Introduce support for the distributed SSHd configuration

[matejak]

As we can see in recent Fedora versions, the sshd configuration is not contained in the config file, but the config file just includes whatever is in the /etc/ssh/sshd_config.d/ directory.

This PR adds this mechanics for Fedora and the RHEL9 products, and it introduces a rule that makes sure that such directive exists in the main /etc/ssh/sshd_config file.

[openscap-ci]

Changes identified:
Rules:
 sshd_use_directory_configuration
 ntpd_configure_restrictions
 grub2_no_removeable_media
Macros:
 set_config_file
 lineinfile_absent
 lineinfile_present
 oval_line_in_file_criterion
 oval_line_in_file_test
 oval_line_in_file_object
 oval_line_in_file_state
Others:
 Changes in Python files.

Show details

Rule sshd_use_directory_configuration:
 The rule doesn't occur in any profile nor product.
 OVAL check is newly added.
 Bash remediation is newly added.
Rule ntpd_configure_restrictions:
 The rule doesn't occur in any profile nor product.
 Found change in bash remediation.
Rule grub2_no_removeable_media:
 Template usage changed in OVAL check.
Macro set_config_file:
 In Ansible remediation for accounts_have_homedir_login_defs.
 In Bash remediation for coredump_disable_backtraces.
 In Bash remediation for sshd_use_strong_macs.
 In Ansible remediation for configure_openssl_tls_crypto_policy.
 In Bash remediation for sshd_set_max_auth_tries.
 In Bash remediation for ntpd_configure_restrictions.
 In Bash remediation for sshd_set_idle_timeout.
 In Bash remediation for sshd_use_priv_separation.
 In Bash remediation for sshd_set_keepalive.
 In Bash remediation for sshd_use_strong_ciphers.
 In Bash remediation for accounts_have_homedir_login_defs.
 In Bash remediation for selinux_state.
 In Bash remediation for selinux_policytype.
 In Bash remediation for configure_usbguard_auditbackend.
 In Bash remediation for postfix_network_listening_disabled.
 In Bash remediation for ssh_client_rekey_limit.
 In Bash remediation for sshd_rekey_limit.
 In Bash remediation for configure_openssl_tls_crypto_policy.
 In Bash remediation for coredump_disable_storage.
 In Bash remediation for sudoers_validate_passwd.
 In Bash remediation for sshd_set_max_sessions.
 In Ansible remediation for accounts_tmout.
Macro lineinfile_absent:
 In Ansible remediation for accounts_have_homedir_login_defs.
 In Bash remediation for coredump_disable_backtraces.
 In Bash remediation for sshd_use_strong_macs.
 In Ansible remediation for configure_openssl_tls_crypto_policy.
 In Bash remediation for sshd_set_max_auth_tries.
 In Bash remediation for ntpd_configure_restrictions.
 In Bash remediation for sshd_set_idle_timeout.
 In Bash remediation for sshd_use_priv_separation.
 In Bash remediation for sshd_set_keepalive.
 In Bash remediation for sshd_use_strong_ciphers.
 In Bash remediation for accounts_have_homedir_login_defs.
 In Bash remediation for selinux_state.
 In Bash remediation for selinux_policytype.
 In Bash remediation for configure_usbguard_auditbackend.
 In Bash remediation for postfix_network_listening_disabled.
 In Bash remediation for ssh_client_rekey_limit.
 In Bash remediation for sshd_rekey_limit.
 In Bash remediation for configure_openssl_tls_crypto_policy.
 In Bash remediation for coredump_disable_storage.
 In Bash remediation for sudoers_validate_passwd.
 In Bash remediation for sshd_set_max_sessions.
 In Ansible remediation for accounts_tmout.
Macro lineinfile_present:
 In Ansible remediation for accounts_have_homedir_login_defs.
 In Bash remediation for coredump_disable_backtraces.
 In Bash remediation for sshd_use_strong_macs.
 In Ansible remediation for configure_openssl_tls_crypto_policy.
 In Bash remediation for sshd_set_max_auth_tries.
 In Bash remediation for ntpd_configure_restrictions.
 In Bash remediation for sshd_set_idle_timeout.
 In Bash remediation for sshd_use_priv_separation.
 In Bash remediation for sshd_set_keepalive.
 In Bash remediation for sshd_use_strong_ciphers.
 In Bash remediation for accounts_have_homedir_login_defs.
 In Bash remediation for selinux_state.
 In Bash remediation for selinux_policytype.
 In Bash remediation for configure_usbguard_auditbackend.
 In Bash remediation for postfix_network_listening_disabled.
 In Bash remediation for ssh_client_rekey_limit.
 In Bash remediation for sshd_rekey_limit.
 In Bash remediation for configure_openssl_tls_crypto_policy.
 In Bash remediation for coredump_disable_storage.
 In Bash remediation for sudoers_validate_passwd.
 In Bash remediation for sshd_set_max_sessions.
 In Ansible remediation for accounts_tmout.
Macro oval_line_in_file_criterion:
 In OVAL check for harden_ssh_client_crypto_policy.
 In OVAL check for sshd_rekey_limit.
 In OVAL check for sshd_use_directory_configuration.
Macro oval_line_in_file_test:
 In OVAL check for sshd_use_priv_separation.
 In OVAL check for chronyd_run_as_chrony_user.
 In OVAL check for postfix_prevent_unrestricted_relay.
 In OVAL check for harden_openssl_crypto_policy.
 In OVAL check for sshd_use_strong_macs.
 In OVAL check for gnome_gdm_disable_xdmcp.
 In OVAL check for configure_openssl_tls_crypto_policy.
 In OVAL check for grub2_no_removeable_media.
 In OVAL check for dnf-automatic_apply_updates.
 In OVAL check for sshd_disable_compression.
 In OVAL check for dnf-automatic_security_updates_only.
 In OVAL check for harden_ssh_client_crypto_policy.
 In OVAL check for coredump_disable_backtraces.
 In OVAL check for sshd_use_strong_ciphers.
 In OVAL check for harden_sshd_crypto_policy.
 In OVAL check for configure_usbguard_auditbackend.
 In OVAL check for grub2_nousb_argument.
 In OVAL check for configure_etc_hosts_deny.
 In OVAL check for coredump_disable_storage.
 In OVAL check for sshd_use_directory_configuration.
Macro oval_line_in_file_object:
 In OVAL check for sshd_use_priv_separation.
 In OVAL check for chronyd_run_as_chrony_user.
 In OVAL check for postfix_prevent_unrestricted_relay.
 In OVAL check for harden_openssl_crypto_policy.
 In OVAL check for sshd_use_strong_macs.
 In OVAL check for gnome_gdm_disable_xdmcp.
 In OVAL check for configure_openssl_tls_crypto_policy.
 In OVAL check for grub2_no_removeable_media.
 In OVAL check for dnf-automatic_apply_updates.
 In OVAL check for sshd_disable_compression.
 In OVAL check for dnf-automatic_security_updates_only.
 In OVAL check for harden_ssh_client_crypto_policy.
 In OVAL check for coredump_disable_backtraces.
 In OVAL check for sshd_use_strong_ciphers.
 In OVAL check for harden_sshd_crypto_policy.
 In OVAL check for configure_usbguard_auditbackend.
 In OVAL check for grub2_nousb_argument.
 In OVAL check for configure_etc_hosts_deny.
 In OVAL check for coredump_disable_storage.
 In OVAL check for sshd_use_directory_configuration.
Macro oval_line_in_file_state:
 In OVAL check for coredump_disable_backtraces.
 In OVAL check for dnf-automatic_apply_updates.
 In OVAL check for sshd_use_strong_ciphers.
 In OVAL check for harden_sshd_crypto_policy.
 In OVAL check for sshd_use_strong_macs.
 In OVAL check for chronyd_run_as_chrony_user.
 In OVAL check for configure_usbguard_auditbackend.
 In OVAL check for grub2_nousb_argument.
 In OVAL check for dnf-automatic_security_updates_only.
 In OVAL check for postfix_prevent_unrestricted_relay.
 In OVAL check for harden_ssh_client_crypto_policy.
 In OVAL check for gnome_gdm_disable_xdmcp.
 In OVAL check for configure_openssl_tls_crypto_policy.
 In OVAL check for coredump_disable_storage.
 In OVAL check for configure_etc_hosts_deny.
 In OVAL check for harden_openssl_crypto_policy.
 In OVAL check for grub2_no_removeable_media.
Others:
 Python abstract syntax tree change found in ssg/jinja.py.

Recommended tests to execute:
 build_product rhel7
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using bash --datastream build/ssg-rhel7-ds.xml grub2_no_removeable_media
 (cd build && cmake ../ && ctest -j4)

[JAORMX]

awesomeness!! Wish we had this in RHCOS already

[cipherboy]

Sometimes I really dislike the Match syntax of SSH config files but at least it is consistent... :-)

I like the intent of this though!

[JAORMX]

Huh, there seem to be some regressions. This is from the ci/prow/e2e-aws-rhcos4-e8 job:

 INFO[2021-04-30T11:18:09Z]     helpers.go:695: Result - Name: e2e-e8-master-sshd-disable-rhosts - Status: FAIL - Severity: medium 
INFO[2021-04-30T11:18:09Z]     helpers.go:698: E2E-FAILURE: The expected result for the sshd_disable_rhosts rule didn't match. Expected 'PASS', Got 'FAIL'

[JAORMX]

The same failure appears in the moderate job.

[matejak]

There are some mysterious failures - the rule should work exactly the same on other products than Fedora and RHEL9, and it also fails to build (presumably on Python2 systems) with a really weird error message.
I will investigate those.

[yuumasato]

There are some mysterious failures - the rule should work exactly the same on other products than Fedora and RHEL9, and it also fails to build (presumably on Python2 systems) with a really weird error message.
I will investigate those.

@matejak Was there any conclusion on the mysterious failures?

[yuumasato]

@matejak Sorry, my mistake I made a comment but did not finish the review.

[matejak]

@matejak Was there any conclusion on the mysterious failures?

Yes, they were related to Jinja constructs that were not supported everywhere, and they were fixed.

I believe Alex's concerns were addressed