Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update rule sles-15-040250 #10492

Merged
merged 2 commits into from
May 10, 2023
Merged

update rule sles-15-040250 #10492

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5eef774
update rule sles-15-040250
svet-se Apr 25, 2023
7618409
refactor ansible and use FQCN
svet-se May 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions linux_os/guide/services/ssh/file_permissions_sshd_private_key/ansible/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,31 +7,39 @@
{{% set find_command_base = 'find -H /etc/ssh/ -maxdepth 1 -user root -regex ".*_key$" -type f' %}}
{{% set dedicated_ssh_groupname = groups.get("dedicated_ssh_keyowner", {}).get("name") %}}

{{% if product in ["sle12", "sle15"] %}}
{{% set find_command_permissions = 'u+xs,g+xws,o+xwrt' %}}
{{% set permissions_mode = 'u-xs,g-xws,o-xwrt' %}}
{{% else %}}
{{% set find_command_permissions = 'u+xs,g+xwrs,o+xwrt' %}}
{{% set permissions_mode = 'u-xs,g-xwrs,o-xwrt' %}}
{{% endif %}}

- name: Find root:root-owned keys
command: '{{{ find_command_base }}} -group root -perm /u+xs,g+xwrs,o+xwrt'
ansible.builtin.command: '{{{ find_command_base }}} -group root -perm /{{{ find_command_permissions }}}'
register: root_owned_keys
changed_when: False
failed_when: False
check_mode: no

- name: Set permissions for root:root-owned keys
file:
ansible.builtin.file:
path: "{{ item }}"
mode: "u-xs,g-xwrs,o-xwrt"
mode: '{{{ permissions_mode }}}'
state: file
with_items:
- "{{ root_owned_keys.stdout_lines }}"

{{% if dedicated_ssh_groupname -%}}
- name: Find root:{{{ dedicated_ssh_groupname }}}-owned keys
command: '{{{ find_command_base }}} -group {{{ dedicated_ssh_groupname }}} -perm /u+xs,g+xws,o+xwrt'
ansible.builtin.command: '{{{ find_command_base }}} -group {{{ dedicated_ssh_groupname }}} -perm /u+xs,g+xws,o+xwrt'
register: dedicated_group_owned_keys
changed_when: False
failed_when: False
check_mode: no

- name: Set permissions for root:{{{ dedicated_ssh_groupname }}}-owned keys
file:
ansible.builtin.file:
path: "{{ item }}"
mode: "u-xs,g-xws,o-xwrt"
state: file
Expand Down
4 changes: 4 additions & 0 deletions linux_os/guide/services/ssh/file_permissions_sshd_private_key/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,11 @@ test root:{{{ groupname }}} = "$(stat -c "%U:%G" "$keyfile")"
for keyfile in /etc/ssh/*_key; do
test -f "$keyfile" || continue
if {{{ keyfile_owned_by("root") }}}; then
{{% if product in ["sle12", "sle15"] %}}
chmod u-xs,g-xws,o-xwrt "$keyfile"
{{% else %}}
chmod u-xs,g-xwrs,o-xwrt "$keyfile"
{{% endif %}}
{{% if dedicated_ssh_groupname -%}}
elif {{{ keyfile_owned_by(dedicated_ssh_groupname) }}}; then
chmod u-xs,g-xws,o-xwrt "$keyfile"
Expand Down
6 changes: 5 additions & 1 deletion linux_os/guide/services/ssh/file_permissions_sshd_private_key/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,8 +58,12 @@
{{# intentionally not considered: <unix:uread datatype="boolean">true</unix:uread> #}}
{{# intentionally not considered: <unix:uwrite datatype="boolean">true</unix:uwrite> #}}
<unix:uexec datatype="boolean">false</unix:uexec>


{{% if product in ["sle12", "sle15"] -%}}
{{# intentionally not considered: <unix:gread datatype="boolean">true</unix:gread> #}}
{{%- else %}}
<unix:gread datatype="boolean">false</unix:gread>
{{%- endif %}}
<unix:gwrite datatype="boolean">false</unix:gwrite>
<unix:gexec datatype="boolean">false</unix:gexec>

Expand Down
6 changes: 3 additions & 3 deletions linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ title: 'Verify Permissions on SSH Server Private *_key Key Files'

{{% set dedicated_ssh_groupname = groups.get("dedicated_ssh_keyowner", {}).get("name") %}}

{{% if product == 'rhcos4' %}}
{{% if product in ["rhcos4", "sle12", "sle15"] %}}
{{# CoreOS is special - it is immutable, so it is more predictable, and it uses the dedicated group as key owner by default #}}
{{% set perms = "-rw-r-----" %}}
{{% set perms_num = "0640" %}}
Expand Down Expand Up @@ -67,6 +67,6 @@ ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/ssh/*_key", perms=perm
ocil: |-
{{{ ocil_file_permissions(file="/etc/ssh/*_key", perms=perms) }}}

fixtext: '{{{ srg_requirement_file_permission(file="/etc/ssh/*_key", mode="0600") }}}'
fixtext: '{{{ srg_requirement_file_permission(file="/etc/ssh/*_key", mode=perms_num) }}}'

srg_requirement: 'The {{{ full_namne }}} SSH private host key files must have mode 0600 or less permissive.'
srg_requirement: 'The {{{ full_namne }}} SSH private host key files must have mode {{{ perms_num }}} or less permissive.'