Align ClientAliveCountMax and ClientAliveInterval on RHEL8 STIG V1R8

[yuumasato]

Description:

• RHEL8 STIG V1R8 configures ClientAliveCountMax 1.
  • This change is valid and keeps the timeout by network availability.
• Update description of sshd_set_keepalive and sshd_set_idle_timeout to reduce misunderstanding of what the rule configures, which is the timeout of SSH sessions based on network timeout, not user idleness.

Rationale:

• Align with RHEL8 STIG V1R8

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chgrp 0 /boot/grub2/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
@@ -20,8 +20,8 @@
 path: /boot/grub2/grub.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80800-6
@@ -42,8 +42,8 @@
 path: /boot/grub2/grub.cfg
 group: '0'
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chgrp 0 /boot/grub2/user.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg
@@ -20,8 +20,8 @@
 path: /boot/grub2/user.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86009-8
@@ -42,8 +42,8 @@
 path: /boot/grub2/user.cfg
 group: '0'
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chown 0 /boot/grub2/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
@@ -20,8 +20,8 @@
 path: /boot/grub2/grub.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80805-5
@@ -42,8 +42,8 @@
 path: /boot/grub2/grub.cfg
 owner: '0'
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_user_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chown 0 /boot/grub2/user.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_user_cfg
@@ -20,8 +20,8 @@
 path: /boot/grub2/user.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86015-5
@@ -42,8 +42,8 @@
 path: /boot/grub2/user.cfg
 owner: '0'
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chmod u-xs,g-xwrs,o-xwrt /boot/grub2/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
@@ -18,8 +18,8 @@
 path: /boot/grub2/grub.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80814-7
@@ -38,8 +38,8 @@
 path: /boot/grub2/grub.cfg
 mode: u-xs,g-xwrs,o-xwrt
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_user_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chmod u-xs,g-xwrs,o-xwrt /boot/grub2/user.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_user_cfg
@@ -18,8 +18,8 @@
 path: /boot/grub2/user.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86024-7
@@ -38,8 +38,8 @@
 path: /boot/grub2/user.cfg
 mode: u-xs,g-xwrs,o-xwrt
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0'.
--- xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0
+++ xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0
@@ -7,10 +7,10 @@
 during a SSH session and waits for a response from the SSH client.
 The option ClientAliveInterval configures timeout after
 each ClientAliveCountMax message. If the SSH server does not
-receive a response from the client, then the connection is considered idle
+receive a response from the client, then the connection is considered unresponsive
 and terminated.
 
-To ensure the SSH idle timeout occurs precisely when the
+To ensure the SSH timeout occurs precisely when the
 ClientAliveInterval is set, set the ClientAliveCountMax to
 value of 0 in
 
@@ -333,13 +333,7 @@
 SRG-OS-000480-VMM-002000
 
 [reference]:
-RHEL-08-010200
-
-[reference]:
 5.2.13
-
-[reference]:
-SV-230244r858697_rule
 
 [rationale]:
 This ensures a user login will be terminated as soon as the ClientAliveInterval

OCIL for rule 'xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0' differs.
--- ocil:ssg-sshd_set_keepalive_0_ocil:questionnaire:1
+++ ocil:ssg-sshd_set_keepalive_0_ocil:questionnaire:1
@@ -5,7 +5,7 @@
 If properly configured, the output should be:
 ClientAliveCountMax 0
 
-In this case, the SSH idle timeout occurs precisely when
+In this case, the SSH timeout occurs precisely when
 the ClientAliveInterval is set.
 Is it the case that it is commented out or not configured properly?
 
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0' differs.
--- xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0
+++ xccdf_org.ssgproject.content_rule_sshd_set_keepalive_0
@@ -32,7 +32,6 @@
 tags:
 - CCE-83405-1
 - CJIS-5.5.6
- - DISA-STIG-RHEL-08-010200
 - NIST-800-171-3.1.11
 - NIST-800-53-AC-12
 - NIST-800-53-AC-17(a)

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sshd_set_keepalive'.
--- xccdf_org.ssgproject.content_rule_sshd_set_keepalive
+++ xccdf_org.ssgproject.content_rule_sshd_set_keepalive
@@ -7,14 +7,15 @@
 during a SSH session and waits for a response from the SSH client.
 The option ClientAliveInterval configures timeout after
 each ClientAliveCountMax message. If the SSH server does not
-receive a response from the client, then the connection is considered idle
+receive a response from the client, then the connection is considered unresponsive
 and terminated.
 For SSH earlier than v8.2, a ClientAliveCountMax value of 0
-causes an idle timeout precisely when the ClientAliveInterval is set.
+causes a timeout precisely when the ClientAliveInterval is set.
 Starting with v8.2, a value of 0 disables the timeout functionality
 completely. If the option is set to a number greater than 0, then
-the idle session will be disconnected after
-ClientAliveInterval * ClientAliveCountMax seconds.
+the session will be disconnected after
+ClientAliveInterval * ClientAliveCountMax seconds without receiving
+a keep alive message.
 
 [reference]:
 BP28(R29)
@@ -332,7 +333,13 @@
 SRG-OS-000480-VMM-002000
 
 [reference]:
+RHEL-08-010200
+
+[reference]:
 5.2.20
+
+[reference]:
+SV-230244r858697_rule
 
 [rationale]:
 This ensures a user login will be terminated as soon as the ClientAliveInterval

OCIL for rule 'xccdf_org.ssgproject.content_rule_sshd_set_keepalive' differs.
--- ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1
+++ ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1
@@ -2,10 +2,10 @@
 $ sudo grep ClientAliveCountMax /etc/ssh/sshd_config
 If properly configured, the output should be:
 ClientAliveCountMax 
-For SSH earlier than v8.2, a ClientAliveCountMax value of 0 causes an idle timeout precisely when
+For SSH earlier than v8.2, a ClientAliveCountMax value of 0 causes a timeout precisely when
 the ClientAliveInterval is set. Starting with v8.2, a value of 0 disables the timeout
 functionality completely.
-If the option is set to a number greater than 0, then the idle session will be disconnected after
-ClientAliveInterval * ClientAliveCountMax seconds.
+If the option is set to a number greater than 0, then the session will be disconnected after
+ClientAliveInterval * ClientAliveCountMax seconds witout receiving a keep alive message.
 Is it the case that it is commented out or not configured properly?
 
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_set_keepalive' differs.
--- xccdf_org.ssgproject.content_rule_sshd_set_keepalive
+++ xccdf_org.ssgproject.content_rule_sshd_set_keepalive
@@ -38,6 +38,7 @@
 tags:
 - CCE-80907-9
 - CJIS-5.5.6
+ - DISA-STIG-RHEL-08-010200
 - NIST-800-171-3.1.11
 - NIST-800-53-AC-12
 - NIST-800-53-AC-17(a)

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout'.
--- xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout
+++ xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout
@@ -1,12 +1,12 @@
 
 [title]:
-Set SSH Idle Timeout Interval
+Set SSH Client Alive Interval
 
 [description]:
-SSH allows administrators to set an idle timeout interval. After this interval
-has passed, the idle user will be automatically logged out.
-
-To set an idle timeout interval, edit the following line in /etc/ssh/sshd_config as
+SSH allows administrators to set a network responsiveness timeout interval.
+After this interval has passed, the unresponsive client will be automatically logged out.
+
+To set this timeout interval, edit the following line in /etc/ssh/sshd_config as
 follows:
 ClientAliveInterval 'xccdf_org.ssgproject.content_value_sshd_idle_timeout_value'
 
@@ -15,10 +15,10 @@
 
 If a shorter timeout has already been set for the login shell, that value will
 preempt any SSH setting made in /etc/ssh/sshd_config. Keep in mind that
-some processes may stop SSH from correctly detecting that the user is idle.
+some processes may stop SSH from correctly detecting that the user is idle.
 
 [warning]:
-SSH disconnecting idle clients will not have desired effect without also
+SSH disconnecting unresponsive clients will not have desired effect without also
 configuring ClientAliveCountMax in the SSH service configuration.
 
 [warning]:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout' differs.
--- xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout
+++ xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout
@@ -4,7 +4,7 @@
 tags:
 - always
 
-- name: Set SSH Idle Timeout Interval
+- name: Set SSH Client Alive Interval
 block:
 
 - name: Check for duplicate values

[yuumasato]

I'll also update sshd_set_idle_timeout in this PR, they are closely related.

[yuumasato]

I'll also update sshd_set_idle_timeout in this PR, they are closely related.

Done.

[Mab879]

Thanks for the PR. I do have one question.

[Mab879]

Thanks for the clarification. LGTM.

[Mab879]

Looks the profile stability didn't make it in your rebase; can you please take a look?

[yuumasato]

Looks the profile stability didn't make it in your rebase; can you please take a look?

Updated

[codeclimate]

Code Climate has analyzed commit 86b1a61 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 46.8% (0.0% change).

View more on Code Climate.