-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add a new rule ssh_keys_passphrase_protected #10017
Conversation
Hi @nightmared. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
We need to find out how to check the SCE snippet by shellcheck, because it clearly has some issues, and in order to scale the project, we need to automate this. Please run shellcheck on the code locally and fix findings - we will figure out the integration later. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the PR. Please review Matej's comment as well.
linux_os/guide/services/ssh/ssh_client/ssh_keys_passphrase_protected/rule.yml
Outdated
Show resolved
Hide resolved
linux_os/guide/services/ssh/ssh_client/ssh_keys_passphrase_protected/rule.yml
Show resolved
Hide resolved
c316597
to
5a97600
Compare
5a97600
to
3190a2b
Compare
Rebased on master. This should be usable now that #10015 is merged. |
Code Climate has analyzed commit 3190a2b and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 49.7% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The Automatus failure for CS9 is expected as this rule only applies to RHEL 8.
This was made possible by the integration of the ssh_keys_passphrase_protected SCE check in ComplianceAsCode#10017.
This was made possible by the integration of the ssh_keys_passphrase_protected SCE check in ComplianceAsCode#10017.
Description:
Add a rule and a SCE check for the DISA STIG requirement RHEL-08-010100.
Rationale:
"RHEL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key."
Review Hints:
This is a SCE check because of the call to
ssh-keygen
, which may be unusual as this project seems to prefer OVAL checks (for good reasons).Depends on #10015.