SLE16 fixes for sshd configuration related rules by teacup-on-rockingchair · Pull Request #14439 · ComplianceAsCode/content

teacup-on-rockingchair · 2026-02-23T08:52:47Z

Description:

Vanilla installation of sshd on sle16 might have only /usr/etc/ssh/sshd_config configuration file but our remediation logic should be to copy the /usr/etc/sshd* files to /etc/sshd*, whenever possible and work with them when doing OVAL checks, since the /usr/etc/sshd* configurations might be changed on system upgrade without preserving user modigications

Rationale:

ansible copy distro defaults and remove Include /usr/etc/ssh/sshd_config.d/*.conf from main config
bash copy distro defaults and remove Include /usr/etc/ssh/sshd_config.d/*.conf from main config
tests now use sshd_main_config_file and sshd_config_dir(oracle specific test remain unchanged)
for sshd_limit_user_access, sshd_set_idle_timeout, sshd_set_login_grace_time, sshd_set_max_auth_tries
sshd_set_max_sessions, sshd_set_maxstartups, sshd_use_strong_kex
- sle16 OVAL is removed and test for checking main config file exist is added
- tests use sshd_main_config_file and sshd_config_dir

openshift-ci · 2026-02-23T08:52:51Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2026-05-24T07:41:19Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_cron_logging' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_cron_logging
+++ xccdf_org.ssgproject.content_rule_rsyslog_cron_logging
@@ -170,6 +170,24 @@
   - no_reboot_needed
   - rsyslog_cron_logging
 
+- name: Ensure cron Is Logging To Rsyslog - Check if /etc/rsyslog.conf exists
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: _config_file_exists
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"rsyslog" in ansible_facts.packages'
+  tags:
+  - CCE-80859-2
+  - DISA-STIG-RHEL-08-030010
+  - NIST-800-53-CM-6(a)
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rsyslog_cron_logging
+
 - name: Ensure cron Is Logging To Rsyslog - Check if the parameter cron.* is configured
     correctly in /etc/rsyslog.conf
   ansible.builtin.lineinfile:
@@ -182,6 +200,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_exists.stat.exists
   tags:
   - CCE-80859-2
   - DISA-STIG-RHEL-08-030010
@@ -257,6 +276,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_correctly is not skipped
   - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
     ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
     | int)) != 1

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode
+++ xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode
@@ -134,6 +134,25 @@
   - no_reboot_needed
   - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
 
+- name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Check if /etc/rsyslog.conf
+    exists
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: _config_file_exists
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"rsyslog" in ansible_facts.packages'
+  tags:
+  - CCE-86339-9
+  - DISA-STIG-RHEL-08-030720
+  - NIST-800-53-AU-4(1)
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rsyslog_encrypt_offload_actionsendstreamdriverauthmode
+
 - name: Ensure Rsyslog Authenticates Off-Loaded Audit Records - Check if the parameter
     $ActionSendStreamDriverAuthMode is configured correctly in /etc/rsyslog.conf
   ansible.builtin.lineinfile:
@@ -146,6 +165,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_exists.stat.exists
   tags:
   - CCE-86339-9
   - DISA-STIG-RHEL-08-030720
@@ -221,6 +241,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_correctly is not skipped
   - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
     ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
     | int)) != 1

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode
+++ xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode
@@ -134,6 +134,25 @@
   - no_reboot_needed
   - rsyslog_encrypt_offload_actionsendstreamdrivermode
 
+- name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if /etc/rsyslog.conf
+    exists
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: _config_file_exists
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"rsyslog" in ansible_facts.packages'
+  tags:
+  - CCE-86098-1
+  - DISA-STIG-RHEL-08-030710
+  - NIST-800-53-AU-4(1)
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rsyslog_encrypt_offload_actionsendstreamdrivermode
+
 - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
     $ActionSendStreamDriverMode is configured correctly in /etc/rsyslog.conf
   ansible.builtin.lineinfile:
@@ -146,6 +165,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_exists.stat.exists
   tags:
   - CCE-86098-1
   - DISA-STIG-RHEL-08-030710
@@ -221,6 +241,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_correctly is not skipped
   - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
     ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
     | int)) != 1

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver
+++ xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver
@@ -134,6 +134,25 @@
   - no_reboot_needed
   - rsyslog_encrypt_offload_defaultnetstreamdriver
 
+- name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if /etc/rsyslog.conf
+    exists
+  ansible.builtin.stat:
+    path: /etc/rsyslog.conf
+  register: _config_file_exists
+  when:
+  - '"kernel-core" in ansible_facts.packages'
+  - '"rsyslog" in ansible_facts.packages'
+  tags:
+  - CCE-85992-6
+  - DISA-STIG-RHEL-08-030710
+  - NIST-800-53-AU-4(1)
+  - configure_strategy
+  - low_complexity
+  - low_disruption
+  - medium_severity
+  - no_reboot_needed
+  - rsyslog_encrypt_offload_defaultnetstreamdriver
+
 - name: Ensure Rsyslog Encrypts Off-Loaded Audit Records - Check if the parameter
     $DefaultNetstreamDriver is configured correctly in /etc/rsyslog.conf
   ansible.builtin.lineinfile:
@@ -146,6 +165,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_exists.stat.exists
   tags:
   - CCE-85992-6
   - DISA-STIG-RHEL-08-030710
@@ -221,6 +241,7 @@
   when:
   - '"kernel-core" in ansible_facts.packages'
   - '"rsyslog" in ansible_facts.packages'
+  - _config_file_correctly is not skipped
   - (_config_file_correctly.found == 0 and _config_dir_correctly.matched == 0) or
     ((_config_file_has_parameter.found | int) + (_config_dir_has_parameter.matched
     | int)) != 1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_use_strong_kex' differs.
--- xccdf_org.ssgproject.content_rule_sshd_use_strong_kex
+++ xccdf_org.ssgproject.content_rule_sshd_use_strong_kex
@@ -2,6 +2,9 @@
 if rpm --quiet -q kernel-core; then
 
 sshd_strong_kex=''
+
+
+
 
 if [ -e "/etc/ssh/sshd_config" ] ; then
     LC_ALL=C sed -i "/^\s*KexAlgorithms\s\+/Id" "/etc/ssh/sshd_config"

… also checked for permissions

- sle16 OVAL is removed and test for checking main config file exist is added - tests checking /usr/etc/ssh stuff are removed and tests use sshd_main_config_file and sshd_config_dir

- ansible copy distro defaults and remove Include /usr/etc/ssh/sshd_config.d/*.conf from main config - bash copy distro defaults and remove Include /usr/etc/ssh/sshd_config.d/*.conf from main config - removed no longer needed tests checking /usr/etc/ssh stuff - tests now use sshd_main_config_file and sshd_config_dir(oracle specific test remain unchanged)

openshift-ci · 2026-05-27T10:12:18Z

@teacup-on-rockingchair: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	`f2d2f82`	link	true	`/test e2e-aws-openshift-node-compliance`
ci/prow/e2e-aws-openshift-platform-compliance	`f2d2f82`	link	true	`/test e2e-aws-openshift-platform-compliance`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

teacup-on-rockingchair · 2026-06-29T08:05:31Z

@Mab879 , @jan-cerny , @matusmarhefka or @vojtapolasek can you check this out

svet-se

LGTM

teacup-on-rockingchair · 2026-07-10T03:19:53Z

@Mab879 @jan-cerny @matusmarhefka @vojtapolasek anyone?

Addressing: jinja2.exceptions.UndefinedError: 'sshd_oval_check_usr' is undefined The PR #14439 merged today removed this macro sshd_oval_check_usr and all its occurrences. But, the #14831 merged yesterday added one occurrence of this macro back. And the first PR wasn't rebased after the latter was merged.

openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Feb 23, 2026

teacup-on-rockingchair added this to the 0.1.81 milestone Feb 23, 2026

svet-se self-assigned this Feb 24, 2026

teacup-on-rockingchair marked this pull request as ready for review February 26, 2026 04:55

openshift-ci Bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Feb 26, 2026

teacup-on-rockingchair requested a review from svet-se March 5, 2026 07:58

teacup-on-rockingchair force-pushed the sle16_file_permissions_sshd_config branch from de0d35d to 5d7ac3a Compare March 16, 2026 10:16

Arden97 modified the milestones: 0.1.81, 0.1.82 May 20, 2026

teacup-on-rockingchair force-pushed the sle16_file_permissions_sshd_config branch from 5d7ac3a to 4b2936b Compare May 24, 2026 07:32

teacup-on-rockingchair requested review from Mab879, jan-cerny, matusmarhefka and vojtapolasek as code owners May 24, 2026 07:32

teacup-on-rockingchair added 4 commits May 27, 2026 11:21

Make sure that distro delivered config in /usr/etc/ssh/sshd_config is…

8794c72

… also checked for permissions

Simplify SLE16 handling in SSH rules

3cda908

- sle16 OVAL is removed and test for checking main config file exist is added - tests checking /usr/etc/ssh stuff are removed and tests use sshd_main_config_file and sshd_config_dir

Add sed separator changes as in PR#14698

798483b

teacup-on-rockingchair force-pushed the sle16_file_permissions_sshd_config branch from 4b2936b to f2d2f82 Compare May 27, 2026 08:22

svet-se approved these changes Jul 2, 2026

View reviewed changes

Comment thread linux_os/guide/services/ssh/file_permissions_sshd_config/rule.yml Outdated

Comment thread products/sle16/product.yml

teacup-on-rockingchair changed the title ~~SLE16 check permissions /usr/etc/ssh/sshd_config~~ SLE16 fixes for sshd configuration related rules Jul 7, 2026

Mab879 approved these changes Jul 10, 2026

View reviewed changes

Mab879 merged commit f5d5023 into ComplianceAsCode:master Jul 10, 2026
67 of 70 checks passed

Mab879 self-assigned this Jul 10, 2026

jan-cerny mentioned this pull request Jul 10, 2026

Fix SLE16 build failure #14868

Merged

Arden97 mentioned this pull request Jul 13, 2026

Fix quoted glob in sshd_lineinfile test scripts breaking test scenarios #14875

Merged

Navigation Menu

Uh oh!

SLE16 fixes for sshd configuration related rules - #14439

SLE16 fixes for sshd configuration related rules#14439
Mab879 merged 4 commits into
ComplianceAsCode:masterfrom
teacup-on-rockingchair:sle16_file_permissions_sshd_config

teacup-on-rockingchair commented Feb 23, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented Feb 23, 2026

Uh oh!

github-actions Bot commented May 24, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented May 27, 2026

Uh oh!

teacup-on-rockingchair commented Jun 29, 2026

Uh oh!

svet-se left a comment

Uh oh!

Uh oh!

Uh oh!

teacup-on-rockingchair commented Jul 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

teacup-on-rockingchair commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description:

Rationale:

Uh oh!

openshift-ci Bot commented Feb 23, 2026

Uh oh!

github-actions Bot commented May 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented May 27, 2026

Uh oh!

teacup-on-rockingchair commented Jun 29, 2026

Uh oh!

svet-se left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

teacup-on-rockingchair commented Jul 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

teacup-on-rockingchair commented Feb 23, 2026 •

edited

Loading

github-actions Bot commented May 24, 2026 •

edited

Loading