Improve sshd_use_approved_kex_ordered_stig

[dodys]

Description:

• While reviewing PR Ubuntu2004 stig profile v1r9 update #10738 , I came across an issue in sshd_use_approved_kex_ordered_stig. Its OVAL wasn't checking the value against anything and tests were passing for cases that should be failing.
• As @Xeicker suggested, I've reverted the OVAL changes as this issue was introduced in Add rules SLES-15-040450 SLES-12-030270 #10639 and fixed issues in the correct_scrambled.fail.sh test.
• Added multi_platform_ubuntu to tests
• Small fix on sshd_use_strong_kex variable state comment

Rationale:

• This rule is needed for DISA STIG in different vendors.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[codeclimate]

Code Climate has analyzed commit 12df498 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.8% (0.0% change).

View more on Code Climate.

[freddieRv]

Changes LGTM.

Thanks for the efforts!

[marcusburghardt]

I noticed the remediations are not enabled for RHEL 8 while the assessment is. I believe this is intentional but I will take a look to confirm. In any case this doesn't block the PR.

[dodys]

I noticed the remediations are not enabled for RHEL 8 while the assessment is. I believe this is intentional but I will take a look to confirm. In any case this doesn't block the PR.

in rule.yml you have this entry:

     {{% if product in ['ol8', 'rhel8']  %}}
     - general: |-
         This rule doesn't come with a remediation, automatically changing the crypto-policies may be too disruptive

[marcusburghardt]

I noticed the remediations are not enabled for RHEL 8 while the assessment is. I believe this is intentional but I will take a look to confirm. In any case this doesn't block the PR.

in rule.yml you have this entry:

     {{% if product in ['ol8', 'rhel8']  %}}
     - general: |-
         This rule doesn't come with a remediation, automatically changing the crypto-policies may be too disruptive

Perfect. I overlooked this warning. Thanks