Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rule 4.2.12 fails, because it does not edit all the needed sshd config files #30

Closed
DianaMariaDDM opened this issue Dec 21, 2023 · 0 comments
Assignees
Labels
bug Something isn't working

Comments

@DianaMariaDDM
Copy link
Contributor

Describe the Issue
Control 4.2.12 gets a "FAIL" result from CIS, because it does not comply to its requirements.

Expected Behavior
In its "Assessment" section CIS checks the compliance of this rule with a script and by looking at certain files. The files that are checked by CIS are the /etc/ssh/sshd_config file and all of the files ending in .conf from this path: /etc/ssh/sshd_config.d/. If all of these files are edited accordingly, the rule passes.

Actual Behavior
The rule edits only the file mentioned in the amzn2023cis_sshd_config_file variable. In this case it only edits the /etc/ssh/sshd_config file, leading to the failing of the rule!

Control(s) Affected
4.2.12 Ensure SSH X11 forwarding is disabled

Environment (please complete the following information):

  • branch being used: [e.g. devel]

Additional Notes
The fix provided for this control can be applied to all of the rules from section 4.2.x, that have the same assessment method!

Possible Solution
As a solution, two preliminary tasks can be created. One that identifies .conf files from /etc/ssh/sshd_config.d/ and one that identifies the main configuration file. Both of these tasks are registering the files found. Based on these registers the rule's task can be rewritten to ensure that the needed line is added in all of the files checked by CIS.
This solution will be presented in a PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants