New rules to complete CIS requirements for SSH Keys #10552

marcusburghardt · 2023-05-11T09:53:54Z

Description:

It was introduced new templated rules to satisfy the following CIS requirements for RHEL:

5.2.2 - Ensure permissions on SSH private host key files are configured (Automated)
5.2.3 - Ensure permissions on SSH public host key files are configured (Automated)

Rationale:

Better CIS coverage for RHEL
Fixes RHEL 8 CIS 5.2.3 Ensure permissions on SSH private host key files are configured (Automated) #7334

Review Hints:

These are templated rules, so a run of Automatus should be enough.
It is also good to check the generated CIS guide.

The Bash and Ansible remediation generated by the file_owner and file_groupowner templates were including many unnecessary blank lines at the beginning of the resulted remediations due to the way the jinja2 lines were declared. It was fixed to remove the unnecessary spaces at the beginning.

The id attribute was included by product so new templated rules using the file_groupowner template can use this attribute more flexibly.

The requirement 5.3.2 for RHEL7 and 5.2.2 for RHEL8 and RHEL9 were updated to automated after the inclusion of new rules related to owner and group-owner of ssh private keys.

The requirement 5.3.3 for RHEL7 and 5.2.3 for RHEL8 and RHEL9 were updated to automated after the inclusion of new rules related to owner and group-owner of ssh public keys.

github-actions · 2023-05-11T09:55:27Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2023-05-11T09:58:17Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership' differs.
--- xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership
+++ xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership
@@ -2,17 +2,11 @@
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 chgrp 0 /sbin/auditctl
-
 chgrp 0 /sbin/aureport
-
 chgrp 0 /sbin/ausearch
-
 chgrp 0 /sbin/autrace
-
 chgrp 0 /sbin/auditd
-
 chgrp 0 /sbin/rsyslogd
-
 chgrp 0 /sbin/augenrules
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_audit_tools_ownership' differs.
--- xccdf_org.ssgproject.content_rule_file_audit_tools_ownership
+++ xccdf_org.ssgproject.content_rule_file_audit_tools_ownership
@@ -2,17 +2,11 @@
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 chown 0 /sbin/auditctl
-
 chown 0 /sbin/aureport
-
 chown 0 /sbin/ausearch
-
 chown 0 /sbin/autrace
-
 chown 0 /sbin/auditd
-
 chown 0 /sbin/rsyslogd
-
 chown 0 /sbin/augenrules
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/issue

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/issue.net

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/motd

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_issue' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_issue
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_issue
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/issue

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/issue.net

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_motd' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_motd
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_motd
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/motd

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration
+++ xccdf_org.ssgproject.content_rule_file_groupownership_audit_configuration
@@ -2,7 +2,6 @@
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 find /etc/audit/ -maxdepth 1 -type f ! -gid 0 -regex '^audit(\.rules|d\.conf)$' -exec chgrp 0 {} \;
-
 
 find /etc/audit/rules.d/ -maxdepth 1 -type f ! -gid 0 -regex '^.*\.rules$' -exec chgrp 0 {} \;
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group
+++ xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/group-

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/gshadow-

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/passwd-

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/shadow-

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_group' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_group
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_group
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/group

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/gshadow

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/passwd

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow
+++ xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /etc/shadow

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group
+++ xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/group-

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow
+++ xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/gshadow-

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/passwd-

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow
+++ xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/shadow-

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_group' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_group
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_group
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/group

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/gshadow

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_passwd' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_passwd
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_passwd
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/passwd

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_etc_shadow' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_etc_shadow
+++ xccdf_org.ssgproject.content_rule_file_owner_etc_shadow
@@ -1,4 +1 @@
-
-
-
 chown 0 /etc/shadow

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_var_log' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_var_log
+++ xccdf_org.ssgproject.content_rule_file_groupowner_var_log
@@ -1,4 +1 @@
-
-
-
 find -H /var/log/ -maxdepth 1 -type d -exec chgrp 0 {} \;

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages
+++ xccdf_org.ssgproject.content_rule_file_groupowner_var_log_messages
@@ -1,4 +1 @@
-
-
-
 chgrp 0 /var/log/messages

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog
+++ xccdf_org.ssgproject.content_rule_file_groupowner_var_log_syslog
@@ -1,4 +1 @@
-
-
-
 chgrp 4 /var/log/syslog

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_var_log' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_var_log
+++ xccdf_org.ssgproject.content_rule_file_owner_var_log
@@ -1,4 +1 @@
-
-
-
 find -H /var/log/ -maxdepth 1 -type d -exec chown 0 {} \;

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_var_log_messages' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_var_log_messages
+++ xccdf_org.ssgproject.content_rule_file_owner_var_log_messages
@@ -1,4 +1 @@
-
-
-
 chown 0 /var/log/messages

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog
+++ xccdf_org.ssgproject.content_rule_file_owner_var_log_syslog
@@ -1,4 +1 @@
-
-
-
 chown 104 /var/log/syslog

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs' differs.
--- xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs
+++ xccdf_org.ssgproject.content_rule_dir_group_ownership_library_dirs
@@ -1,10 +1,4 @@
-
-
-
 find -H /lib/ -type d -exec chgrp 0 {} \;
-
 find -H /lib64/ -type d -exec chgrp 0 {} \;
-
 find -H /usr/lib/ -type d -exec chgrp 0 {} \;
-
 find -H /usr/lib64/ -type d -exec chgrp 0 {} \;

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_ownership_binary_dirs' differs.
--- xccdf_org.ssgproject.content_rule_dir_ownership_binary_dirs
+++ xccdf_org.ssgproject.content_rule_dir_ownership_binary_dirs
@@ -1,14 +1,6 @@
-
-
-
 find -H /bin/ -type d -exec chown 0 {} \;
-
 find -H /sbin/ -type d -exec chown 0 {} \;
-
 find -H /usr/bin/ -type d -exec chown 0 {} \;
-
 find -H /usr/sbin/ -type d -exec chown 0 {} \;
-
 find -H /usr/local/bin/ -type d -exec chown 0 {} \;
-
 find -H /usr/local/sbin/ -type d -exec chown 0 {} \;

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs' differs.
--- xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs
+++ xccdf_org.ssgproject.content_rule_dir_ownership_library_dirs
@@ -1,10 +1,4 @@
-
-
-
 find -H /lib/ -type d -exec chown 0 {} \;
-
 find -H /lib64/ -type d -exec chown 0 {} \;
-
 find -H /usr/lib/ -type d -exec chown 0 {} \;
-
 find -H /usr/lib64/ -type d -exec chown 0 {} \;

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_audit_binaries' differs.
--- xccdf_org.ssgproject.content_rule_file_groupownership_audit_binaries
+++ xccdf_org.ssgproject.content_rule_file_groupownership_audit_binaries
@@ -1,16 +1,7 @@
-
-
-
 chgrp 0 /sbin/auditctl
-
 chgrp 0 /sbin/aureport
-
 chgrp 0 /sbin/ausearch
-
 chgrp 0 /sbin/autrace
-
 chgrp 0 /sbin/auditd
-
 chgrp 0 /sbin/audispd
-
 chgrp 0 /sbin/augenrules

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_ownership_audit_binaries' differs.
--- xccdf_org.ssgproject.content_rule_file_ownership_audit_binaries
+++ xccdf_org.ssgproject.content_rule_file_ownership_audit_binaries
@@ -1,16 +1,7 @@
-
-
-
 chown 0 /sbin/auditctl
-
 chown 0 /sbin/aureport
-
 chown 0 /sbin/ausearch
-
 chown 0 /sbin/autrace
-
 chown 0 /sbin/auditd
-
 chown 0 /sbin/audispd
-
 chown 0 /sbin/augenrules

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_ownership_library_dirs' differs.
--- xccdf_org.ssgproject.content_rule_file_ownership_library_dirs
+++ xccdf_org.ssgproject.content_rule_file_ownership_library_dirs
@@ -1,5 +1,3 @@
-
-
 
 find /lib/ -type f ! -uid 0 -regex '^.*$' -exec chown 0 {} \;
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files' differs.
--- xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files
+++ xccdf_org.ssgproject.content_rule_root_permissions_syslibrary_files
@@ -1,13 +1,8 @@
-
-
 
 find /lib/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;
 
-
 find /lib64/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;
-
 
 find /usr/lib/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;
 
-
 find /usr/lib64/ -type f ! -gid 0 -regex '^.*$' -exec chgrp 0 {} \;

codeclimate · 2023-05-11T11:20:18Z

Code Climate has analyzed commit 791d47c and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 52.4% (0.0% change).

View more on Code Climate.

Mab879 · 2023-05-11T15:57:53Z

I'm waving the automatus tests as they pass locally on a vm.

ggbecker · 2023-05-23T12:26:24Z

I have a suspicion that this is what is causing the fails in

#10594
#10593
#10592

I guess the group id for ssh_keys is changing or is different depending on the deployment and we have these hardcoded values:

content/products/rhel8/product.yml

Line 30 in 0c6b8fb

id: "995"

marcusburghardt · 2023-05-24T07:44:51Z

I have a suspicion that this is what is causing the fails in

#10594 #10593 #10592

I guess the group id for ssh_keys is changing or is different depending on the deployment and we have these hardcoded values:

content/products/rhel8/product.yml

Line 30 in 0c6b8fb

id: "995"

Yes, these IDs don't seem to be so stable as expected. Thanks for #10622

marcusburghardt added 8 commits May 11, 2023 10:49

Introduce file_ownership_sshd_private_key rule

55a4341

Include id attribute to dedicated_ssh_keyowner

68e0205

The id attribute was included by product so new templated rules using the file_groupowner template can use this attribute more flexibly.

Introduce file_groupownership_sshd_private_key rule

c6d3d3c

Update CIS control files for RHEL

03e23cb

The requirement 5.3.2 for RHEL7 and 5.2.2 for RHEL8 and RHEL9 were updated to automated after the inclusion of new rules related to owner and group-owner of ssh private keys.

Introduce file_ownership_sshd_pub_key rule

26caabf

Introduce file_groupownership_sshd_pub_key rule

67c6661

Update CIS control files for RHEL

aa559cb

The requirement 5.3.3 for RHEL7 and 5.2.3 for RHEL8 and RHEL9 were updated to automated after the inclusion of new rules related to owner and group-owner of ssh public keys.

marcusburghardt added RHEL Red Hat Enterprise Linux product related. New Rule Issues or pull requests related to new Rules. CIS CIS Benchmark related. labels May 11, 2023

marcusburghardt added this to the 0.1.68 milestone May 11, 2023

marcusburghardt requested a review from a team as a code owner May 11, 2023 09:53

Include missing CIS reference for RHEL7

791d47c

marcusburghardt mentioned this pull request May 11, 2023

'Verify Permissions on SSH Server Private *_key Key Files' false positive #10542

Open

Mab879 self-assigned this May 11, 2023

Mab879 approved these changes May 11, 2023

View reviewed changes

Mab879 merged commit a879b3b into ComplianceAsCode:master May 11, 2023

marcusburghardt deleted the cis_ssh_keys branch May 11, 2023 18:56

ggbecker mentioned this pull request May 23, 2023

update rule sles-15-040250 #10492

Merged

This was referenced May 30, 2023

[affects stabilization] Rule file_permissions_sshd_private_key is present in CIS Workstation L1 #10653

Closed

Error during evaluation of file_groupowner_var_log_syslog on RHEL 7 #10655

Closed

vojtapolasek mentioned this pull request Jun 5, 2023

[Stabilization] revert modifications to file_groupownership template and respective rules #10683

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New rules to complete CIS requirements for SSH Keys #10552

New rules to complete CIS requirements for SSH Keys #10552

marcusburghardt commented May 11, 2023

github-actions bot commented May 11, 2023

github-actions bot commented May 11, 2023

codeclimate bot commented May 11, 2023

Mab879 commented May 11, 2023

ggbecker commented May 23, 2023 •

edited

Loading

marcusburghardt commented May 24, 2023

New rules to complete CIS requirements for SSH Keys #10552

New rules to complete CIS requirements for SSH Keys #10552

Conversation

marcusburghardt commented May 11, 2023

Description:

Rationale:

Review Hints:

github-actions bot commented May 11, 2023

github-actions bot commented May 11, 2023

codeclimate bot commented May 11, 2023

Mab879 commented May 11, 2023

ggbecker commented May 23, 2023 • edited Loading

marcusburghardt commented May 24, 2023

ggbecker commented May 23, 2023 •

edited

Loading