Remove redundant sshd oval macro

[vojtapolasek]

Description:

• remove the oval_sshd_config macro
• replace its usage with sshd_oval_check macro

Rationale:

• there were two macros for checking of sshd config, this might cause confusion. Moreover, the removed macro was less powerful and effectively a subset of the sshd_oval_check macro.

Review Hints:

• run automatus on sshd_use_storng_ciphers rule

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

kylinserver10 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

OVAL for rule 'xccdf_org.ssgproject.content_rule_sshd_use_strong_ciphers' differs.
--- oval:ssg-sshd_use_strong_ciphers:def:1
+++ oval:ssg-sshd_use_strong_ciphers:def:1
@@ -5,5 +5,7 @@
 criteria AND
 extend_definition oval:ssg-sshd_required_or_unset:def:1
 extend_definition oval:ssg-package_openssh-server_installed:def:1
-criteria OR
+criteria AND
+criteria AND
 criterion oval:ssg-test_sshd_use_strong_ciphers:tst:1
+criterion oval:ssg-test_Ciphers_present_sshd_use_strong_ciphers:tst:1

[codeclimate]

Code Climate has analyzed commit 87dd7be and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 60.9% (0.0% change).

View more on Code Climate.

[jan-cerny]

I have add the rule sshd_use_strong_ciphers to RHEL 9 default profile and built the content. Then, I have run Automatus test scenarios.

jcerny@fedora:~/work/git/scap-security-guide (pr/12532)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 sshd_use_strong_ciphers
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-10-24-1350/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_sshd_use_strong_ciphers
INFO - Script good_cipher.pass.sh using profile (all) OK
INFO - Script no_ciphers.fail.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/12532)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible sshd_use_strong_ciphers
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-10-24-1351/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_sshd_use_strong_ciphers
INFO - Script good_cipher.pass.sh using profile (all) OK
INFO - Script no_ciphers.fail.sh using profile (all) OK
WARNING - No remediation is available for rule 'xccdf_org.ssgproject.content_rule_sshd_use_strong_ciphers'.