From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 9449D13827E for ; Wed, 11 Dec 2013 20:53:20 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 54270E0B61; Wed, 11 Dec 2013 20:53:18 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id A65A2E0B61 for ; Wed, 11 Dec 2013 20:53:17 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id A4AF233F30D for ; Wed, 11 Dec 2013 20:53:16 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 59854D0045 for ; Wed, 11 Dec 2013 20:53:14 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1386795066.912cc3b552b8dd23ddccdca7f77a1beaa490d136.swift@gentoo> Subject: [gentoo-commits] proj/hardened-docs:master commit in: xml/SCAP/ X-VCS-Repository: proj/hardened-docs X-VCS-Files: xml/SCAP/openssh-oval.xml xml/SCAP/openssh-xccdf.xml X-VCS-Directories: xml/SCAP/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 912cc3b552b8dd23ddccdca7f77a1beaa490d136 X-VCS-Branch: master Date: Wed, 11 Dec 2013 20:53:14 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 602d4be6-150a-4fc0-a5cc-cbca9bda51e5 X-Archives-Hash: b799eea7ff885f31c7f869b503ba7f8d commit: 912cc3b552b8dd23ddccdca7f77a1beaa490d136 Author: Sven Vermeulen siphos be> AuthorDate: Wed Dec 11 20:51:06 2013 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Wed Dec 11 20:51:06 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=commit;h=912cc3b5 Adding OpenSSH files --- xml/SCAP/openssh-oval.xml | 354 +++++++++++++++++++++++++++ xml/SCAP/openssh-xccdf.xml | 579 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 933 insertions(+) diff --git a/xml/SCAP/openssh-oval.xml b/xml/SCAP/openssh-oval.xml new file mode 100644 index 0000000..ad1ca8c --- /dev/null +++ b/xml/SCAP/openssh-oval.xml @@ -0,0 +1,354 @@ + + + + vim + 5.9 + 2011-10-31T12:00:00-04:00 + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^PermitRootLogin no + file /etc/ssh/sshd_config must have a line that matches ^PermitRootLogin no + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^PasswordAuthentication no + file /etc/ssh/sshd_config must have a line that matches ^PasswordAuthentication no + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^ChallengeResponseAuthentication no + file /etc/ssh/sshd_config must have a line that matches ^ChallengeResponseAuthentication no + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^AllowGroup + file /etc/ssh/sshd_config must have a line that matches ^AllowGroup + + + + + + + + file /etc/hosts.allow must have a line that matches ^sshd: + file /etc/hosts.allow must have a line that matches ^sshd: + + + + + + + + file /etc/hosts.deny must have a line that matches ^sshd: ALL + file /etc/hosts.deny must have a line that matches ^sshd: ALL + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^IgnoreRhosts.*no + file /etc/ssh/sshd_config may not have a line that matches ^IgnoreRhosts.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^RhostsRSAAuthentication.*yes + file /etc/ssh/sshd_config may not have a line that matches ^RhostsRSAAuthentication.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^HostbasedAuthentication.*yes + file /etc/ssh/sshd_config may not have a line that matches ^HostbasedAuthentication.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^PermitEmptyPasswords.*yes + file /etc/ssh/sshd_config may not have a line that matches ^PermitEmptyPasswords.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^UsePAM.*no + file /etc/ssh/sshd_config may not have a line that matches ^UsePAM.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^Protocol.*1 + file /etc/ssh/sshd_config may not have a line that matches ^Protocol.*1 + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^UsePrivilegeSeparation.*no + file /etc/ssh/sshd_config may not have a line that matches ^UsePrivilegeSeparation.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^X11Forwarding.*yes + file /etc/ssh/sshd_config may not have a line that matches ^X11Forwarding.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^StrictMode.*no + file /etc/ssh/sshd_config may not have a line that matches ^StrictMode.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress.*0.0.0.0 + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress.*0.0.0.0 + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress[ ]*::$ + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress[ ]*::$ + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^ListenAddress + file /etc/ssh/sshd_config must have a line that matches ^ListenAddress + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^AllowTcpForwarding.*no + file /etc/ssh/sshd_config must have a line that matches ^AllowTcpForwarding.*no + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + /etc/ssh/sshd_config + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/hosts.allow + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/hosts.deny + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + + + + + + ^PermitRootLogin no + + + ^PasswordAuthentication no + + + ^ChallengeResponseAuthentication no + + + ^AllowGroup + + + ^sshd + + + ^sshd + + + ^IgnoreRhosts.*no + + + ^RhostsRSAAuthentication.*yes + + + ^HostbasedAuthentication.*yes + + + ^PermitEmptyPasswords.*yes + + + ^UsePAM.*no + + + ^Protocol.*1 + + + ^UsePrivilegeSeparation.*no + + + ^X11Forwarding.*yes + + + ^StrictMode.*no + + + ^ListenAddress.*0.0.0.0 + + + ^ListenAddress[ ]* + + + ^ListenAddress + + + ^AllowTcpForwarding.*no + + + + + diff --git a/xml/SCAP/openssh-xccdf.xml b/xml/SCAP/openssh-xccdf.xml new file mode 100644 index 0000000..0230c63 --- /dev/null +++ b/xml/SCAP/openssh-xccdf.xml @@ -0,0 +1,579 @@ + + + draft + Hardening OpenSSH + + The OpenSSH server offers remote Secure Shell services towards your users. This benchmark + focuses on the hardening of OpenSSH within a Gentoo Hardened environment. + + + 1 + + + + OpenSSH server setup settings + + Profile matching all OpenSSH hardening rules + + + + + + + + + + +