OCPBUGS-18331: Include sshd config directories in remediation template#11551
Conversation
|
Adding @BhargaviGudi for review. |
|
Start a new ephemeral environment with changes proposed in this pull request: Fedora Environment Oracle Linux 8 Environment |
|
/test |
|
@rhmdnd: The
Use
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/test e2e-aws-rhcos4-e8 |
|
Failures are unrelated to the change being made here and will be fixed separately. |
The generic sshd configuration file we were using to generate sshd remediations for OpenShift didn't include the sshd_config.d/ directory. This can be a problem for some clusters and configuration that spread their sshd configuration across those directories, instead of assuming all configuration will be in a single sshd configuration file. This could lead to cases where applying remediations for sshd hardening breaks ssh in unexpected ways (e.g., like not being able to ssh into the clusters because the ssh keys are not longer accessible if they're under sshd_config.d).
48f40b8 to
7b8f481
Compare
|
/test |
|
@rhmdnd: The
Use
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/test 4.13-e2e-aws-rhcos4-e8 |
|
Code Climate has analyzed commit 7b8f481 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.3% (0.0% change). View more on Code Climate. |
|
/hold for test |
|
Verification passed with 4.12.49 + compliance operator + code from PR #11551
|
|
/unhold |
|
@yuumasato @Vincent056 should be ready for another review. |
|
@BhargaviGudi @xiaojiey Hi, just wanted to double check whether you were able to ssh into the cluster. |
Yes, I can. Notify you on the detailed step I used for ssh to the node. |
|
/lgtm |
The generic sshd configuration file we were using to generate
sshd remediations for OpenShift didn't include the sshd_config.d/
directory. This can be a problem for some clusters and configuration
that spread their sshd configuration across those directories, instead
of assuming all configuration will be in a single sshd configuration
file.
This could lead to cases where applying remediations for sshd hardening
breaks ssh in unexpected ways (e.g., like not being able to ssh into the
clusters because the ssh keys are not longer accessible if they're under
sshd_config.d).