Update OVAL check and remediations for sshd_use_priv_separation.

[ggbecker]

Description:

• Add ansible remediation for sshd_use_priv_separation and remove template entry from its rule.yml as it is not needed.

- Per V-72265 sshd_use_priv_separation should accept both sandbox and yes values for UsePrivilegeSeparation:

Uncomment the "UsePrivilegeSeparation" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "sandbox" or "yes":

So the OVAL check has to use the regex (sandbox|yes) similar to what is done in sshd_disable_compression

The variable var_sshd_priv_separation is still being used so remediations (including the new Ansible one) know how to remediate.

And last but not least, the default value for this parameter is yes so we have to switch missing_parameter_pass to true:

UsePrivilegeSeparation Specifies whether sshd(8) separates privileges by creating an unprivileged child process to deal with incoming network traffic. After successful authentication, another process will be created that has the privilege of the authenticated user. The goal of privilege separation is to prevent privilege escalation by containing any corruption within the unprivileged processes. The default is ''yes''.
Reference: https://linux.die.net/man/5/sshd_config

Rationale:

• STIG Reference: https://vaulted.io/library/disa-stigs-srgs/red_hat_enterprise_linux_7_security_technical_implementation_guide/V-72265?version=v2r7

[jan-cerny]

@openscap-ci test this please

[jan-cerny]

/test e2e-aws-rhcos4-moderate

[jan-cerny]

/test e2e-aws-rhcos4-moderate

[JAORMX]

/retest

[mildas]

Changes identified:
Rule sshd_use_priv_separation:
 Ansible remediation newly added.

Recommended tests to execute:
 build_product ol8
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-ol8-ds.xml sshd_use_priv_separation

[openshift-ci-robot]

@ggbecker: The following tests failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-rhcos4-e8	44fe515	link	/test e2e-aws-rhcos4-e8
ci/prow/e2e-aws-rhcos4-moderate	44fe515	link	/test e2e-aws-rhcos4-moderate

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.