Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Introduce new rule sshd_use_approved_kex_ordered_stig #10103

Merged
merged 3 commits into from
Jan 26, 2023
Merged

Introduce new rule sshd_use_approved_kex_ordered_stig #10103

merged 3 commits into from
Jan 26, 2023

Conversation

freddieRv
Copy link
Contributor

Description:

  • This rule implements the new DISA STIG requirements OL07-00-040712, OL08-00-040342, RHEL-07-040712, and RHEL-08-040342

Rationale:

  • OL/RHEL SITG efforts

@freddieRv freddieRv requested review from a team as code owners January 20, 2023 18:45
@github-actions
Copy link

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

Mab879
Mab879 previously requested changes Jan 20, 2023
View reviewed changes
Copy link
Member

@Mab879 Mab879 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please double-check the CCEs.

cce CCE-83280-8 is included in files: 
 - linux_os/guide/services/ssh/ssh_server/sshd_use_approved_kex_ordered_stig/rule.yml
 - linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml

cce CCE-83636-1 is included in files: 
 - linux_os/guide/services/ssh/ssh_server/sshd_use_approved_kex_ordered_stig/rule.yml
 - linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml

@freddieRv
Copy link
Contributor Author

Please double-check the CCEs.

cce CCE-83280-8 is included in files: 
 - linux_os/guide/services/ssh/ssh_server/sshd_use_approved_kex_ordered_stig/rule.yml
 - linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml

cce CCE-83636-1 is included in files: 
 - linux_os/guide/services/ssh/ssh_server/sshd_use_approved_kex_ordered_stig/rule.yml
 - linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs_ordered_stig/rule.yml

I took the first one from shared/references/cce-redhat-avail.txt and assigned it to this new rule.
Also removed the SLE one. Was this the correct approach @Mab879 ?

@freddieRv freddieRv force-pushed the sshd_kex_fips branch 2 times, most recently from d537f5d to 6e792b1 Compare January 23, 2023 16:19
jan-cerny
jan-cerny approved these changes Jan 25, 2023
View reviewed changes
Copy link
Collaborator

@jan-cerny jan-cerny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason of Automatus fail on CS9 is that this rule is only for RHEL7 and 8.

When I run tests on RHEL 7 locally, they pass:

[jcerny@thinkpad scap-security-guide{pr/10103}]$ python3 tests/automatus.py rule  --libvirt qemu:///system ssgts_rhel7 sshd_use_approved_kex_ordered_stig
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-01-25-1352/test_suite.log
WARNING - Script default_fips.pass.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_sshd_use_approved_kex_ordered_stig
INFO - Script comment.fail.sh using profile (all) OK
INFO - Script correct_reduced_list.pass.sh using profile (all) OK
INFO - Script correct_scrambled.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script line_not_there.fail.sh using profile (all) OK
INFO - Script no_parameters.fail.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
[jcerny@thinkpad scap-security-guide{pr/10103}]$ python3 tests/automatus.py rule --remediate-using ansible  --libvirt qemu:///system ssgts_rhel7 sshd_use_approved_kex_ordered_stig
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-01-25-1402/test_suite.log
WARNING - Script default_fips.pass.sh is not applicable on given platform
INFO - xccdf_org.ssgproject.content_rule_sshd_use_approved_kex_ordered_stig
INFO - Script comment.fail.sh using profile (all) OK
INFO - Script correct_reduced_list.pass.sh using profile (all) OK
INFO - Script correct_scrambled.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script line_not_there.fail.sh using profile (all) OK
INFO - Script no_parameters.fail.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK

The fail on CentOS 7 testing_farm job is in the test Sanity/machine-hardening/stig and the reason is that this new rule depends on "installed OS is FIPS certified" therefore it will never pass on CentOS 7 which isn't FIPS certified. I think we need to update the blocklist in https://src.fedoraproject.org/tests/scap-security-guide/blob/main/f/Sanity/machine-hardening/runtest.sh#_27. I have created a PR for it: https://src.fedoraproject.org/tests/scap-security-guide/pull-request/29

@jan-cerny
Copy link
Collaborator

@ComplianceAsCode/oracle-maintainers PTAL

@jan-cerny jan-cerny added this to the 0.1.67 milestone Jan 25, 2023
@jan-cerny jan-cerny added RHEL7 Red Hat Enterprise Linux 7 product related. STIG STIG Benchmark related. Oracle Linux Oracle Linux product related. New Rule Issues or pull requests related to new Rules. labels Jan 25, 2023
@jan-cerny jan-cerny self-assigned this Jan 25, 2023
@yuumasato
Copy link
Member

@jan-cerny @freddieRv is the only member of oracle-maintainers and I think he cannot approve his own PR.
I think you can override the approval requirements.

yuumasato
yuumasato approved these changes Jan 25, 2023
View reviewed changes
Copy link
Member

@yuumasato yuumasato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This LGTM.

Xeicker and others added 3 commits January 25, 2023 11:46
@Xeicker @freddieRv
Introduce rule sshd_use_approved_kex_ordered_stig
0496fd1 
This rule implements the new DISA STIG requirements OL07-00-040712,
OL08-00-040342, RHEL-07-040712, and RHEL-08-040342

Signed-off-by: Edgar Aguilar <edgar.aguilar@oracle.com>
Signed-off-by: Federico Ramírez <federico.r.ramirez@oracle.com>
@Xeicker @freddieRv
Add tests to sshd_use_approved_kex_ordered_stig
d0079cb 
Signed-off-by: Edgar Aguilar <edgar.aguilar@oracle.com>
Signed-off-by: Federico Ramírez <federico.r.ramirez@oracle.com>
@freddieRv
Add missing-remediation warning
9eec8f4 
Add a warning about the missing remediations for rule
sshd_use_approved_kex_ordered_stig for OL8 and RHEL8.

The remediation would require modifying the crypto-policies
files, which might be too disruptive.

Signed-off-by: Federico Ramirez <federico.r.ramirez@oracle.com>
@freddieRv freddieRv requested a review from Mab879 January 25, 2023 22:04
@codeclimate
Copy link

codeclimate bot commented Jan 25, 2023

Code Climate has analyzed commit 9eec8f4 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 49.5% (0.0% change).

View more on Code Climate.

@jan-cerny jan-cerny dismissed Mab879’s stale review January 26, 2023 08:42

the CCE has been addressed

@yuumasato
Copy link
Member

Overriding and merging, since Freddie is the only member of Oracle maintainers

@yuumasato yuumasato merged commit e3b3f51 into ComplianceAsCode:master Jan 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@yuumasato yuumasato yuumasato approved these changes

@jan-cerny jan-cerny jan-cerny approved these changes

@Mab879 Mab879 Awaiting requested review from Mab879

Assignees

@jan-cerny jan-cerny

Labels
New Rule Issues or pull requests related to new Rules. Oracle Linux Oracle Linux product related. RHEL7 Red Hat Enterprise Linux 7 product related. STIG STIG Benchmark related.
Projects
None yet
Milestone
0.1.67
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@freddieRv @jan-cerny @yuumasato @Mab879 @Xeicker