for obvious reasons.

The encountered the behavior with the following rules:

• sshd_use_approved_ciphers
• sshd_use_approved_ciphers_ordered_stig
• sshd_use_approved_macs
• sshd_use_approved_macs_ordered_stig

More rules may be affected.

SCAP Security Guide Version:

0.1.81

I believe the issue was introduced with that version as the rules pass in builds that use 0.1.80.

Operating System Version:

SLES 15 SP5

Steps to Reproduce:

1. Start SLES 15 SP5+ instance (any system with distributed sshd config will probably do)
2. Run remediation for rules in question, e.g. oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml

Actual Results:

Remediation error:

:/ # oscap xccdf eval --remediate --rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml
--- Starting Evaluation ---

Title   Use Only FIPS 140-2 Validated Ciphers
Rule    xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
Ident   CCE-91337-6
Result  fail


--- Starting Remediation ---

Title   Use Only FIPS 140-2 Validated Ciphers
Rule    xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
Ident   CCE-91337-6
Result  error

Remediation was written though:

:/ # ls /etc/ssh/sshd_config.d/
00-complianceascode-hardening.conf

Expected Results:

Remediation check passes.

[Tomatotech90]

I looked into this, and it looks like the OVAL check reads only /etc/ssh/sshd_config, but the remediation can write to /etc/ssh/sshd_config.d/ on distributed config systems. I confirmed this locally and reproduced the exact failure described here.
Other rules already handle distributed config correctly, and I can follow that pattern for sshd_use_approved_ciphers_ordered_stig and sshd_use_approved_macs_ordered_stig.
sshd_use_approved_ciphers and sshd_use_approved_macs are different. They check that at least one approved value is present out of a list, and no shared macro supports that check across both the main file and the config directory yet.
I will open a PR to see if this is correct.