Update sshd crypto policy for CC

[vojtapolasek]

Description:

Add supported public key algorithms to sshd crypto-policy - rsa-sha2-256,rsa-sha2-512

Rationale:

Update supported algorithms for common criteria

[yuumasato]

LGTM, but..
@jjaburek @stevegrubb Can the new algorithms just be appended? Should they be in inserted in a specific position?

[stevegrubb]

In a lot of cases, sshd/ssh uses the order given as the preferred order. So, generally you want things ordered from strongest to weakest. I don't think this particular setting matters on the server side. But it might on the client side. The safest thing to do is just go from strong to weak.

[vojtapolasek]

In a lot of cases, sshd/ssh uses the order given as the preferred order. So, generally you want things ordered from strongest to weakest. I don't think this particular setting matters on the server side. But it might on the client side. The safest thing to do is just go from strong to weak.

So dou want me to also sort ciphers etc? Cause now they are afaik not sorted from strongest to weakest. How about this?
-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ssh-rsa -oPubkeyAcceptedKeyTypes=ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,rsa-sha2-512,rsa-sha2-256,ssh-rsa

[mildas]

Changes identified:
Rule harden_sshd_crypto_policy:
 Template usage changed in OVAL check.
 Found change in bash remediation.

Recommended tests to execute:
 build_product ocp4
 test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate bash --datastream build/ssg-ocp4-ds.xml harden_sshd_crypto_policy

[yuumasato]

@t8m Hi, does the order of the algorithms for opensshserver matter?

If so, can you help review order of the algorithms?

[t8m]

Yes, it does. I think the new order is OK.

[yuumasato]

Awesome, thank you for the review.