sshd_limit_user_access: Improve rule description, add oval and tests

[dodys]

Description:

• As discussed in PR Add new rule to limit ssh access #10402 this PR adds OVAL and tests to sshd_limit_user_access

Rationale:

• This is needed for CIS on most distros

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sshd_limit_user_access'.
--- xccdf_org.ssgproject.content_rule_sshd_limit_user_access
+++ xccdf_org.ssgproject.content_rule_sshd_limit_user_access
@@ -4,11 +4,29 @@
 
 [description]:
 By default, the SSH configuration allows any user with an account
-to access the system. In order to specify the users that are allowed to login
-via SSH and deny all other users, add or correct the following line in the
-/etc/ssh/sshd_config file:
-AllowUsers USER1 USER2
-Where USER1 and USER2 are valid user names.
+to access the system. There are several options available to limit
+which users and group can access the system via SSH. It is
+recommended that at least one of the following options be leveraged:
+- AllowUsers variable gives the system administrator the option of
+ allowing specific users to ssh into the system. The list consists of
+ space separated user names. Numeric user IDs are not recognized with
+ this variable. If a system administrator wants to restrict user
+ access further by specifically allowing a user's access only from a
+ particular host, the entry can be specified in the form of user@host.
+- AllowGroups variable gives the system administrator the option of
+ allowing specific groups of users to ssh into the system. The list
+ consists of space separated group names. Numeric group IDs are not
+ recognized with this variable.
+- DenyUsers variable gives the system administrator the option of
+ denying specific users to ssh into the system. The list consists of
+ space separated user names. Numeric user IDs are not recognized with
+ this variable. If a system administrator wants to restrict user
+ access further by specifically denying a user's access from a
+ particular host, the entry can be specified in the form of user@host.
+- DenyGroups variable gives the system administrator the option of
+ denying specific groups of users to ssh into the system. The list
+ consists of space separated group names. Numeric group IDs are not
+ recognized with this variable.
 
 [reference]:
 11

New datastream adds OVAL for rule 'xccdf_org.ssgproject.content_rule_sshd_limit_user_access'.
OCIL for rule 'xccdf_org.ssgproject.content_rule_sshd_limit_user_access' differs.
--- ocil:ssg-sshd_limit_user_access_ocil:questionnaire:1
+++ ocil:ssg-sshd_limit_user_access_ocil:questionnaire:1
@@ -1,6 +1,6 @@
 To ensure sshd limits the users who can log in, run the following:
-$ sudo grep AllowUsers /etc/ssh/sshd_config
-If properly configured, the output should be a list of usernames allowed to log in
-to this system.
+pre>$ sudo grep -rPi '^\h*(allow|deny)(users|groups)\h+\H+(\h+.*)?$' /etc/ssh/sshd_config*
+If properly configured, the output should be a list of usernames and/or
+groups allowed to log in to this system.
 Is it the case that sshd does not limit the users who can log in?

[marcusburghardt]

Would it be valid to have a test with an option defined but empty? Like AllowUsers without any user specified.

[freddieRv]

Changes LGTM

[marcusburghardt]

/packit test

[marcusburghardt]

/packit build

[codeclimate]

Code Climate has analyzed commit ef90ed0 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 52.4% (0.0% change).

View more on Code Climate.

[marcusburghardt]

Thanks for this rule update!

[marcusburghardt]

Overriding CODEOWNERS since a SUSE approver is not currently available and @dodys can't approve his own PR.

[jan-cerny]

Resolves: https://issues.redhat.com/browse/RHEL-1314