check_sshpermitrootno is broken #129

New Issue

Closed

opened 2020-12-07 11:27:45 +01:00 by bwaegeneire · 1 comment

bwaegeneire commented

2020-12-07 11:27:45 +01:00

Owner

The default value of PermitRootLogin is prohibit-password and check_sshpermitrootno search in the config file for line setting PermitRootLogin to something other than no. So when this options isn't expclicitly set in the config file, PermitRootLogin isn't set to no but the chekc doens't fail although it should have.

This issue was revealed in ticket 55058.

Note that fixing and deploying it may lead to a lot of failed checks if they have previosly been fixed as first done in that ticket.

The default value of `PermitRootLogin` is `prohibit-password` and check_sshpermitrootno search in the config file for line setting `PermitRootLogin` to something other than `no`. So when this options isn't expclicitly set in the config file, `PermitRootLogin` isn't set to `no` but the chekc doens't fail although it should have. This issue was revealed in ticket 55058. Note that fixing and deploying it may lead to a lot of failed checks if they have previosly been fixed as first done in that ticket.

bwaegeneire commented

2021-06-16 11:09:49 +02:00

Author

Owner

Even worse, we don't check the effective configuration. In the followig example evocheck approve the configuration, looking naively at the configuration file one could think PermitRootLogin is disabled since it's applied last, however looking at the effective configuration dumped by SSH we that's not the case!

# /usr/share/scripts/evocheck.sh --verbose --cron
# echo $?
0
# grep PermitRootLogin /etc/ssh/sshd_config
PermitRootLogin prohibit-password
PermitRootLogin no
# sshd -T -C addr=0.0.0.0,user=root | grep permitroot
permitrootlogin without-password

Even worse, we don't check the effective configuration. In the followig example evocheck approve the configuration, looking naively at the configuration file one could think `PermitRootLogin` is disabled since it's applied last, however looking at the effective configuration dumped by SSH we that's not the case! ``` sh # /usr/share/scripts/evocheck.sh --verbose --cron # echo $? 0 # grep PermitRootLogin /etc/ssh/sshd_config PermitRootLogin prohibit-password PermitRootLogin no # sshd -T -C addr=0.0.0.0,user=root | grep permitroot permitrootlogin without-password ```