Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-111896

Rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers should not apply to RHEL8 as is

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • rhel-8.10
    • scap-security-guide
    • None
    • No
    • Low
    • rhel-security-compliance
    • 2
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • None
    • None
    • Unspecified Release Note Type - Unknown
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      CIS Level 1 selects rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers ("Use Only FIPS 140-2 Validated Ciphers").
      The implementation relies on implementing Ciphers property in /etc/ssh/sshd_config:

      ./linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml:
      
       38   <ind:textfilecontent54_object id="obj_sshd_config_ciphers" version="1">
       39     <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
       40     <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+([\w,-@]+)+[\s]*(?:#.*)?$</ind:pattern>
       41     <ind:instance datatype="int">1</ind:instance>
       42   </ind:textfilecontent54_object>
      

      This doesn't make sense on RHEL8 since system-wide Crypto Policies is used by default.
      Last but not least setting Ciphers in /etc/ssh/sshd_config will have no effect since system-wide Crypto Policies will take precedence.

      Please provide the package NVR for which the bug is seen:

      scap-security-guide-0.1.77-1.el8.noarch

      How reproducible is this bug?:

      Always

              vpolasek@redhat.com Vojtech Polasek
              rhn-support-rmetrich Renaud Métrich
              Vojtech Polasek Vojtech Polasek
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated: