Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add a new rule ssh_keys_passphrase_protected #10017

Merged
merged 1 commit into from
Feb 1, 2023
Merged

Add a new rule ssh_keys_passphrase_protected #10017

merged 1 commit into from
Feb 1, 2023

Conversation

nightmared
Copy link
Contributor

Description:

Add a rule and a SCE check for the DISA STIG requirement RHEL-08-010100.

Rationale:

"RHEL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key."

Review Hints:

This is a SCE check because of the call to ssh-keygen, which may be unusual as this project seems to prefer OVAL checks (for good reasons).

Depends on #10015.

@nightmared nightmared requested a review from a team as a code owner January 2, 2023 15:34
@openshift-ci openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Jan 2, 2023
@openshift-ci
Copy link

openshift-ci bot commented Jan 2, 2023

Hi @nightmared. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@github-actions
Copy link

github-actions bot commented Jan 2, 2023

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@Mab879 Mab879 added RHEL Red Hat Enterprise Linux product related. New Rule Issues or pull requests related to new Rules. STIG STIG Benchmark related. labels Jan 3, 2023
@matejak
Copy link
Member

matejak commented Jan 5, 2023

We need to find out how to check the SCE snippet by shellcheck, because it clearly has some issues, and in order to scale the project, we need to automate this. Please run shellcheck on the code locally and fix findings - we will figure out the integration later.

Mab879
Mab879 requested changes Jan 5, 2023
View reviewed changes
Copy link
Member

@Mab879 Mab879 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR. Please review Matej's comment as well.

linux_os/guide/services/ssh/ssh_client/ssh_keys_passphrase_protected/rule.yml Outdated Show resolved Hide resolved
linux_os/guide/services/ssh/ssh_client/ssh_keys_passphrase_protected/rule.yml Show resolved Hide resolved
@Mab879 Mab879 added this to the 0.1.66 milestone Jan 5, 2023
@nightmared nightmared mentioned this pull request Jan 7, 2023
Merged
@nightmared nightmared force-pushed the RHEL_08_010100 branch 3 times, most recently from c316597 to 5a97600 Compare January 7, 2023 16:47
@nightmared nightmared requested a review from Mab879 January 7, 2023 17:39
@nightmared
Copy link
Contributor Author

Rebased on master.

This should be usable now that #10015 is merged.

@codeclimate
Copy link

codeclimate bot commented Jan 23, 2023

Code Climate has analyzed commit 3190a2b and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 49.7% (0.0% change).

View more on Code Climate.

@vojtapolasek vojtapolasek modified the milestones: 0.1.66, 0.1.67 Jan 24, 2023
@Mab879 Mab879 self-assigned this Feb 1, 2023
Mab879
Mab879 approved these changes Feb 1, 2023
View reviewed changes
Copy link
Member

@Mab879 Mab879 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Automatus failure for CS9 is expected as this rule only applies to RHEL 8.

@Mab879 Mab879 merged commit c041e64 into ComplianceAsCode:master Feb 1, 2023
nightmared added a commit to nightmared/content that referenced this pull request Feb 4, 2023
@nightmared
Enable SCE integrity checks for RHEL8
6aa11ee 
This was made possible by the integration of the ssh_keys_passphrase_protected SCE check in
ComplianceAsCode#10017.
@nightmared nightmared mentioned this pull request Feb 4, 2023
Merged
@yuumasato yuumasato mentioned this pull request Feb 8, 2023
Merged
@marcusburghardt marcusburghardt mentioned this pull request Feb 8, 2023
Merged
teacup-on-rockingchair pushed a commit to teacup-on-rockingchair/content that referenced this pull request Feb 15, 2023
@nightmared @teacup-on-rockingchair
Enable SCE integrity checks for RHEL8
5a7f68d 
This was made possible by the integration of the ssh_keys_passphrase_protected SCE check in
ComplianceAsCode#10017.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Mab879 Mab879 Mab879 approved these changes

Assignees

@Mab879 Mab879

Labels
needs-ok-to-test Used by openshift-ci bot. New Rule Issues or pull requests related to new Rules. RHEL Red Hat Enterprise Linux product related. STIG STIG Benchmark related.
Projects
None yet
Milestone
0.1.67
Development

Successfully merging this pull request may close these issues.
4 participants
@nightmared @matejak @Mab879 @vojtapolasek