From f28fd77583f59566e3abe8f25ec7dedb928a046b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20Boraty=C5=84ski?= Date: Thu, 3 Dec 2015 00:57:50 +0100 Subject: [PATCH 1/9] Modified [SSH-7408] -- made it widely usable. Modified [SSH-7408] in such a way that every option for SSH server might be added in SSHOPS with expected (and wrong) values (like it was described in comment). --- include/tests_ssh | 58 +++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 51 insertions(+), 7 deletions(-) diff --git a/include/tests_ssh b/include/tests_ssh index 5cc466ce..b2fd7222 100644 --- a/include/tests_ssh +++ b/include/tests_ssh @@ -83,15 +83,59 @@ # Test : SSH-7408 # Description : Check SSH specific defined options if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi - Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH defined options" + Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH specific defined options" if [ ${SKIPTEST} -eq 0 ]; then - logtext "Test: Checking all specific defined options in ${SSH_DAEMON_CONFIG}" - FIND=`grep -v "^#" ${SSH_DAEMON_CONFIG} | grep -v "^$" | ${AWKBINARY} '{gsub("\t"," ");print}' | sed 's/ /!space!/g'` - for I in ${FIND}; do - I=`echo ${I} | sed 's/!space!/ /g'` - logtext "Found SSH option: ${I}" + logtext "Test: Checking specific defined options in ${SSH_DAEMON_CONFIG}" + ## SSHOPTIONS scheme: + ## :,, + ## Example: + ## PermitRootLogin:NO,WITHOUT-PASSWORD,YES + SSHOPS="Protocol:2,,1" + + for I in ${SSHOPS}; + do + OPTIONNAME=`echo ${I} | cut -d ':' -f1` + + EXPECTEDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f1` + MEDIUMSCOREDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f2` + WRONGVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f3` + + FOUNDVALUE=`awk -v OPT="${OPTIONNAME}" 'index($0, OPT) == 1 { print toupper($2) }' ${SSH_DAEMON_CONFIG}` + + logtext "Test: Checking ${OPTIONNAME} in ${SSH_DAEMON_CONFIG}" + + if [ ! "${FOUNDVALUE}" = "" ]; then + logtext "Result: Option ${OPTIONNAME} found in ${SSH_DAEMON_CONFIG}" + logtext "Result: Option ${OPTIONNAME} value is ${FOUNDVALUE}" + + if [ "${FOUNDVALUE}" = "${EXPECTEDVALUE}" ]; then + logtext "Result: SSH option ${OPTIONNAME} is configured very well" + Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result OK --color GREEN + AddHP 3 3 + + elif [ "${FOUNDVALUE}" = "${MEDIUMSCOREDVALUE}" ]; then + logtext "Result: SSH option ${OPTIONNAME} is configured totally wrong" + ReportSuggestion ${TEST_NO} "Harder SSH option: ${OPTIONNAME}" + Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "MEDIUM" --color YELLOW + AddHP 1 3 + + elif [ "${FOUNDVALUE}" = "${WRONGVALUE}" ]; then + logtext "Result: SSH option ${OPTIONNAME} is configured totally wrong" + ReportWarning ${TEST_NO} "M" "Unsafe configured SSH option: ${OPTIONNAME}" + ReportSuggestion ${TEST_NO} "Reconfigure ${OPTIONNAME}" + Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result WARNING --color RED + AddHP 0 3 + + else + logtext "Result: Value of SSH option ${OPTIONNAME} is unknown (not defined)" + Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result DEFAULT --color WHITE + fi + + else + logtext "Result: Option ${OPTIONNAME} not found in ${SSH_DAEMON_CONFIG}" + Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "NOT FOUND" --color WHITE + fi done - Display --indent 4 --text "- Checking defined SSH options" --result "DONE" --color GREEN fi # ################################################################################# From dcd8f8925666dfc70ef8ea01f6396ecbb130228b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20Boraty=C5=84ski?= Date: Thu, 3 Dec 2015 01:38:55 +0100 Subject: [PATCH 2/9] Moved [SSH-7414] into [SSH-7408]. --- include/tests_ssh | 26 -------------------------- 1 file changed, 26 deletions(-) diff --git a/include/tests_ssh b/include/tests_ssh index b2fd7222..9afebd6d 100644 --- a/include/tests_ssh +++ b/include/tests_ssh @@ -171,32 +171,6 @@ fi # ################################################################################# -# - # Test : SSH-7414 - # Description : Check SSH Protocol option - if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi - Register --test-no SSH-7414 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: Protocol" - if [ ${SKIPTEST} -eq 0 ]; then - logtext "Test: check allowed SSH protocol versions" - FIND=`awk '/^Protocol/ { print $2 }' ${SSH_DAEMON_CONFIG}` - if [ "${FIND}" = "1" -o "${FIND}" = "2,1" -o "${FIND}" = "1,2" ]; then - logtext "Result: Protocol option is set to allow SSH protocol version 1" - Display --indent 4 --text "- SSH option: Protocol" --result WARNING --color RED - ReportWarning ${TEST_NO} "M" "SSH protocol version 1 is allowed" - AddHP 0 3 - else - if [ "${FIND}" = "2" ]; then - logtext "Result: only protocol 2 is allowed" - Display --indent 4 --text "- SSH option: Protocol" --result OK --color GREEN - AddHP 3 3 - else - logtext "Result: value of Protocol is unknown (not defined)" - Display --indent 4 --text "- SSH option: Protocol" --result DEFAULT --color WHITE - fi - fi - fi -# -################################################################################# # # Test : SSH-7416 # Description : Check SSH StrictModes option From a07c7ae4f901cf341330784f3a6914d9972b4303 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20Boraty=C5=84ski?= Date: Thu, 3 Dec 2015 01:41:07 +0100 Subject: [PATCH 3/9] Moved [SSH-7412] into [SSH-7408]. --- include/tests_ssh | 35 ++--------------------------------- 1 file changed, 2 insertions(+), 33 deletions(-) diff --git a/include/tests_ssh b/include/tests_ssh index 9afebd6d..e985e2ce 100644 --- a/include/tests_ssh +++ b/include/tests_ssh @@ -90,7 +90,8 @@ ## :,, ## Example: ## PermitRootLogin:NO,WITHOUT-PASSWORD,YES - SSHOPS="Protocol:2,,1" + SSHOPS="Protocol:2,,1\ + PermitRootLogin:NO,WITHOUT-PASSWORD,YES" for I in ${SSHOPS}; do @@ -139,38 +140,6 @@ fi # ################################################################################# -# - # Test : SSH-7412 - # Description : Check SSH PermitRootLogin option - if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi - Register --test-no SSH-7412 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: PermitRootLogin" - if [ ${SKIPTEST} -eq 0 ]; then - logtext "Test: check PermitRootLogin option" - FIND=`awk '/^PermitRootLogin/ { print $2 }' ${SSH_DAEMON_CONFIG}` - if [ "${FIND}" = "yes" -o "${FIND}" = "YES" -o "${FIND}" = "Yes" ]; then - logtext "Result: PermitRootLogin is enabled, root can login directly" - Display --indent 4 --text "- SSH option: PermitRootLogin" --result WARNING --color RED - ReportWarning ${TEST_NO} "M" "Root can directly login via SSH" - AddHP 0 3 - else - # YYY add test for DenyUsers root - if [ "${FIND}" = "no" -o "${FIND}" = "No" ]; then - logtext "Result: PermitRootLogin is disabled. Root can't login directly" - Display --indent 4 --text "- SSH option: PermitRootLogin" --result DISABLED --color GREEN - AddHP 3 3 - elif [ "${FIND}" = "without-password" ]; then - # Check if password authentication is disabled for root user, so this option is used properly - logtext "Result: PermitRootLogin is disabled. Root can't login directly" - Display --indent 4 --text "- SSH option: PermitRootLogin (without-password)" --result OK --color GREEN - AddHP 3 3 - else - logtext "Result: Value of PermitRootLogin is unknown (not defined)" - Display --indent 4 --text "- SSH option: PermitRootLogin" --result DEFAULT --color WHITE - fi - fi - fi -# -################################################################################# # # Test : SSH-7416 # Description : Check SSH StrictModes option From 66b0ee3977209272857254e22a26efba7f6ae64b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20Boraty=C5=84ski?= Date: Thu, 3 Dec 2015 01:44:00 +0100 Subject: [PATCH 4/9] Moved [SSH-7416] into [SSH-7408]. --- include/tests_ssh | 30 ++---------------------------- 1 file changed, 2 insertions(+), 28 deletions(-) diff --git a/include/tests_ssh b/include/tests_ssh index e985e2ce..be262bed 100644 --- a/include/tests_ssh +++ b/include/tests_ssh @@ -91,7 +91,8 @@ ## Example: ## PermitRootLogin:NO,WITHOUT-PASSWORD,YES SSHOPS="Protocol:2,,1\ - PermitRootLogin:NO,WITHOUT-PASSWORD,YES" + PermitRootLogin:NO,WITHOUT-PASSWORD,YES\ + StrictModes:YES,,NO" for I in ${SSHOPS}; do @@ -140,33 +141,6 @@ fi # ################################################################################# -# - # Test : SSH-7416 - # Description : Check SSH StrictModes option - if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi - Register --test-no SSH-7416 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: StrictModes" - if [ ${SKIPTEST} -eq 0 ]; then - logtext "Test: Check configured StrictModes option" - FIND=`awk '/^StrictModes/ { print $2 }' ${SSH_DAEMON_CONFIG}` - if [ "${FIND}" = "no" -o "${FIND}" = "NO" -o "${FIND}" = "No" ]; then - logtext "Result: StrictModes option is set to 'no', which means file permissions are NOT checked" - Display --indent 4 --text "- SSH option: StrictModes" --result WARNING --color RED - ReportWarning ${TEST_NO} "M" "StrictModes is turned off" - ReportSuggestion ${TEST_NO} "Check StrictModes option in sshd_config" - AddHP 0 3 - else - if [ "${FIND}" = "yes" -o "${FIND}" = "YES" -o "${FIND}" = "Yes" ]; then - logtext "Result: StrictModes active, file permissions are checked" - Display --indent 4 --text "- SSH option: StrictModes" --result OK --color GREEN - AddHP 3 3 - else - logtext "Result: value of StrictModes is unknown (not defined)" - Display --indent 4 --text "- SSH option: StrictModes" --result DEFAULT --color WHITE - fi - fi - fi -# -################################################################################# # # Test : SSH-7440 # Description : AllowUsers / AllowGroups From 37ab68d501f6c6fed2adb909cf08528f1b1ea9a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20Boraty=C5=84ski?= Date: Thu, 3 Dec 2015 01:48:30 +0100 Subject: [PATCH 5/9] Improved [SSH-7408] with 'PermitEmptyPasswords'. [SSH-7408] will verify 'PermitEmptyPasswords' option too. --- include/tests_ssh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/tests_ssh b/include/tests_ssh index be262bed..63cfa0ef 100644 --- a/include/tests_ssh +++ b/include/tests_ssh @@ -92,7 +92,8 @@ ## PermitRootLogin:NO,WITHOUT-PASSWORD,YES SSHOPS="Protocol:2,,1\ PermitRootLogin:NO,WITHOUT-PASSWORD,YES\ - StrictModes:YES,,NO" + StrictModes:YES,,NO\ + VerifyReverseMapping:YES,,NO" for I in ${SSHOPS}; do From e656111c753f208f21df3008702907891b423c44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20Boraty=C5=84ski?= Date: Thu, 3 Dec 2015 01:57:43 +0100 Subject: [PATCH 6/9] Improved [SSH-7408] with 'IgnoreRhosts'. --- include/tests_ssh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/tests_ssh b/include/tests_ssh index 63cfa0ef..d348eba5 100644 --- a/include/tests_ssh +++ b/include/tests_ssh @@ -93,7 +93,8 @@ SSHOPS="Protocol:2,,1\ PermitRootLogin:NO,WITHOUT-PASSWORD,YES\ StrictModes:YES,,NO\ - VerifyReverseMapping:YES,,NO" + VerifyReverseMapping:YES,,NO\ + IgnoreRhosts:YES,,NO" for I in ${SSHOPS}; do From cd3cd74b8ec8dc287ffbb0749995b6146e67c3ab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20Boraty=C5=84ski?= Date: Thu, 3 Dec 2015 01:58:58 +0100 Subject: [PATCH 7/9] Improved [SSH-7408] with 'UseDNS'. --- include/tests_ssh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/tests_ssh b/include/tests_ssh index d348eba5..a85ffefb 100644 --- a/include/tests_ssh +++ b/include/tests_ssh @@ -94,7 +94,8 @@ PermitRootLogin:NO,WITHOUT-PASSWORD,YES\ StrictModes:YES,,NO\ VerifyReverseMapping:YES,,NO\ - IgnoreRhosts:YES,,NO" + IgnoreRhosts:YES,,NO\ + UseDNS:YES,,NO" for I in ${SSHOPS}; do From 42a5df379673837a84fa19ac81e7ee2929f17f7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20Boraty=C5=84ski?= Date: Thu, 3 Dec 2015 02:01:00 +0100 Subject: [PATCH 8/9] Improved [SSH-7408] with 'X11Forwarding'. --- include/tests_ssh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/tests_ssh b/include/tests_ssh index a85ffefb..3e532657 100644 --- a/include/tests_ssh +++ b/include/tests_ssh @@ -95,7 +95,8 @@ StrictModes:YES,,NO\ VerifyReverseMapping:YES,,NO\ IgnoreRhosts:YES,,NO\ - UseDNS:YES,,NO" + UseDNS:YES,,NO\ + X11Forwarding:NO,,YES" for I in ${SSHOPS}; do From 10b9edd8efc9123ec5c2ffc12cb5900c4aa80821 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamil=20Boraty=C5=84ski?= Date: Thu, 3 Dec 2015 02:37:56 +0100 Subject: [PATCH 9/9] Improved [SSH-7408] with 'PrintLastLog'. --- include/tests_ssh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/tests_ssh b/include/tests_ssh index 3e532657..3d6d5b8c 100644 --- a/include/tests_ssh +++ b/include/tests_ssh @@ -96,7 +96,8 @@ VerifyReverseMapping:YES,,NO\ IgnoreRhosts:YES,,NO\ UseDNS:YES,,NO\ - X11Forwarding:NO,,YES" + X11Forwarding:NO,,YES\ + PrintLastLog:YES,,NO" for I in ${SSHOPS}; do