From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id A2EA513827E for ; Wed, 11 Dec 2013 20:58:45 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 275BEE09DB; Wed, 11 Dec 2013 20:58:45 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 71A68E09A4 for ; Wed, 11 Dec 2013 20:58:44 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 36E6033F152 for ; Wed, 11 Dec 2013 20:58:43 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id 9E469D004C for ; Wed, 11 Dec 2013 20:58:40 +0000 (UTC) From: "Sven Vermeulen" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" Message-ID: <1386795433.47048684305f47c5fbe32da2c9cdc6e7f687cfaa.swift@gentoo> Subject: [gentoo-commits] proj/hardened-docs:master commit in: xml/SCAP/ X-VCS-Repository: proj/hardened-docs X-VCS-Files: xml/SCAP/openssh-ds.xml X-VCS-Directories: xml/SCAP/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 47048684305f47c5fbe32da2c9cdc6e7f687cfaa X-VCS-Branch: master Date: Wed, 11 Dec 2013 20:58:40 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 8fc9dae0-9e3a-4fc2-ac43-d0de25cc5417 X-Archives-Hash: 0946c437f13df478e6aacc059fa5a643 commit: 47048684305f47c5fbe32da2c9cdc6e7f687cfaa Author: Sven Vermeulen siphos be> AuthorDate: Wed Dec 11 20:57:13 2013 +0000 Commit: Sven Vermeulen gentoo org> CommitDate: Wed Dec 11 20:57:13 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-docs.git;a=commit;h=47048684 Adding datastream for OpenSSH --- xml/SCAP/openssh-ds.xml | 1610 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 1610 insertions(+) diff --git a/xml/SCAP/openssh-ds.xml b/xml/SCAP/openssh-ds.xml new file mode 100644 index 0000000..84207bc --- /dev/null +++ b/xml/SCAP/openssh-ds.xml @@ -0,0 +1,1610 @@ + + + + vim + 5.9 + 2011-10-31T12:00:00-04:00 + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^PermitRootLogin no + file /etc/ssh/sshd_config must have a line that matches ^PermitRootLogin no + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^PasswordAuthentication no + file /etc/ssh/sshd_config must have a line that matches ^PasswordAuthentication no + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^ChallengeResponseAuthentication no + file /etc/ssh/sshd_config must have a line that matches ^ChallengeResponseAuthentication no + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^AllowGroup + file /etc/ssh/sshd_config must have a line that matches ^AllowGroup + + + + + + + + file /etc/hosts.allow must have a line that matches ^sshd: + file /etc/hosts.allow must have a line that matches ^sshd: + + + + + + + + file /etc/hosts.deny must have a line that matches ^sshd: ALL + file /etc/hosts.deny must have a line that matches ^sshd: ALL + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^IgnoreRhosts.*no + file /etc/ssh/sshd_config may not have a line that matches ^IgnoreRhosts.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^RhostsRSAAuthentication.*yes + file /etc/ssh/sshd_config may not have a line that matches ^RhostsRSAAuthentication.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^HostbasedAuthentication.*yes + file /etc/ssh/sshd_config may not have a line that matches ^HostbasedAuthentication.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^PermitEmptyPasswords.*yes + file /etc/ssh/sshd_config may not have a line that matches ^PermitEmptyPasswords.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^UsePAM.*no + file /etc/ssh/sshd_config may not have a line that matches ^UsePAM.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^Protocol.*1 + file /etc/ssh/sshd_config may not have a line that matches ^Protocol.*1 + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^UsePrivilegeSeparation.*no + file /etc/ssh/sshd_config may not have a line that matches ^UsePrivilegeSeparation.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^X11Forwarding.*yes + file /etc/ssh/sshd_config may not have a line that matches ^X11Forwarding.*yes + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^StrictMode.*no + file /etc/ssh/sshd_config may not have a line that matches ^StrictMode.*no + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress.*0.0.0.0 + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress.*0.0.0.0 + + + + + + + + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress[ ]*::$ + file /etc/ssh/sshd_config may not have a line that matches ^ListenAddress[ ]*::$ + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^ListenAddress + file /etc/ssh/sshd_config must have a line that matches ^ListenAddress + + + + + + + + file /etc/ssh/sshd_config must have a line that matches ^AllowTcpForwarding.*no + file /etc/ssh/sshd_config must have a line that matches ^AllowTcpForwarding.*no + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + /etc/ssh/sshd_config + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/hosts.allow + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + /etc/hosts.deny + ^[[:space:]]*([^#[:space:]].*[^[:space:]]?)[[:space:]]*$ + 1 + + + + + + + + ^PermitRootLogin no + + + ^PasswordAuthentication no + + + ^ChallengeResponseAuthentication no + + + ^AllowGroup + + + ^sshd + + + ^sshd + + + ^IgnoreRhosts.*no + + + ^RhostsRSAAuthentication.*yes + + + ^HostbasedAuthentication.*yes + + + ^PermitEmptyPasswords.*yes + + + ^UsePAM.*no + + + ^Protocol.*1 + + + ^UsePrivilegeSeparation.*no + + + ^X11Forwarding.*yes + + + ^StrictMode.*no + + + ^ListenAddress.*0.0.0.0 + + + ^ListenAddress[ ]* + + + ^ListenAddress + + + ^AllowTcpForwarding.*no + + + + + + draft + Hardening OpenSSH + + The OpenSSH server offers remote Secure Shell services towards your users. This benchmark + focuses on the hardening of OpenSSH within a Gentoo Hardened environment. + + + 1 + + + + OpenSSH server setup settings + + Profile matching all OpenSSH hardening rules + + + + + + + + + + +