diff --git a/products/rhcos4/product.yml b/products/rhcos4/product.yml index d1ae9ebf1ba..d83119dcf13 100644 --- a/products/rhcos4/product.yml +++ b/products/rhcos4/product.yml @@ -20,6 +20,10 @@ groups: sshd_distributed_config: "true" +# Enable runtime sshd configuration checking for compliance operator scans +# Compliance Operator fetches the result of sshd -T and stores it in a file +sshd_runtime_check: "true" + cpes_root: "../../shared/applicability" cpes: - rhcos4: diff --git a/shared/macros/10-oval.jinja b/shared/macros/10-oval.jinja index 260d2d73f5c..6466728189d 100644 --- a/shared/macros/10-oval.jinja +++ b/shared/macros/10-oval.jinja @@ -1033,9 +1033,10 @@ Generates the :code:`` tag for OVAL check using correct product platfo :type datatype: str #}} -{{%- macro sshd_oval_check(parameter, value, missing_parameter_pass, config_is_distributed, xccdf_variable="", datatype="", rule_id=None, rule_title=None) -%}} +{{%- macro sshd_oval_check(parameter, value, missing_parameter_pass, config_is_distributed, runtime_check="false", xccdf_variable="", datatype="", rule_id=None, rule_title=None) -%}} {{%- set sshd_config_path = "/etc/ssh/sshd_config" %}} {{%- set sshd_config_dir = "/etc/ssh/sshd_config.d" -%}} +{{%- set sshd_runtime_path = "/tmp/runtime/sshd_effective_config" -%}} {{%- if xccdf_variable -%}} {{%- set description = "Ensure '" ~ parameter ~ "' is configured with value configured in " ~ xccdf_variable ~ " variable in " ~ sshd_config_path %}} {{%- else -%}} @@ -1072,18 +1073,28 @@ Generates the :code:`` tag for OVAL check using correct product platfo definition_ref="package_openssh-server_installed" /> {{% endif %}} - - {{{- oval_line_in_file_criterion(sshd_config_path, parameter, avoid_conflicting=true, rule_id=rule_id) | indent(10)}}} - {{%- if config_is_distributed == "true" %}} - {{{- oval_line_in_directory_criterion(sshd_config_dir, parameter, avoid_conflicting=true, rule_id=rule_id) | indent(10) }}} - {{%- endif %}} - {{% if product in ["ol8", "ol9"] %}} - {{{- oval_line_in_file_criterion("sshd_config included", parameter, id_stem=rule_id ~ "_sshd_included_files", avoid_conflicting=true, rule_id=rule_id) | indent(10)}}} + {{%- if runtime_check == "true" %}} + + + + + {{%- endif %}} + {{%- if runtime_check != "true" %}} + + + {{{- oval_line_in_file_criterion(sshd_config_path, parameter, avoid_conflicting=true, rule_id=rule_id) | indent(12)}}} + {{%- if config_is_distributed == "true" %}} + {{{- oval_line_in_directory_criterion(sshd_config_dir, parameter, avoid_conflicting=true, rule_id=rule_id) | indent(12) }}} + {{%- endif %}} + {{% if product in ["ol8", "ol9"] %}} + {{{- oval_line_in_file_criterion("sshd_config included", parameter, id_stem=rule_id ~ "_sshd_included_files", avoid_conflicting=true, rule_id=rule_id) | indent(12)}}} + {{% endif %}} + + {{%- if not missing_parameter_pass %}} + {{% endif %}} - {{%- if not missing_parameter_pass %}} - - {{% endif %}} + {{%- endif %}} @@ -1162,6 +1173,49 @@ Generates the :code:`` tag for OVAL check using correct product platfo {{% endif %}} + + {{%- if runtime_check == "true" %}} + + + + + + + {{{ sshd_runtime_path }}} + .* + 1 + + + + + {{%- if xccdf_variable -%}} + + {{%- else -%}} + + {{%- endif -%}} + + + + {{{ sshd_runtime_path }}} + ^[\s]*{{{ parameter | lower }}}[\s]+(.*)$ + 1 + + + {{%- if xccdf_variable -%}} + + + + {{%- else -%}} + + {{{ value | lower if datatype == 'string' else value }}} + + {{%- endif -%}} + {{%- endif %}} + {{%- endmacro %}} diff --git a/shared/templates/sshd_lineinfile/oval.template b/shared/templates/sshd_lineinfile/oval.template index 99bc7dbee39..d3f4218ec30 100644 --- a/shared/templates/sshd_lineinfile/oval.template +++ b/shared/templates/sshd_lineinfile/oval.template @@ -1,5 +1,5 @@ {{%- if XCCDF_VARIABLE -%}} -{{{ sshd_oval_check(parameter=PARAMETER, xccdf_variable=XCCDF_VARIABLE, missing_parameter_pass=MISSING_PARAMETER_PASS, config_is_distributed=sshd_distributed_config, datatype=DATATYPE, rule_id=rule_id, rule_title=rule_title) }}} +{{{ sshd_oval_check(parameter=PARAMETER, xccdf_variable=XCCDF_VARIABLE, missing_parameter_pass=MISSING_PARAMETER_PASS, config_is_distributed=sshd_distributed_config, runtime_check=sshd_runtime_check, datatype=DATATYPE, rule_id=rule_id, rule_title=rule_title) }}} {{%- else -%}} -{{{ sshd_oval_check(parameter=PARAMETER, value=VALUE, missing_parameter_pass=MISSING_PARAMETER_PASS, config_is_distributed=sshd_distributed_config, datatype=DATATYPE, rule_id=rule_id, rule_title=rule_title) }}} +{{{ sshd_oval_check(parameter=PARAMETER, value=VALUE, missing_parameter_pass=MISSING_PARAMETER_PASS, config_is_distributed=sshd_distributed_config, runtime_check=sshd_runtime_check, datatype=DATATYPE, rule_id=rule_id, rule_title=rule_title) }}} {{%- endif -%}} diff --git a/ssg/constants.py b/ssg/constants.py index 25a9693a4cb..832732e1f40 100644 --- a/ssg/constants.py +++ b/ssg/constants.py @@ -462,6 +462,7 @@ DEFAULT_RSYSLOG_CAFILE = '/etc/pki/tls/cert.pem' DEFAULT_FAILLOCK_PATH = '/var/run/faillock' DEFAULT_SSH_DISTRIBUTED_CONFIG = 'false' +DEFAULT_SSH_RUNTIME_CHECK = 'false' DEFAULT_PRODUCT = 'example' DEFAULT_CHRONY_CONF_PATH = '/etc/chrony.conf' DEFAULT_CHRONY_D_PATH = '/etc/chrony.d/' diff --git a/ssg/products.py b/ssg/products.py index c08f9cb7562..25cb41c3776 100644 --- a/ssg/products.py +++ b/ssg/products.py @@ -17,6 +17,7 @@ DEFAULT_AUDIT_WATCHES_STYLE, DEFAULT_RSYSLOG_CAFILE, DEFAULT_SSH_DISTRIBUTED_CONFIG, + DEFAULT_SSH_RUNTIME_CHECK, DEFAULT_CHRONY_CONF_PATH, DEFAULT_CHRONY_D_PATH, DEFAULT_AUDISP_CONF_PATH, @@ -108,6 +109,9 @@ def _get_implied_properties(existing_properties): if "sshd_distributed_config" not in existing_properties: result["sshd_distributed_config"] = DEFAULT_SSH_DISTRIBUTED_CONFIG + if "sshd_runtime_check" not in existing_properties: + result["sshd_runtime_check"] = DEFAULT_SSH_RUNTIME_CHECK + if "product" not in existing_properties: result["product"] = DEFAULT_PRODUCT diff --git a/tests/data/product_stability/alinux2.yml b/tests/data/product_stability/alinux2.yml index a5ea062bfc8..758ed04ab27 100644 --- a/tests/data/product_stability/alinux2.yml +++ b/tests/data/product_stability/alinux2.yml @@ -85,6 +85,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/alinux3.yml b/tests/data/product_stability/alinux3.yml index 9cfcf3c7f5f..e8df627c48b 100644 --- a/tests/data/product_stability/alinux3.yml +++ b/tests/data/product_stability/alinux3.yml @@ -85,6 +85,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/anolis23.yml b/tests/data/product_stability/anolis23.yml index f358fb6d2b3..8b41ee0abeb 100644 --- a/tests/data/product_stability/anolis23.yml +++ b/tests/data/product_stability/anolis23.yml @@ -84,6 +84,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/anolis8.yml b/tests/data/product_stability/anolis8.yml index 6ea514a4da3..906bbe9a484 100644 --- a/tests/data/product_stability/anolis8.yml +++ b/tests/data/product_stability/anolis8.yml @@ -84,6 +84,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/debian11.yml b/tests/data/product_stability/debian11.yml index 4a82ddf4bf2..fe41f44198e 100644 --- a/tests/data/product_stability/debian11.yml +++ b/tests/data/product_stability/debian11.yml @@ -94,6 +94,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/debian12.yml b/tests/data/product_stability/debian12.yml index 8fe0afe738a..92d6c32ecc1 100644 --- a/tests/data/product_stability/debian12.yml +++ b/tests/data/product_stability/debian12.yml @@ -95,6 +95,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/debian13.yml b/tests/data/product_stability/debian13.yml index 75a041831bf..7a7f6411132 100644 --- a/tests/data/product_stability/debian13.yml +++ b/tests/data/product_stability/debian13.yml @@ -95,6 +95,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/eks.yml b/tests/data/product_stability/eks.yml index b1c88cb7b8b..df97dc7eb94 100644 --- a/tests/data/product_stability/eks.yml +++ b/tests/data/product_stability/eks.yml @@ -92,6 +92,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/example.yml b/tests/data/product_stability/example.yml index b44035b82b6..2cbad33f7fd 100644 --- a/tests/data/product_stability/example.yml +++ b/tests/data/product_stability/example.yml @@ -86,6 +86,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/fedora.yml b/tests/data/product_stability/fedora.yml index b0cc325cbc6..d37cbd094bc 100644 --- a/tests/data/product_stability/fedora.yml +++ b/tests/data/product_stability/fedora.yml @@ -130,6 +130,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem sshd_distributed_config: 'true' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/firefox.yml b/tests/data/product_stability/firefox.yml index 5e2e4b39888..757c88d7b68 100644 --- a/tests/data/product_stability/firefox.yml +++ b/tests/data/product_stability/firefox.yml @@ -81,6 +81,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/ocp4.yml b/tests/data/product_stability/ocp4.yml index 6d944e445d7..c09dcc8094d 100644 --- a/tests/data/product_stability/ocp4.yml +++ b/tests/data/product_stability/ocp4.yml @@ -192,6 +192,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/ol7.yml b/tests/data/product_stability/ol7.yml index 28fc8780ad5..1a9e0671987 100644 --- a/tests/data/product_stability/ol7.yml +++ b/tests/data/product_stability/ol7.yml @@ -96,6 +96,7 @@ reference_uris: release_key_fingerprint: 42144123FECFC55B9086313D72F97B74EC551F03 rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/ol8.yml b/tests/data/product_stability/ol8.yml index 98abd16cb3d..e983100c0b2 100644 --- a/tests/data/product_stability/ol8.yml +++ b/tests/data/product_stability/ol8.yml @@ -95,6 +95,7 @@ reference_uris: release_key_fingerprint: 76FD3DB13AB67410B89DB10E82562EA9AD986DA3 rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/ol9.yml b/tests/data/product_stability/ol9.yml index e3173eaef35..1bc329e1439 100644 --- a/tests/data/product_stability/ol9.yml +++ b/tests/data/product_stability/ol9.yml @@ -99,6 +99,7 @@ reference_uris: release_key_fingerprint: 3E6D826D3FBAB389C2F38E34BC4D06A08D8B756F rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'true' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/openembedded.yml b/tests/data/product_stability/openembedded.yml index 68ecc97b11e..4c6072ee64d 100644 --- a/tests/data/product_stability/openembedded.yml +++ b/tests/data/product_stability/openembedded.yml @@ -97,6 +97,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/opensuse.yml b/tests/data/product_stability/opensuse.yml index 36f1cdb2d0f..23aeb63e1c7 100644 --- a/tests/data/product_stability/opensuse.yml +++ b/tests/data/product_stability/opensuse.yml @@ -92,8 +92,9 @@ reference_uris: stigid: https://www.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem -sshd_distributed_config: "false" -sysctl_remediate_drop_in_file: "false" +sshd_distributed_config: 'false' +sshd_runtime_check: 'false' +sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 - 11 diff --git a/tests/data/product_stability/rhcos4.yml b/tests/data/product_stability/rhcos4.yml index 2518614670e..3e9a08aa1c6 100644 --- a/tests/data/product_stability/rhcos4.yml +++ b/tests/data/product_stability/rhcos4.yml @@ -90,6 +90,7 @@ reference_uris: release_key_fingerprint: 567E347AD0044ADE55BA8A5F199E2F91FD431D51 rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'true' +sshd_runtime_check: 'true' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/rhel10.yml b/tests/data/product_stability/rhel10.yml index 284e8461348..494900236d8 100644 --- a/tests/data/product_stability/rhel10.yml +++ b/tests/data/product_stability/rhel10.yml @@ -97,6 +97,7 @@ reference_uris: release_key_fingerprint: 567E347AD0044ADE55BA8A5F199E2F91FD431D51 rsyslog_cafile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem sshd_distributed_config: 'true' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/rhel8.yml b/tests/data/product_stability/rhel8.yml index d8aef9ae364..f1150341102 100644 --- a/tests/data/product_stability/rhel8.yml +++ b/tests/data/product_stability/rhel8.yml @@ -147,6 +147,7 @@ reference_uris: release_key_fingerprint: 567E347AD0044ADE55BA8A5F199E2F91FD431D51 rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/rhel9.yml b/tests/data/product_stability/rhel9.yml index cd1afd61b31..6a0a6212cec 100644 --- a/tests/data/product_stability/rhel9.yml +++ b/tests/data/product_stability/rhel9.yml @@ -104,6 +104,7 @@ reference_uris: release_key_fingerprint: 567E347AD0044ADE55BA8A5F199E2F91FD431D51 rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'true' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/rhv4.yml b/tests/data/product_stability/rhv4.yml index 198d6f3db0a..016aec57a2e 100644 --- a/tests/data/product_stability/rhv4.yml +++ b/tests/data/product_stability/rhv4.yml @@ -95,6 +95,7 @@ reference_uris: release_key_fingerprint: 567E347AD0044ADE55BA8A5F199E2F91FD431D51 rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/sle12.yml b/tests/data/product_stability/sle12.yml index 858c9119c96..b42e4494310 100644 --- a/tests/data/product_stability/sle12.yml +++ b/tests/data/product_stability/sle12.yml @@ -95,6 +95,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'true' target_oval_version: - 5 diff --git a/tests/data/product_stability/sle15.yml b/tests/data/product_stability/sle15.yml index a3cecb59132..04912acb800 100644 --- a/tests/data/product_stability/sle15.yml +++ b/tests/data/product_stability/sle15.yml @@ -101,6 +101,7 @@ reference_uris: release_key_fingerprint: FEAB502539D846DB2C0961CA70AF9E8139DB7C82 rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'false' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'true' target_oval_version: - 5 diff --git a/tests/data/product_stability/ubuntu2204.yml b/tests/data/product_stability/ubuntu2204.yml index 7ed5f5618ae..52b7d05fd2b 100644 --- a/tests/data/product_stability/ubuntu2204.yml +++ b/tests/data/product_stability/ubuntu2204.yml @@ -103,6 +103,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'true' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5 diff --git a/tests/data/product_stability/ubuntu2404.yml b/tests/data/product_stability/ubuntu2404.yml index 9ce793a8454..dd4cf290ffe 100644 --- a/tests/data/product_stability/ubuntu2404.yml +++ b/tests/data/product_stability/ubuntu2404.yml @@ -104,6 +104,7 @@ reference_uris: stigref: https://www.cyber.mil/stigs/srg-stig-tools/ rsyslog_cafile: /etc/pki/tls/cert.pem sshd_distributed_config: 'true' +sshd_runtime_check: 'false' sysctl_remediate_drop_in_file: 'false' target_oval_version: - 5