Review sshd_set_maxstartups rule

[marcusburghardt]

Description:

The template sshd_lineinfile was recently improved (#12251) to use variables. The rule sshd_set_maxstartups is used in different profiles and could benefit from this template, but the SSH MaxStartups parameter has some particularities in its OVAL.

During the review, I concluded that is better to keep a specific OVAL for sshd_set_maxstartups since there is no other rules using a similar parameter or even similar parameters in SSH configuration. So it would bring an unnecessary complexity to the templated OVAL. But the bash, Ansible and test scenarios could be nicely used to keep a better consistency among SSH rules.

This PR:

• Refactor the sshd_set_maxstartups OVAL logic
  • Remove incorrect assumptions about parameter duplication
  • Remove hard-coded values and use variable values instead, giving more flexibility to the rule.
• Use the sshd_lineinfile template for remediation and tests.
• Increase coverage of test scenarios.

Rationale:

• Better alignment among SSH related rules
• Less complexity and more robustness for the rule
• Fixes https://issues.redhat.com/browse/RHEL-38206

Review Hints:

./build_product rhel9
./tests/automatus.py rule --libvirt qemu:///session rhel9 --datastream build/ssg-rhel9-ds.xml --dontclean --remediate-using bash sshd_set_maxstartups

Other CI tests will help us to test the changes in a context of a profile. But I expect everything to be green.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sshd_set_maxstartups'.
--- xccdf_org.ssgproject.content_rule_sshd_set_maxstartups
+++ xccdf_org.ssgproject.content_rule_sshd_set_maxstartups
@@ -3,16 +3,11 @@
 Ensure SSH MaxStartups is configured
 
 [description]:
-The MaxStartups parameter specifies the maximum number of concurrent
-unauthenticated connections to the SSH daemon. Additional connections will be
-dropped until authentication succeeds or the LoginGraceTime expires for a
-connection. To confgure MaxStartups, you should add or correct the following
-line in the
-/etc/ssh/sshd_config file:
+The MaxStartups parameter specifies the maximum number of concurrent unauthenticated
+connections to the SSH daemon. Additional connections will be dropped until authentication
+succeeds or the LoginGraceTime expires for a connection. To configure MaxStartups, you should
+add or edit the following line in the /etc/ssh/sshd_config file:
 MaxStartups 'xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups'
-        
-CIS recommends a MaxStartups value of '10:30:60', or more restrictive where
-dictated by site policy.
 
 [reference]:
 4.2.17
@@ -24,9 +19,9 @@
 2.2
 
 [rationale]:
-To protect a system from denial of service due to a large number of pending
-authentication connection attempts, use the rate limiting function of MaxStartups
-to protect availability of sshd logins and prevent overwhelming the daemon.
+To protect a system from denial of service due to a large number of pending authentication
+connection attempts, use the rate limiting function of MaxStartups to protect availability of
+sshd logins and prevent overwhelming the daemon.
 
 [ident]:
 CCE-90718-8

OCIL for rule 'xccdf_org.ssgproject.content_rule_sshd_set_maxstartups' differs.
--- ocil:ssg-sshd_set_maxstartups_ocil:questionnaire:1
+++ ocil:ssg-sshd_set_maxstartups_ocil:questionnaire:1
@@ -1,5 +1,5 @@
 To check if MaxStartups is configured, run the following command:
-$ sudo grep MaxStartups /etc/ssh/sshd_config
+$ sudo grep -r ^[\s]*MaxStartups /etc/ssh/sshd_config*
 If configured, this command should output the configuration.
       Is it the case that maxstartups is not configured?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_set_maxstartups' differs.
--- xccdf_org.ssgproject.content_rule_sshd_set_maxstartups
+++ xccdf_org.ssgproject.content_rule_sshd_set_maxstartups
@@ -2,6 +2,7 @@
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 var_sshd_set_maxstartups=''
+
 
 
 if [ -e "/etc/ssh/sshd_config" ] ; then

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12419
This image was built from commit: d9ba185

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12419

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12419 make deploy-local

[jan-cerny]

The Jira link is wrong, it should be https://issues.redhat.com/browse/RHEL-38206

[marcusburghardt]

The Jira link is wrong, it should be https://issues.redhat.com/browse/RHEL-38206

Thanks for alerting me on that. It is fixed.

[jan-cerny]

The test scenarios pass for me on both RHEL 8 and 9.

I only have a minor problem.

[codeclimate]

Code Climate has analyzed commit d9ba185 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.0% change).

View more on Code Climate.