Description of problem: Scap-security-guide rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key is not aligned with DISA STIG xccdf_mil.disa.stig_rule_SV-230287r743951_rule. SSG: xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key expects SSH private keys with: 0600 permission and owned by root:root or 0640 permission and owned by root:ssh_key DISA: xccdf_mil.disa.stig_rule_SV-230287r743951_rule expects SSH private keys with 0600 permission, no matter the group owner. Version-Release number of selected component (if applicable): scap-security-guide-0.1.63-1.el8.noarch How reproducible: 100% Steps to Reproduce: 1. Private keys with 0640 permission and ssh_keys group exist 2. oscap xccdf eval --profile '(all)' --rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml 3. oscap xccdf eval --profile '(all)' --rule xccdf_mil.disa.stig_rule_SV-230287r743951_rule disa-stig-rhel8-v1r6-xccdf-scap.xml Actual results: # oscap xccdf eval --profile '(all)' --rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml --- Starting Evaluation --- Title Verify Permissions on SSH Server Private *_key Key Files Rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key Ident CCE-82424-3 Result pass # oscap xccdf eval --profile '(all)' --rule xccdf_mil.disa.stig_rule_SV-230287r743951_rule disa-stig-rhel8-v1r6-xccdf-scap.xml --- Starting Evaluation --- Title The RHEL 8 SSH private host key files must have mode 0600 or less permissive. Rule xccdf_mil.disa.stig_rule_SV-230287r743951_rule Ident CCI-000366 Result fail Expected results: # oscap xccdf eval --profile '(all)' --rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml --- Starting Evaluation --- Title Verify Permissions on SSH Server Private *_key Key Files Rule xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key Ident CCE-82424-3 Result pass # oscap xccdf eval --profile '(all)' --rule xccdf_mil.disa.stig_rule_SV-230287r743951_rule disa-stig-rhel8-v1r6-xccdf-scap.xml --- Starting Evaluation --- Title The RHEL 8 SSH private host key files must have mode 0600 or less permissive. Rule xccdf_mil.disa.stig_rule_SV-230287r743951_rule Ident CCI-000366 Result pass
See also: https://github.com/ComplianceAsCode/content/issues/9251 and https://github.com/ComplianceAsCode/content/issues/7833 for the context.
DISA has updated their automated content and now the rules are aligned. The update to DISA's automated content V1R8 aligns them: https://github.com/ComplianceAsCode/content/pull/10078
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (scap-security-guide bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:2869