update rule sles-15-040250

[svet-se]

Description:

• Update rule file_permissions_sshd_private_key

Rationale:

• Accoring DISA recommendations Version 1, Release 9 from 26 January 2023 about SLE 15 STIG - "SLES-15-040250 - Updated text to reflect revised SSH key permissions guidance from vendor."

[openshift-ci]

Hi @svet-se. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
@@ -4,7 +4,9 @@
 for keyfile in /etc/ssh/*_key; do
 test -f "$keyfile" || continue
 if test root:root = "$(stat -c "%U:%G" "$keyfile")"; then
+ 
 chmod u-xs,g-xwrs,o-xwrt "$keyfile"
+ 
 elif test root:ssh_keys = "$(stat -c "%U:%G" "$keyfile")"; then
 chmod u-xs,g-xws,o-xwrt "$keyfile"
 else

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
@@ -1,6 +1,6 @@
 - name: Find root:root-owned keys
- command: find -H /etc/ssh/ -maxdepth 1 -user root -regex ".*_key$" -type f -group
- root -perm /u+xs,g+xwrs,o+xwrt
+ ansible.builtin.command: find -H /etc/ssh/ -maxdepth 1 -user root -regex ".*_key$"
+ -type f -group root -perm /u+xs,g+xwrs,o+xwrt
 register: root_owned_keys
 changed_when: false
 failed_when: false
@@ -24,7 +24,7 @@
 - no_reboot_needed
 
 - name: Set permissions for root:root-owned keys
- file:
+ ansible.builtin.file:
 path: '{{ item }}'
 mode: u-xs,g-xwrs,o-xwrt
 state: file
@@ -49,8 +49,8 @@
 - no_reboot_needed
 
 - name: Find root:ssh_keys-owned keys
- command: find -H /etc/ssh/ -maxdepth 1 -user root -regex ".*_key$" -type f -group
- ssh_keys -perm /u+xs,g+xws,o+xwrt
+ ansible.builtin.command: find -H /etc/ssh/ -maxdepth 1 -user root -regex ".*_key$"
+ -type f -group ssh_keys -perm /u+xs,g+xws,o+xwrt
 register: dedicated_group_owned_keys
 changed_when: false
 failed_when: false
@@ -74,7 +74,7 @@
 - no_reboot_needed
 
 - name: Set permissions for root:ssh_keys-owned keys
- file:
+ ansible.builtin.file:
 path: '{{ item }}'
 mode: u-xs,g-xws,o-xwrt
 state: file

[marcusburghardt]

@svet-se could you rebase this PR with the current master, please? This should solve the failed CI tests.

[svet-se]

hey @marcusburghardt

Thanks for the advice, I've rebased to master.

Have a nice day!

[codeclimate]

Code Climate has analyzed commit 7618409 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 52.4% (0.0% change).

View more on Code Climate.

[ggbecker]

I see Automatus tests were not applicable:

Run tests/test_rule_in_container.sh --no-remove-machine-only --dontclean --logdir logs_bash --remediate-using bash --name ssg_test_suite --datastream $DATASTREAM file_permissions_sshd_private_key
Setting console output to log level INFO
INFO - The base image option has been specified, choosing Podman-based test environment.
INFO - Logging into logs_bash/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
WARNING - Script unfixable.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key evaluation resulted in notapplicable
WARNING - Script altcorrect_permissions.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key evaluation resulted in notapplicable
WARNING - Script multiple_keys.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key evaluation resulted in notapplicable
WARNING - Script lenient_permissions.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key evaluation resulted in notapplicable
WARNING - Script supercompliance.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key evaluation resulted in notapplicable
WARNING - Script altlenient_permissions.fail.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key evaluation resulted in notapplicable
WARNING - Script correct_permissions.pass.sh using profile (all) notapplicable
WARNING - Rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key evaluation resulted in notapplicable

This PR is what most likely is causing:

#10594
#10592

Because now we don't override machine platform anymore.

content/linux_os/guide/services/ssh/group.yml

Line 16 in 91ba1a5

platform: machine

https://github.com/ComplianceAsCode/content/pull/10453/files

Update1: I think it's the new rules introduced in: #10552 that are causing the issue.