-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
rhel-8.10
-
None
-
No
-
Low
-
rhel-security-compliance
-
2
-
False
-
False
-
-
No
-
None
-
None
-
None
-
Unspecified Release Note Type - Unknown
-
Unspecified
-
Unspecified
-
Unspecified
-
None
What were you trying to do that didn't work?
CIS Level 1 selects rule xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers ("Use Only FIPS 140-2 Validated Ciphers").
The implementation relies on implementing Ciphers property in /etc/ssh/sshd_config:
./linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/oval/shared.xml: 38 <ind:textfilecontent54_object id="obj_sshd_config_ciphers" version="1"> 39 <ind:filepath>/etc/ssh/sshd_config</ind:filepath> 40 <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+([\w,-@]+)+[\s]*(?:#.*)?$</ind:pattern> 41 <ind:instance datatype="int">1</ind:instance> 42 </ind:textfilecontent54_object>
This doesn't make sense on RHEL8 since system-wide Crypto Policies is used by default.
Last but not least setting Ciphers in /etc/ssh/sshd_config will have no effect since system-wide Crypto Policies will take precedence.
Please provide the package NVR for which the bug is seen:
scap-security-guide-0.1.77-1.el8.noarch
How reproducible is this bug?:
Always