Add extended definition to check for OpenSSH 7.4 in sshd_disable_compression

[ggbecker]

Description:

• Add extended definition to check for OpenSSH 7.4 or higher in sshd_disable_compression

Rationale:

• The pre-authentication vulnerability was fixed since OpenSSH 7.4 so the SSH configuration represented by this rules doesn't make sense if the version is equals or higher to that.

• Changelog reference:

 * sshd(8): Remove support for pre-authentication compression.
   Doing compression early in the protocol probably seemed reasonable
   in the 1990s, but today it's clearly a bad idea in terms of both
   cryptography (cf. multiple compression oracle attacks in TLS) and
   attack surface. Pre-auth compression support has been disabled by
   default for >10 years. Support remains in the client.

• STIG requirement: https://www.stigviewer.com/stig/red_hat_enterprise_linux_7/2020-09-03/finding/V-204602

Additional Information

• The test scenarios still have to be updated, hence the draft PR.

• Fixes: sshd_disable_compression fails when set to yes on RHEL7.4+ systems #6345

[openshift-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openscap-ci]

Changes identified:
Rules:
 sshd_disable_compression

Show details

Rule sshd_disable_compression:
 New node inserted to OVAL check.

Recommended tests to execute:
 build_product rhel8
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-rhel8-ds.xml sshd_disable_compression

[matejak]

This looks really great, especially the test coverage. Is there any reason for keeping it as a draft PR?

[ggbecker]

This looks really great, especially the test coverage. Is there any reason for keeping it as a draft PR?

On my tests, the package downgrade commands were not working. I tested on RHEL7.9 and I'm not sure if it's not possible to downgrade them anymore or if I was doing something wrong.

Update1:

On a RHEL7.9 machine, the command:

yum downgrade -y openssh-6.6.1p1 openssh-clients-6.6.1p1 openssh-server-6.6.1p1

returns:

No package openssh-6.6.1p1 available.
No package openssh-clients-6.6.1p1 available.
No package openssh-server-6.6.1p1 available.

So, the downgrade test scenario should probably go away.

[ggbecker]

I've flipped to ready to review. The solution proposed is to remove all the fail test scenarios as we cannot reproduce them anymore because the package downgrade doesn't work anymore for recent versions of RHEL (e.g 7.9).

[carlosmmatos]

/retest