From 912cc3b552b8dd23ddccdca7f77a1beaa490d136 Mon Sep 17 00:00:00 2001 From: Sven Vermeulen Date: Wed, 11 Dec 2013 21:51:06 +0100 Subject: Adding OpenSSH files --- xml/SCAP/openssh-oval.xml | 354 +++++++++++++++++++++++++++ xml/SCAP/openssh-xccdf.xml | 579 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 933 insertions(+) create mode 100644 xml/SCAP/openssh-oval.xml create mode 100644 xml/SCAP/openssh-xccdf.xml diff --git a/xml/SCAP/openssh-oval.xml b/xml/SCAP/openssh-oval.xml new file mode 100644 index 0000000..ad1ca8c --- /dev/null +++ b/xml/SCAP/openssh-oval.xml @@ -0,0 +1,354 @@ + + + + vim + 5.9 + 2011-10-31T12:00:00-04:00 + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^PermitRootLogin no + file /etc/ssh/sshd_config must have a line that matches ^PermitRootLogin no + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^PasswordAuthentication no + file /etc/ssh/sshd_config must have a line that matches ^PasswordAuthentication no + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^ChallengeResponseAuthentication no + file /etc/ssh/sshd_config must have a line that matches ^ChallengeResponseAuthentication no + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^AllowGroup + file /etc/ssh/sshd_config must have a line that matches ^AllowGroup + + + + + + + + file /etc/hosts.allow must have a line that matches ^sshd: + file /etc/hosts.allow must have a line that matches ^sshd: + + + + + + + + file /etc/hosts.deny must have a line that matches ^sshd: ALL + file /etc/hosts.deny must have a line that matches ^sshd: ALL + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^IgnoreRhosts.*no + file /etc/ssh/sshd_config may not have a line that matches ^IgnoreRhosts.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^RhostsRSAAuthentication.*yes + file /etc/ssh/sshd_config may not have a line that matches ^RhostsRSAAuthentication.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^HostbasedAuthentication.*yes + file /etc/ssh/sshd_config may not have a line that matches ^HostbasedAuthentication.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^PermitEmptyPasswords.*yes + file /etc/ssh/sshd_config may not have a line that matches ^PermitEmptyPasswords.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^UsePAM.*no + file /etc/ssh/sshd_config may not have a line that matches ^UsePAM.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^Protocol.*1 + file /etc/ssh/sshd_config may not have a line that matches ^Protocol.*1 + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^UsePrivilegeSeparation.*no + file /etc/ssh/sshd_config may not have a line that matches ^UsePrivilegeSeparation.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^X11Forwarding.*yes + file /etc/ssh/sshd_config may not have a line that matches ^X11Forwarding.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^StrictMode.*no + file /etc/ssh/sshd_config may not have a line that matches ^StrictMode.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress.*0.0.0.0 + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress.*0.0.0.0 + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress[ ]*::$ + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress[ ]*::$ + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^ListenAddress + file /etc/ssh/sshd_config must have a line that matches ^ListenAddress + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^AllowTcpForwarding.*no + file /etc/ssh/sshd_config must have a line that matches ^AllowTcpForwarding.*no + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + /etc/ssh/sshd_config + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/hosts.allow + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/hosts.deny + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + + + + + + ^PermitRootLogin no + + + ^PasswordAuthentication no + + + ^ChallengeResponseAuthentication no + + + ^AllowGroup + + + ^sshd + + + ^sshd + + + ^IgnoreRhosts.*no + + + ^RhostsRSAAuthentication.*yes + + + ^HostbasedAuthentication.*yes + + + ^PermitEmptyPasswords.*yes + + + ^UsePAM.*no + + + ^Protocol.*1 + + + ^UsePrivilegeSeparation.*no + + + ^X11Forwarding.*yes + + + ^StrictMode.*no + + + ^ListenAddress.*0.0.0.0 + + + ^ListenAddress[ ]* + + + ^ListenAddress + + + ^AllowTcpForwarding.*no + + + + + diff --git a/xml/SCAP/openssh-xccdf.xml b/xml/SCAP/openssh-xccdf.xml new file mode 100644 index 0000000..0230c63 --- /dev/null +++ b/xml/SCAP/openssh-xccdf.xml @@ -0,0 +1,579 @@ + + + draft + Hardening OpenSSH + + The OpenSSH server offers remote Secure Shell services towards your users. This benchmark + focuses on the hardening of OpenSSH within a Gentoo Hardened environment. + + + 1 + + + + OpenSSH server setup settings + + Profile matching all OpenSSH hardening rules + + + + + + + + + + +