Bug 1467784

Summary:	Openscap scan allows only exactly the list of ciphers for rule ssg-obj_sshd_use_approved_ciphers
Product:	Red Hat Enterprise Linux 6	Reporter:	dgupte
Component:	scap-security-guide	Assignee:	Watson Yuuma Sato <wsato>
Status:	CLOSED ERRATA	QA Contact:	Marek Haicman <mhaicman>
Severity:	high	Docs Contact:
Priority:	high
Version:	6.9	CC:	cww, jkurik, matyc, mhaicman, mmarhefk, mpreisle, mthacker, openscap-maint, wsato
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-06-19 05:22:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1374441, 1461138, 1507541

Description dgupte 2017-07-05 07:10:19 UTC

Description of problem:

Using the profile C2S and  PCI-DSS for Red Hat Enterprise Linux 6, the following test fails

Object oval:ssg-obj_sshd_use_approved_ciphers:obj:1 of type textfilecontent54_object

/etc/ssh/sshd_config	^[\s]*(?i)Ciphers(?-i)[\s]+aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc[\s]*(?:|(?:#.*))?$

This is not a valid test, because it allows only EXACTLY the list of ciphers:
aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

Customer's systems use only:

aes128-ctr,aes192-ctr,aes256-ctr

All of which are in the list of approved ciphers, and is MORE restrictive than the test, yet the test fails.

It fails because it expects that exact list of ciphers in that exact order.  The test needs to be updated so that instead of a simple match, it actually checks that all listed ciphers are in the approved list (ie, any subset of the approved ciphers in any order should be a vaild test).


Version-Release number of selected component (if applicable):
 scap-security-guide-0.1.28-3.el6.noarch


Additional info:

- There's existing bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1413494) for RHEL7 and planned to resolve in RHEL 7.4 release. 

Really need to backport this functionality in RHEL 6 as well.


-------------------
    <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_approved_ciphers:obj:1" version="2">
      <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
      <ind:pattern operation="pattern match">^[\s]*(?i)Ciphers(?-i)[\s]+aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc[\s]*(?:|(?:#.*))?$</ind:pattern>
-------------------

Comment 7 Matěj Týč 2018-02-26 12:11:57 UTC

Fixed in upstream by https://github.com/OpenSCAP/scap-security-guide/pull/1767

Comment 10 Marek Haicman 2018-04-25 22:32:42 UTC

Verified fix in scap-security-guide-0.1.28-4.el6 via upstream SSG Test Suite:
https://github.com/OpenSCAP/scap-security-guide/commit/3398c06a4b42e4518479d5b1276b65fb2cf89125

NEW (scap-security-guide-0.1.28-4.el6):
[dahaic@dhcp-24-168 tests]$ sudo ./test_suite.py rule --hypervisor qemu:///system --domain ssg-test-suite-6 --datastream ssg-6.10.xml --xccdf-id scap_org.open-scap_cref_ssg-rhel6-xccdf-1.2.xml --dontclean sshd_use_approved_ciphers
Setting console output to log level INFO
INFO - xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
INFO - Script comment.fail.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
INFO - Script correct_reduced_list.pass.sh using profile xccdf_org.ssgproject.content_profile_C2S OK

OLD (scap-security-guide-0.1.28-3.el6):
[dahaic@dhcp-24-168 tests]$ sudo ./test_suite.py rule --hypervisor qemu:///system --domain ssg-test-suite-6 --datastream ssg-6.9.xml --xccdf-id scap_org.open-scap_cref_ssg-rhel6-xccdf-1.2.xml --dontclean sshd_use_approved_ciphers
Setting console output to log level INFO
INFO - xccdf_org.ssgproject.content_rule_sshd_use_approved_ciphers
INFO - Script comment.fail.sh using profile xccdf_org.ssgproject.content_profile_C2S OK
ERROR - Script correct_reduced_list.pass.sh using profile xccdf_org.ssgproject.content_profile_C2S found issue:
ERROR - Scan has exited with return code 2, instead of expected 0 during stage initial

Comment 13 errata-xmlrpc 2018-06-19 05:22:53 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1918