Skip to content

Set the requires to sshd_set_keepalive on sshd_set_idle_timeout#11815

Merged
marcusburghardt merged 2 commits into
ComplianceAsCode:masterfrom
Mab879:fix_11803
Apr 17, 2024
Merged

Set the requires to sshd_set_keepalive on sshd_set_idle_timeout#11815
marcusburghardt merged 2 commits into
ComplianceAsCode:masterfrom
Mab879:fix_11803

Conversation

@Mab879
Copy link
Copy Markdown
Member

@Mab879 Mab879 commented Apr 12, 2024

Description:

Clean up the requires for sshd_set_keepalive.

Rationale:

Fixes #11803

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 12, 2024

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 12, 2024 •
edited
Loading

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11815
This image was built from commit: 92bd690

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11815

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11815 make deploy-local

@Mab879
Copy link
Copy Markdown
Member Author

Mab879 commented Apr 12, 2024

/packit rebuild-failed

@jan-cerny
Copy link
Copy Markdown
Collaborator

jan-cerny commented Apr 15, 2024

/packit build

@jan-cerny
Copy link
Copy Markdown
Collaborator

jan-cerny commented Apr 15, 2024

The rule sshd_set_idle_timeout has the platform os_linux[rhel]<=8.5, on RHEL 9 the session timeout should be set by the rule logind_session_timeout instead.

@Mab879
Removed the RHEL <8.5 restriction from sshd_set_idle_timeout
92bd690 
This is no longer true in the STIG. While it is true that
8.5+ changes the behavior there is value in this rule in
RHEL 8.5+.
@Mab879
Copy link
Copy Markdown
Member Author

Mab879 commented Apr 15, 2024

The rule sshd_set_idle_timeout has the platform os_linux[rhel]<=8.5, on RHEL 9 the session timeout should be set by the rule logind_session_timeout instead.

I just removed the restriction. The STIG doesn't have this and there still value in this rule for RHEL 8.5+.

@qlty-cloud-legacy
Copy link
Copy Markdown

qlty-cloud-legacy Bot commented Apr 15, 2024

Code Climate has analyzed commit 92bd690 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.2% (0.0% change).

View more on Code Climate.

@marcusburghardt marcusburghardt added the Update Rule Issues or pull requests related to Rules updates. label Apr 16, 2024
@marcusburghardt marcusburghardt added this to the 0.1.73 milestone Apr 16, 2024
@marcusburghardt
Copy link
Copy Markdown
Member

marcusburghardt commented Apr 16, 2024

/packit build

@jan-cerny jan-cerny requested a review from vojtapolasek April 16, 2024 14:29
marcusburghardt
marcusburghardt approved these changes Apr 17, 2024
View reviewed changes
Copy link
Copy Markdown
Member

@marcusburghardt marcusburghardt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@marcusburghardt marcusburghardt self-assigned this Apr 17, 2024
@marcusburghardt marcusburghardt merged commit 8fd51a6 into ComplianceAsCode:master Apr 17, 2024
@Mab879 Mab879 deleted the fix_11803 branch April 17, 2024 12:22
@vojtapolasek vojtapolasek mentioned this pull request Apr 18, 2024
Merged
yuumasato added a commit to yuumasato/scap-security-guide that referenced this pull request Jun 25, 2024
@yuumasato
OCPBUGS-33945: select required SSHD timeout rule
729a3eb 
The rule sshd_set_idle_timeout used to require rule sshd_set_keepalive_0
for Red Hat linuxes. But after ComplianceAsCode#11815 it started to require rules
sshd_set_keepalive.

This selects the rule that satifyes the requirement.
@yuumasato yuumasato mentioned this pull request Jun 25, 2024
Merged
yuumasato added a commit to yuumasato/scap-security-guide that referenced this pull request Jun 26, 2024
@yuumasato
OCPBUGS-33945: select required SSHD timeout rule
f386a43 
The rule sshd_set_idle_timeout used to require rule sshd_set_keepalive_0
for Red Hat linuxes. But after ComplianceAsCode#11815 it started to require rules
sshd_set_keepalive.

This selects the rule that satifyes the requirement.
yuumasato added a commit to yuumasato/scap-security-guide that referenced this pull request Jun 27, 2024
@yuumasato
OCPBUGS-33945: select required SSHD timeout rule
5d53fe2 
The rule sshd_set_idle_timeout used to require rule sshd_set_keepalive_0
for Red Hat linuxes. But after ComplianceAsCode#11815 it started to require rules
sshd_set_keepalive.

This selects the rule that satifyes the requirement.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcusburghardt marcusburghardt marcusburghardt approved these changes

@vojtapolasek vojtapolasek Awaiting requested review from vojtapolasek

Assignees

@marcusburghardt marcusburghardt

Labels

Update Rule Issues or pull requests related to Rules updates.

Projects

None yet

Milestone

0.1.73

Development

Successfully merging this pull request may close these issues.

CCE-90811-1 is notselected by SSG, however for DISA STIG it fail

3 participants

@Mab879 @jan-cerny @marcusburghardt