{ "platform": { "name": "mac_os_x", "release": "19.4.0" }, "profiles": [ { "name": "acme-inspec-profile", "version": "0.2.0", "sha256": "6414f43b3c6ff3106c96b2e75067a9ed6144a728373b864f4de8b3fb3c6c528f", "title": "Meta profile for Acme Inc", "maintainer": "Christoph Hartmann", "summary": "This profile collects all compliance and security related requirements for Acme Inc.", "license": "Apache 2.0", "copyright": "Christoph Hartmann", "copyright_email": "chris@lollyrock.com", "supports": [], "attributes": [], "depends": [ { "name": "linux-patch-baseline", "url": "https://github.com/dev-sec/linux-patch-baseline", "status": "skipped", "skip_message": "Skipping profile: 'linux-patch-baseline' on unsupported platform: 'mac_os_x/19.4.0'." }, { "name": "linux-baseline", "url": "https://github.com/dev-sec/linux-baseline", "status": "skipped", "skip_message": "Skipping profile: 'linux-baseline' on unsupported platform: 'mac_os_x/19.4.0'." }, { "name": "ssh-baseline", "url": "https://github.com/dev-sec/ssh-baseline", "status": "loaded" }, { "name": "windows-patch-baseline", "url": "https://github.com/dev-sec/windows-patch-baseline", "status": "skipped", "skip_message": "Skipping profile: 'windows-patch-baseline' on unsupported platform: 'mac_os_x/19.4.0'." }, { "name": "windows-baseline", "url": "https://github.com/dev-sec/windows-baseline", "status": "skipped", "skip_message": "Skipping profile: 'windows-baseline' on unsupported platform: 'mac_os_x/19.4.0'." }, { "name": "ssl-baseline", "url": "https://github.com/dev-sec/ssl-baseline", "status": "loaded" } ], "groups": [ { "id": "ssh-baseline-master/controls/ssh_spec.rb", "controls": [ "ssh-01", "ssh-02", "ssh-03", "ssh-04", "ssh-05", "ssh-06", "ssh-07", "ssh-08", "ssh-09", "ssh-10", "ssh-11", "ssh-12", "ssh-13", "ssh-14", "ssh-15", "ssh-16", "ssh-17", "ssh-18", "ssh-19", "ssh-20", "ssh-21" ], "title": "SSH client config" }, { "id": "ssh-baseline-master/controls/sshd_spec.rb", "controls": [ "sshd-01", "sshd-02", "sshd-03", "sshd-04", "sshd-05", "sshd-06", "sshd-07", "sshd-08", "sshd-09", "sshd-10", "sshd-11", "sshd-12", "sshd-13", "sshd-14", "sshd-15", "sshd-16", "sshd-17", "sshd-18", "sshd-19", "sshd-20", "sshd-21", "sshd-22", "sshd-23", "sshd-24", "sshd-25", "sshd-27", "sshd-28", "sshd-29", "sshd-30", "sshd-31", "sshd-32", "sshd-33", "sshd-34", "sshd-35", "sshd-36", "sshd-37", "sshd-38", "sshd-39", "sshd-40", "sshd-41", "sshd-42", "sshd-43", "sshd-44", "sshd-45", "sshd-46", "sshd-47", "sshd-48" ], "title": "SSH server config" }, { "id": "ssl-baseline-master/controls/ssl_test.rb", "controls": [ "debugging", "ssl2", "ssl3", "tls1.0", "tls1.1", "tls1.2", "kx-ecdh", "kx-rsa", "kx-dh", "kx-krb5", "kx-psk", "kx-gostr", "kx-srp", "au-ecdsa-rsa", "au-anon", "au-dss", "au-psk", "au-export", "enc-aes-gcm-chacha20", "enc-cbc", "enc-rc4", "enc-export", "enc-des", "enc-enull", "enc-camellia", "enc-seed", "enc-idea", "enc-aes-ccm", "mac-sha384-sha256-poly1305", "mac-md5", "mac-sha", "mac-null", "robotattack" ] } ], "controls": [ { "id": "ssh-01", "title": "client: Check ssh_config owner, group and permissions.", "desc": "The ssh_config should owned by root or a specified user, only be writable by owner and readable to all.", "descriptions": [ { "label": "default", "data": "The ssh_config should owned by root or a specified user, only be writable by owner and readable to all." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-01' do\n impact 1.0\n title 'client: Check ssh_config owner, group and permissions.'\n desc 'The ssh_config should owned by root or a specified user, only be writable by owner and readable to all.'\n\n describe file(ssh_custom_path + '/ssh_config') do\n it { should exist }\n it { should be_file }\n it { should be_owned_by ssh_custom_user }\n it { should be_grouped_into os.darwin? ? 'wheel' : ssh_custom_user }\n it { should_not be_executable }\n it { should be_readable.by('owner') }\n it { should be_readable.by('group') }\n it { should be_readable.by('other') }\n it { should be_writable.by('owner') }\n it { should_not be_writable.by('group') }\n it { should_not be_writable.by('other') }\n end\nend\n", "source_location": { "line": 28, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-02", "title": "Client: Specify the AddressFamily to your need", "desc": "OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6.", "descriptions": [ { "label": "default", "data": "OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-02' do\n impact 1.0\n title 'Client: Specify the AddressFamily to your need'\n desc 'OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('AddressFamily') { should match(/inet|inet6|any/) }\n end\nend\n", "source_location": { "line": 48, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-03", "title": "Client: Specify expected ssh port", "desc": "Always specify which port the SSH client should connect. Prevent unexpected settings.", "descriptions": [ { "label": "default", "data": "Always specify which port the SSH client should connect. Prevent unexpected settings." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-03' do\n impact 1.0\n title 'Client: Specify expected ssh port'\n desc 'Always specify which port the SSH client should connect. Prevent unexpected settings.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('Port') { should eq('22') }\n end\nend\n", "source_location": { "line": 57, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-04", "title": "Client: Specify protocol version 2", "desc": "Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore.", "descriptions": [ { "label": "default", "data": "Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-04' do\n impact 1.0\n title 'Client: Specify protocol version 2'\n desc \"Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore.\"\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('Protocol') { should eq('2') }\n end\nend\n", "source_location": { "line": 66, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-05", "title": "Client: Disable batch mode", "desc": "Avoid batch mode in the default configuration.", "descriptions": [ { "label": "default", "data": "Avoid batch mode in the default configuration." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-05' do\n impact 1.0\n title 'Client: Disable batch mode'\n desc 'Avoid batch mode in the default configuration.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('BatchMode') { should eq('no') }\n end\nend\n", "source_location": { "line": 75, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-06", "title": "Client: Check Host IPs", "desc": "Make sure that SSH checks the host IP address in the known_hosts file, to avoid DNS spoofing effects.", "descriptions": [ { "label": "default", "data": "Make sure that SSH checks the host IP address in the known_hosts file, to avoid DNS spoofing effects." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-06' do\n impact 1.0\n title 'Client: Check Host IPs'\n desc 'Make sure that SSH checks the host IP address in the known_hosts file, to avoid DNS spoofing effects.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('CheckHostIP') { should eq('yes') }\n end\nend\n", "source_location": { "line": 84, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-07", "title": "Client: Ask when checking host keys", "desc": "Don't automatically add new hosts keys to the list of known hosts.", "descriptions": [ { "label": "default", "data": "Don't automatically add new hosts keys to the list of known hosts." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-07' do\n impact 1.0\n title 'Client: Ask when checking host keys'\n desc \"Don't automatically add new hosts keys to the list of known hosts.\"\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('StrictHostKeyChecking') { should match(/ask|yes/) }\n end\nend\n", "source_location": { "line": 93, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-08", "title": "Client: Check for secure ssh ciphers", "desc": "Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)", "descriptions": [ { "label": "default", "data": "Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-08' do\n impact 1.0\n title 'Client: Check for secure ssh ciphers'\n desc 'Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('Ciphers') { should eq(ssh_crypto.valid_ciphers) }\n end\nend\n", "source_location": { "line": 102, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-09", "title": "Client: Check for secure ssh Key-Exchange Algorithm", "desc": "Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)", "descriptions": [ { "label": "default", "data": "Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-09' do\n impact 1.0\n title 'Client: Check for secure ssh Key-Exchange Algorithm'\n desc 'Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('KexAlgorithms') { should eq(ssh_crypto.valid_kexs) }\n end\nend\n", "source_location": { "line": 111, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-10", "title": "Client: Check for secure ssh Message Authentication Codes", "desc": "Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)", "descriptions": [ { "label": "default", "data": "Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-10' do\n impact 1.0\n title 'Client: Check for secure ssh Message Authentication Codes'\n desc 'Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('MACs') { should eq(ssh_crypto.valid_macs) }\n end\nend\n", "source_location": { "line": 120, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-11", "title": "Client: Disable agent forwarding", "desc": "Prevent agent forwarding by default, as it can be used in a limited way to enable attacks.", "descriptions": [ { "label": "default", "data": "Prevent agent forwarding by default, as it can be used in a limited way to enable attacks." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-11' do\n impact 1.0\n title 'Client: Disable agent forwarding'\n desc 'Prevent agent forwarding by default, as it can be used in a limited way to enable attacks.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('ForwardAgent') { should eq('no') }\n end\nend\n", "source_location": { "line": 129, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-12", "title": "Client: Disable X11Forwarding", "desc": "Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks.", "descriptions": [ { "label": "default", "data": "Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-12' do\n impact 1.0\n title 'Client: Disable X11Forwarding'\n desc 'Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('ForwardX11') { should eq('no') }\n end\nend\n", "source_location": { "line": 138, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-13", "title": "Client: Disable HostbasedAuthentication", "desc": "This option is a weak way for authentication and provide attacker more ways to enter the system.", "descriptions": [ { "label": "default", "data": "This option is a weak way for authentication and provide attacker more ways to enter the system." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-13' do\n impact 1.0\n title 'Client: Disable HostbasedAuthentication'\n desc 'This option is a weak way for authentication and provide attacker more ways to enter the system.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('HostbasedAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 147, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-14", "title": "Client: Disable rhosts-based authentication", "desc": "Avoid rhosts-based authentication, as it opens more ways for an attacker to enter a system.", "descriptions": [ { "label": "default", "data": "Avoid rhosts-based authentication, as it opens more ways for an attacker to enter a system." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-14' do\n impact 1.0\n title 'Client: Disable rhosts-based authentication'\n desc 'Avoid rhosts-based authentication, as it opens more ways for an attacker to enter a system.'\n only_if { ssh_crypto.ssh_version < 7.6 }\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('RhostsRSAAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 156, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-15", "title": "Client: Enable RSA authentication", "desc": "Make sure RSA authentication is used by default.", "descriptions": [ { "label": "default", "data": "Make sure RSA authentication is used by default." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-15' do\n impact 1.0\n title 'Client: Enable RSA authentication'\n desc 'Make sure RSA authentication is used by default.'\n only_if { ssh_crypto.ssh_version < 7.6 }\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('RSAAuthentication') { should eq('yes') }\n end\nend\n", "source_location": { "line": 166, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-16", "title": "Client: Disable password-based authentication", "desc": "Avoid password-based authentications.", "descriptions": [ { "label": "default", "data": "Avoid password-based authentications." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-16' do\n impact 1.0\n title 'Client: Disable password-based authentication'\n desc 'Avoid password-based authentications.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('PasswordAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 176, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-17", "title": "Client: Disable GSSAPIAuthentication", "desc": "If you do not use GSSAPI authentication then disable it.", "descriptions": [ { "label": "default", "data": "If you do not use GSSAPI authentication then disable it." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-17' do\n impact 1.0\n title 'Client: Disable GSSAPIAuthentication'\n desc 'If you do not use GSSAPI authentication then disable it.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('GSSAPIAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 185, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-18", "title": "Client: Disable GSSAPIDelegateCredentials", "desc": "If you do not use GSSAPI authentication then disable it.", "descriptions": [ { "label": "default", "data": "If you do not use GSSAPI authentication then disable it." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-18' do\n impact 1.0\n title 'Client: Disable GSSAPIDelegateCredentials'\n desc 'If you do not use GSSAPI authentication then disable it.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('GSSAPIDelegateCredentials') { should eq('no') }\n end\nend\n", "source_location": { "line": 194, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-19", "title": "Client: Disable tunnels", "desc": "Avoid using SSH tunnels.", "descriptions": [ { "label": "default", "data": "Avoid using SSH tunnels." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-19' do\n impact 1.0\n title 'Client: Disable tunnels'\n desc 'Avoid using SSH tunnels.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('Tunnel') { should eq('no') }\n end\nend\n", "source_location": { "line": 203, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-20", "title": "Client: Do not permit local commands", "desc": "Do not permit any local command execution.", "descriptions": [ { "label": "default", "data": "Do not permit any local command execution." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-20' do\n impact 1.0\n title 'Client: Do not permit local commands'\n desc 'Do not permit any local command execution.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('PermitLocalCommand') { should eq('no') }\n end\nend\n", "source_location": { "line": 212, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssh-21", "title": "Client: Do not allow Roaming", "desc": "Workaround for SSH Client Bug CVE-2016-0777 and CVE-2016-0778", "descriptions": [ { "label": "default", "data": "Workaround for SSH Client Bug CVE-2016-0777 and CVE-2016-0778" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-21' do\n impact 1.0\n title 'Client: Do not allow Roaming'\n desc 'Workaround for SSH Client Bug CVE-2016-0777 and CVE-2016-0778'\n only_if { ssh_crypto.ssh_version < 7.2 }\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('UseRoaming') { should eq('no') }\n end\nend\n", "source_location": { "line": 221, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-01", "title": "Server: Check for secure ssh ciphers", "desc": "Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)", "descriptions": [ { "label": "default", "data": "Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-01' do\n impact 1.0\n title 'Server: Check for secure ssh ciphers'\n desc 'Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('Ciphers') { should eq(sshd_valid_ciphers) }\n end\nend\n", "source_location": { "line": 46, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-02", "title": "Server: Check for secure ssh Key-Exchange Algorithm", "desc": "Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)", "descriptions": [ { "label": "default", "data": "Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-02' do\n impact 1.0\n title 'Server: Check for secure ssh Key-Exchange Algorithm'\n desc 'Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('KexAlgorithms') { should eq(sshd_valid_kexs) }\n end\nend\n", "source_location": { "line": 55, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-03", "title": "Server: Check for secure ssh Message Authentication Codes", "desc": "Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)", "descriptions": [ { "label": "default", "data": "Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-03' do\n impact 1.0\n title 'Server: Check for secure ssh Message Authentication Codes'\n desc 'Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('MACs') { should eq(sshd_valid_macs) }\n end\nend\n", "source_location": { "line": 64, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-04", "title": "Server: Check SSH folder owner, group and permissions.", "desc": "The SSH folder should owned by root or a defined user, only be writable by owner and readable by others.", "descriptions": [ { "label": "default", "data": "The SSH folder should owned by root or a defined user, only be writable by owner and readable by others." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-04' do\n impact 1.0\n title 'Server: Check SSH folder owner, group and permissions.'\n desc 'The SSH folder should owned by root or a defined user, only be writable by owner and readable by others.'\n describe file(sshd_custom_path) do\n it { should exist }\n it { should be_directory }\n it { should be_owned_by sshd_custom_user }\n it { should be_grouped_into os.darwin? ? 'wheel' : sshd_custom_user }\n it { should be_executable }\n it { should be_readable.by('owner') }\n it { should be_readable.by('group') }\n it { should be_readable.by('other') }\n it { should be_writable.by('owner') }\n it { should_not be_writable.by('group') }\n it { should_not be_writable.by('other') }\n end\nend\n", "source_location": { "line": 73, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-05", "title": "Server: Check sshd_config owner, group and permissions.", "desc": "The sshd_config should owned by root or a defined user, only be writable/readable by owner and not be executable.", "descriptions": [ { "label": "default", "data": "The sshd_config should owned by root or a defined user, only be writable/readable by owner and not be executable." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-05' do\n impact 1.0\n title 'Server: Check sshd_config owner, group and permissions.'\n desc 'The sshd_config should owned by root or a defined user, only be writable/readable by owner and not be executable.'\n\n describe file(sshd_custom_path + '/sshd_config') do\n it { should exist }\n it { should be_file }\n it { should be_owned_by sshd_custom_user }\n it { should be_grouped_into os.darwin? ? 'wheel' : sshd_custom_user }\n it { should_not be_executable }\n it { should be_readable.by('owner') }\n it { should_not be_readable.by('group') }\n it { should_not be_readable.by('other') }\n it { should be_writable.by('owner') }\n it { should_not be_writable.by('group') }\n it { should_not be_writable.by('other') }\n end\nend\n", "source_location": { "line": 92, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-06", "title": "Server: Do not permit root-based login or do not allow password and keyboard-interactive authentication", "desc": "Reduce the potential risk to gain full privileges access of the system because of weak password and keyboard-interactive authentication, do not allow logging in as the root user or with password authentication.", "descriptions": [ { "label": "default", "data": "Reduce the potential risk to gain full privileges access of the system because of weak password and keyboard-interactive authentication, do not allow logging in as the root user or with password authentication." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-06' do\n impact 1.0\n title 'Server: Do not permit root-based login or do not allow password and keyboard-interactive authentication'\n desc 'Reduce the potential risk to gain full privileges access of the system because of weak password and keyboard-interactive authentication, do not allow logging in as the root user or with password authentication.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PermitRootLogin') { should match(/no|without-password|prohibit-password/) }\n end\nend\n", "source_location": { "line": 112, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-07", "title": "Server: Specify the listen ssh Port", "desc": "Always specify which port the SSH server should listen to. Prevent unexpected settings.", "descriptions": [ { "label": "default", "data": "Always specify which port the SSH server should listen to. Prevent unexpected settings." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-07' do\n impact 1.0\n title 'Server: Specify the listen ssh Port'\n desc 'Always specify which port the SSH server should listen to. Prevent unexpected settings.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('Port') { should eq(sshd_custom_port) }\n end\nend\n", "source_location": { "line": 121, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-08", "title": "Server: Specify the AddressFamily to your need", "desc": "OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6.", "descriptions": [ { "label": "default", "data": "OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-08' do\n impact 1.0\n title 'Server: Specify the AddressFamily to your need'\n desc 'OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('AddressFamily') { should match(/inet|inet6|any/) }\n end\nend\n", "source_location": { "line": 130, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-09", "title": "Server: Specify ListenAddress", "desc": "Limit the SSH server to listen to a specific address. Don't let it listen on all interfaces to avoid logins from unexpected sources.", "descriptions": [ { "label": "default", "data": "Limit the SSH server to listen to a specific address. Don't let it listen on all interfaces to avoid logins from unexpected sources." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-09' do\n impact 1.0\n title 'Server: Specify ListenAddress'\n desc \"Limit the SSH server to listen to a specific address. Don't let it listen on all interfaces to avoid logins from unexpected sources.\"\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('ListenAddress') { should_not eq nil }\n its('ListenAddress') { should_not match(/^\\s*$/) }\n its('ListenAddress') { should_not eq [] }\n end\nend\n", "source_location": { "line": 139, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-10", "title": "Server: Specify protocol version 2", "desc": "Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore.", "descriptions": [ { "label": "default", "data": "Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-10' do\n impact 1.0\n title 'Server: Specify protocol version 2'\n desc \"Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore.\"\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('Protocol') { should eq('2') }\n end\nend\n", "source_location": { "line": 150, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-11", "title": "Server: Enable StrictModes", "desc": "Prevent the use of insecure home directory and key file permissions.", "descriptions": [ { "label": "default", "data": "Prevent the use of insecure home directory and key file permissions." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-11' do\n impact 1.0\n title 'Server: Enable StrictModes'\n desc 'Prevent the use of insecure home directory and key file permissions.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('StrictModes') { should eq('yes') }\n end\nend\n", "source_location": { "line": 159, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-12", "title": "Server: Specify SyslogFacility to AUTH", "desc": "Logging should be set to go to the /var/log/auth.log facility by using the SysLog AUTH parameter. This will ensure that any problems around invalid logins or the like are forwarded to a central security file for auditing purposes", "descriptions": [ { "label": "default", "data": "Logging should be set to go to the /var/log/auth.log facility by using the SysLog AUTH parameter. This will ensure that any problems around invalid logins or the like are forwarded to a central security file for auditing purposes" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-12' do\n impact 1.0\n title 'Server: Specify SyslogFacility to AUTH'\n desc 'Logging should be set to go to the /var/log/auth.log facility by using the SysLog AUTH parameter. This will ensure that any problems around invalid logins or the like are forwarded to a central security file for auditing purposes'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('SyslogFacility') { should eq('AUTH') }\n end\nend\n", "source_location": { "line": 168, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-13", "title": "Server: Specify LogLevel to VERBOSE", "desc": "Be verbose in logging, to allow analysis in case of unexpected behavior.", "descriptions": [ { "label": "default", "data": "Be verbose in logging, to allow analysis in case of unexpected behavior." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-13' do\n impact 1.0\n title 'Server: Specify LogLevel to VERBOSE'\n desc 'Be verbose in logging, to allow analysis in case of unexpected behavior.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('LogLevel') { should eq('VERBOSE') }\n end\nend\n", "source_location": { "line": 177, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-14", "title": "Server: Specify SSH HostKeys", "desc": "Specify HostKey for protection against Man-In-The-Middle Attacks", "descriptions": [ { "label": "default", "data": "Specify HostKey for protection against Man-In-The-Middle Attacks" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-14' do\n impact 1.0\n title 'Server: Specify SSH HostKeys'\n desc 'Specify HostKey for protection against Man-In-The-Middle Attacks'\n\n sshd_valid_hostkeys = ssh_crypto.valid_algorithms.map { |alg| \"#{sshd_custom_hostkeys_path}/ssh_host_#{alg}_key\" }\n sshd_valid_hostkeys = sshd_valid_hostkeys[0] if sshd_valid_hostkeys.length == 1\n\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('HostKey') { should cmp sshd_valid_hostkeys }\n end\nend\n", "source_location": { "line": 186, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-15", "title": "Server: Specify UseLogin to NO", "desc": "Disable legacy login mechanism and do not use login for interactive login sessions.", "descriptions": [ { "label": "default", "data": "Disable legacy login mechanism and do not use login for interactive login sessions." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-15' do\n impact 1.0\n title 'Server: Specify UseLogin to NO'\n desc 'Disable legacy login mechanism and do not use login for interactive login sessions.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('UseLogin') { should eq(ssh_crypto.ssh_version < 7.4 ? 'no' : nil) }\n end\nend\n", "source_location": { "line": 199, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-16", "title": "Server: Use privilege separation", "desc": "UsePrivilegeSeparation is an option, when enabled will allow the OpenSSH server to run a small (necessary) amount of code as root and the of the code in a chroot jail environment. This enables ssh to deal incoming network traffic in an unprivileged child process to avoid privilege escalation by an attacker.", "descriptions": [ { "label": "default", "data": "UsePrivilegeSeparation is an option, when enabled will allow the OpenSSH server to run a small (necessary) amount of code as root and the of the code in a chroot jail environment. This enables ssh to deal incoming network traffic in an unprivileged child process to avoid privilege escalation by an attacker." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-16' do\n impact 1.0\n title 'Server: Use privilege separation'\n desc 'UsePrivilegeSeparation is an option, when enabled will allow the OpenSSH server to run a small (necessary) amount of code as root and the of the code in a chroot jail environment. This enables ssh to deal incoming network traffic in an unprivileged child process to avoid privilege escalation by an attacker.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('UsePrivilegeSeparation') { should eq(sshd_valid_privseparation) }\n end\nend\n", "source_location": { "line": 208, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-17", "title": "Server: Disable PermitUserEnvironment", "desc": "Enabling environment processing may enable users to bypass access restrictions in some configurations using mechanisms such as LD_PRELOAD.", "descriptions": [ { "label": "default", "data": "Enabling environment processing may enable users to bypass access restrictions in some configurations using mechanisms such as LD_PRELOAD." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-17' do\n impact 1.0\n title 'Server: Disable PermitUserEnvironment'\n desc 'Enabling environment processing may enable users to bypass access restrictions in some configurations using mechanisms such as LD_PRELOAD.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PermitUserEnvironment') { should eq('no') }\n end\nend\n", "source_location": { "line": 217, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-18", "title": "Server: Specify LoginGraceTime", "desc": "The LoginGraceTime gives the user 30 seconds to accomplish a login. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon.", "descriptions": [ { "label": "default", "data": "The LoginGraceTime gives the user 30 seconds to accomplish a login. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-18' do\n impact 1.0\n title 'Server: Specify LoginGraceTime'\n desc 'The LoginGraceTime gives the user 30 seconds to accomplish a login. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('LoginGraceTime') { should eq('30s') }\n end\nend\n", "source_location": { "line": 226, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-19", "title": "Server: Specify Limit for maximum authentication retries", "desc": "The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the syslog file detailing the login failure. Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. The default is 2 but should be configured based on site policy.", "descriptions": [ { "label": "default", "data": "The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the syslog file detailing the login failure. Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. The default is 2 but should be configured based on site policy." } ], "impact": 1, "refs": [ { "url": "https://www.cisecurity.org/", "ref": "Center for Internet Security" } ], "tags": { "CIS Red Hat Enterprise Linux 7 Benchmark version 01-31-2017": "2.1.1" }, "code": "control 'sshd-19' do\n impact 1.0\n title 'Server: Specify Limit for maximum authentication retries'\n desc 'The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the syslog file detailing the login failure. Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. The default is 2 but should be configured based on site policy.'\n tag 'CIS Red Hat Enterprise Linux 7 Benchmark version 01-31-2017': '2.1.1'\n ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('MaxAuthTries') { should cmp(sshd_max_auth_tries) }\n end\nend\n", "source_location": { "line": 235, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-20", "title": "Server: Specify maximum sessions", "desc": "Specifies the maximum number of open sessions permitted per network connection. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon.", "descriptions": [ { "label": "default", "data": "Specifies the maximum number of open sessions permitted per network connection. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-20' do\n impact 1.0\n title 'Server: Specify maximum sessions'\n desc 'Specifies the maximum number of open sessions permitted per network connection. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('MaxSessions') { should eq('10') }\n end\nend\n", "source_location": { "line": 246, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-21", "title": "Server: Specify maximum startups", "desc": "Limit the number of concurrent unauthenticated sessions to prevent Denial of Service (DoS) against a running SSH daemon.", "descriptions": [ { "label": "default", "data": "Limit the number of concurrent unauthenticated sessions to prevent Denial of Service (DoS) against a running SSH daemon." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-21' do\n impact 1.0\n title 'Server: Specify maximum startups'\n desc 'Limit the number of concurrent unauthenticated sessions to prevent Denial of Service (DoS) against a running SSH daemon.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('MaxStartups') { should eq('10:30:100') }\n end\nend\n", "source_location": { "line": 255, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-22", "title": "Server: Enable PubkeyAuthentication", "desc": "Prefer public key authentication mechanisms, because other methods are weaker (e.g. passwords).", "descriptions": [ { "label": "default", "data": "Prefer public key authentication mechanisms, because other methods are weaker (e.g. passwords)." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-22' do\n impact 1.0\n title 'Server: Enable PubkeyAuthentication'\n desc 'Prefer public key authentication mechanisms, because other methods are weaker (e.g. passwords).'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PubkeyAuthentication') { should eq('yes') }\n end\nend\n", "source_location": { "line": 264, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-23", "title": "Server: Disable IgnoreRhosts", "desc": "Ignore legacy .rhosts configuration, because rhosts are a weak way to authenticate systems and provide attacker more ways to enter the system.", "descriptions": [ { "label": "default", "data": "Ignore legacy .rhosts configuration, because rhosts are a weak way to authenticate systems and provide attacker more ways to enter the system." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-23' do\n impact 1.0\n title 'Server: Disable IgnoreRhosts'\n desc 'Ignore legacy .rhosts configuration, because rhosts are a weak way to authenticate systems and provide attacker more ways to enter the system.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('IgnoreRhosts') { should eq('yes') }\n end\nend\n", "source_location": { "line": 273, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-24", "title": "Server: Enable IgnoreUserKnownHosts", "desc": "This option is a weak way for authentication and provide attacker more ways to enter the system.", "descriptions": [ { "label": "default", "data": "This option is a weak way for authentication and provide attacker more ways to enter the system." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-24' do\n impact 1.0\n title 'Server: Enable IgnoreUserKnownHosts'\n desc 'This option is a weak way for authentication and provide attacker more ways to enter the system.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('IgnoreUserKnownHosts') { should eq('yes') }\n end\nend\n", "source_location": { "line": 282, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-25", "title": "Server: Disable HostbasedAuthentication", "desc": "This option is a weak way for authentication and provide attacker more ways to enter the system.", "descriptions": [ { "label": "default", "data": "This option is a weak way for authentication and provide attacker more ways to enter the system." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-25' do\n impact 1.0\n title 'Server: Disable HostbasedAuthentication'\n desc 'This option is a weak way for authentication and provide attacker more ways to enter the system.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('HostbasedAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 291, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-27", "title": "Server: Disable password-based authentication", "desc": "Avoid password-based authentications.", "descriptions": [ { "label": "default", "data": "Avoid password-based authentications." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-27' do\n impact 1.0\n title 'Server: Disable password-based authentication'\n desc 'Avoid password-based authentications.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PasswordAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 300, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-28", "title": "Server: Disable PermitEmptyPasswords", "desc": "Accounts should be protected and users should be accountable. For this reason the usage of empty passwords should never be allowed.", "descriptions": [ { "label": "default", "data": "Accounts should be protected and users should be accountable. For this reason the usage of empty passwords should never be allowed." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-28' do\n impact 1.0\n title 'Server: Disable PermitEmptyPasswords'\n desc 'Accounts should be protected and users should be accountable. For this reason the usage of empty passwords should never be allowed.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PermitEmptyPasswords') { should eq('no') }\n end\nend\n", "source_location": { "line": 309, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-29", "title": "Server: Disable ChallengeResponseAuthentication", "desc": "Avoid challenge-response and password-based authentications.", "descriptions": [ { "label": "default", "data": "Avoid challenge-response and password-based authentications." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-29' do\n impact 1.0\n title 'Server: Disable ChallengeResponseAuthentication'\n desc 'Avoid challenge-response and password-based authentications.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('ChallengeResponseAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 318, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-30", "title": "Server: Disable Kerberos", "desc": "Avoid kerberos authentication.", "descriptions": [ { "label": "default", "data": "Avoid kerberos authentication." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-30' do\n impact 1.0\n title 'Server: Disable Kerberos'\n desc 'Avoid kerberos authentication.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('KerberosAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 327, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-31", "title": "Server: Disable Kerberos or Local Password", "desc": "Avoid kerberos authentication because it use password-based authentication as fallback.", "descriptions": [ { "label": "default", "data": "Avoid kerberos authentication because it use password-based authentication as fallback." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-31' do\n impact 1.0\n title 'Server: Disable Kerberos or Local Password'\n desc 'Avoid kerberos authentication because it use password-based authentication as fallback.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('KerberosOrLocalPasswd') { should eq('no') }\n end\nend\n", "source_location": { "line": 336, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-32", "title": "Server: Enable KerberosTicketCleanup", "desc": "Specifies whether to automatically destroy the user's ticket cache file on logout.", "descriptions": [ { "label": "default", "data": "Specifies whether to automatically destroy the user's ticket cache file on logout." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-32' do\n impact 1.0\n title 'Server: Enable KerberosTicketCleanup'\n desc \"Specifies whether to automatically destroy the user's ticket cache file on logout.\"\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('KerberosTicketCleanup') { should eq('yes') }\n end\nend\n", "source_location": { "line": 345, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-33", "title": "Server: Disable GSSAPIAuthentication", "desc": "If you do not use GSSAPI authentication then disable it.", "descriptions": [ { "label": "default", "data": "If you do not use GSSAPI authentication then disable it." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-33' do\n impact 1.0\n title 'Server: Disable GSSAPIAuthentication'\n desc 'If you do not use GSSAPI authentication then disable it.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('GSSAPIAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 354, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-34", "title": "Server: Enable GSSAPICleanupCredentials", "desc": "Automatically destroy the user's credentials cache on logout.", "descriptions": [ { "label": "default", "data": "Automatically destroy the user's credentials cache on logout." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-34' do\n impact 1.0\n title 'Server: Enable GSSAPICleanupCredentials'\n desc \"Automatically destroy the user's credentials cache on logout.\"\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('GSSAPICleanupCredentials') { should eq('yes') }\n end\nend\n", "source_location": { "line": 363, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-35", "title": "Server: Disable TCPKeepAlive", "desc": "Avoid the TCPKeepAlive messages to see if the client is still alive, because they are sent over unencrypted connection and are spoofable.", "descriptions": [ { "label": "default", "data": "Avoid the TCPKeepAlive messages to see if the client is still alive, because they are sent over unencrypted connection and are spoofable." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-35' do\n impact 1.0\n title 'Server: Disable TCPKeepAlive'\n desc 'Avoid the TCPKeepAlive messages to see if the client is still alive, because they are sent over unencrypted connection and are spoofable.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('TCPKeepAlive') { should eq('no') }\n end\nend\n", "source_location": { "line": 372, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-36", "title": "Server: Set a client alive interval", "desc": "ClientAlive messages are sent over encrypted connection and are not spoofable.", "descriptions": [ { "label": "default", "data": "ClientAlive messages are sent over encrypted connection and are not spoofable." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-36' do\n impact 1.0\n title 'Server: Set a client alive interval'\n desc 'ClientAlive messages are sent over encrypted connection and are not spoofable.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('ClientAliveInterval') { should eq('300') }\n end\nend\n", "source_location": { "line": 381, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-37", "title": "Server: Configure a few client alive counters", "desc": "This indicates the total number of checkalive message sent by the ssh server without getting any response from the ssh client. ClientAlive messages are sent over encrypted connection and are not spoofable.", "descriptions": [ { "label": "default", "data": "This indicates the total number of checkalive message sent by the ssh server without getting any response from the ssh client. ClientAlive messages are sent over encrypted connection and are not spoofable." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-37' do\n impact 1.0\n title 'Server: Configure a few client alive counters'\n desc 'This indicates the total number of checkalive message sent by the ssh server without getting any response from the ssh client. ClientAlive messages are sent over encrypted connection and are not spoofable.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('ClientAliveCountMax') { should eq('3') }\n end\nend\n", "source_location": { "line": 390, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-38", "title": "Server: Disable tunnels", "desc": "Avoid to use tunnels.", "descriptions": [ { "label": "default", "data": "Avoid to use tunnels." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-38' do\n impact 1.0\n title 'Server: Disable tunnels'\n desc 'Avoid to use tunnels.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PermitTunnel') { should eq(sshd_permittunnel) }\n end\nend\n", "source_location": { "line": 399, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-39", "title": "Server: Disable TCP forwarding", "desc": "If you use TCP forwarding in an uncontrolled manner then you can bypass the firewalls", "descriptions": [ { "label": "default", "data": "If you use TCP forwarding in an uncontrolled manner then you can bypass the firewalls" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-39' do\n impact 1.0\n title 'Server: Disable TCP forwarding'\n desc 'If you use TCP forwarding in an uncontrolled manner then you can bypass the firewalls'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('AllowTcpForwarding') { should eq(sshd_tcpforwarding) }\n end\nend\n", "source_location": { "line": 408, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-40", "title": "Server: Disable Agent forwarding", "desc": "Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.", "descriptions": [ { "label": "default", "data": "Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-40' do\n impact 1.0\n title 'Server: Disable Agent forwarding'\n desc \"Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.\"\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('AllowAgentForwarding') { should eq(sshd_agentforwarding) }\n end\nend\n", "source_location": { "line": 417, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-41", "title": "Server: Disable gateway ports", "desc": "Prevent remote hosts from connecting to forwarded ports on the node.", "descriptions": [ { "label": "default", "data": "Prevent remote hosts from connecting to forwarded ports on the node." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-41' do\n impact 1.0\n title 'Server: Disable gateway ports'\n desc 'Prevent remote hosts from connecting to forwarded ports on the node.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('GatewayPorts') { should eq(sshd_gatewayports) }\n end\nend\n", "source_location": { "line": 426, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-42", "title": "Server: Disable X11Forwarding", "desc": "Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks.", "descriptions": [ { "label": "default", "data": "Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-42' do\n impact 1.0\n title 'Server: Disable X11Forwarding'\n desc 'Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('X11Forwarding') { should eq(sshd_x11forwarding) }\n end\nend\n", "source_location": { "line": 435, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-43", "title": "Server: Enable X11UseLocalhost", "desc": "SSH daemon should bind the X11 forwarding server to the loopback address. This prevents remote hosts from connecting to the proxy display and reduce the attack surface", "descriptions": [ { "label": "default", "data": "SSH daemon should bind the X11 forwarding server to the loopback address. This prevents remote hosts from connecting to the proxy display and reduce the attack surface" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-43' do\n impact 1.0\n title 'Server: Enable X11UseLocalhost'\n desc 'SSH daemon should bind the X11 forwarding server to the loopback address. This prevents remote hosts from connecting to the proxy display and reduce the attack surface'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('X11UseLocalhost') { should eq('yes') }\n end\nend\n", "source_location": { "line": 444, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-44", "title": "Server: Disable PrintMotd", "desc": "This specifies that the SSH daemon itself should not read and display the message of the day file.", "descriptions": [ { "label": "default", "data": "This specifies that the SSH daemon itself should not read and display the message of the day file." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-44' do\n impact 1.0\n title 'Server: Disable PrintMotd'\n desc 'This specifies that the SSH daemon itself should not read and display the message of the day file.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PrintMotd') { should eq('no') }\n end\nend\n", "source_location": { "line": 453, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-45", "title": "Server: PrintLastLog", "desc": "This tells the SSH daemon to print out information about the last time you logged in.", "descriptions": [ { "label": "default", "data": "This tells the SSH daemon to print out information about the last time you logged in." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-45' do\n impact 1.0\n title 'Server: PrintLastLog'\n desc 'This tells the SSH daemon to print out information about the last time you logged in.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PrintLastLog') { should eq('no') }\n end\nend\n", "source_location": { "line": 462, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-46", "title": "Server: Banner", "desc": "Specifies a banner file to serve before authentication succeeds", "descriptions": [ { "label": "default", "data": "Specifies a banner file to serve before authentication succeeds" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-46' do\n impact 1.0\n title 'Server: Banner'\n desc 'Specifies a banner file to serve before authentication succeeds'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('Banner') { should eq(sshd_banner) }\n end\nend\n", "source_location": { "line": 471, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-47", "title": "Server: DebianBanner", "desc": "Specifies whether to include OS distribution in version information", "descriptions": [ { "label": "default", "data": "Specifies whether to include OS distribution in version information" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-47' do\n impact 1.0\n title 'Server: DebianBanner'\n desc 'Specifies whether to include OS distribution in version information'\n case os[:family]\n when 'debian' then\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('DebianBanner') { should eq('no') }\n end\n else\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('content') { should_not match(/DebianBanner/) }\n end\n end\nend\n", "source_location": { "line": 480, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "sshd-48", "title": "Server: DH primes", "desc": "Verifies if strong DH primes are used in /etc/ssh/moduli", "descriptions": [ { "label": "default", "data": "Verifies if strong DH primes are used in /etc/ssh/moduli" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-48' do\n impact 1.0\n title 'Server: DH primes'\n desc 'Verifies if strong DH primes are used in /etc/ssh/moduli'\n describe bash(\"test $(awk '$5 < 2047 && $5 ~ /^[0-9]+$/ { print $5 }' #{sshd_custom_path}/moduli | uniq | wc -c) -eq 0\") do\n its('exit_status') { should eq 0 }\n its('stdout') { should eq '' }\n its('stderr') { should eq '' }\n end\nend\n", "source_location": { "line": 496, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [] }, { "id": "debugging", "title": "Inspec::Version=4.19.2", "desc": null, "descriptions": [], "impact": 0, "refs": [], "tags": {}, "code": "control 'debugging' do\n title \"Inspec::Version=#{Inspec::VERSION}\"\n impact 0.0\n describe \"tcpports=\\n#{tcpports.join(\"\\n\")}\" do\n it { should_not eq nil }\n end\n describe \"sslports=\\n#{sslports.join(\"\\n\")}\" do\n it { should_not eq nil }\n end\nend\n", "source_location": { "line": 74, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssl2", "title": "Disable SSL 2 from all exposed SSL ports.", "desc": null, "descriptions": [], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssl2' do\n title 'Disable SSL 2 from all exposed SSL ports.'\n impact 1.0\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).protocols('ssl2') do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 90, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "ssl3", "title": "Disable SSL 3 from all exposed SSL ports.", "desc": null, "descriptions": [], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssl3' do\n title 'Disable SSL 3 from all exposed SSL ports.'\n impact 1.0\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).protocols('ssl3') do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 105, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "tls1.0", "title": "Disable TLS 1.0 on exposed ports.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'tls1.0' do\n title 'Disable TLS 1.0 on exposed ports.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).protocols('tls1.0') do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 120, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "tls1.1", "title": "Disable TLS 1.1 on exposed ports.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'tls1.1' do\n title 'Disable TLS 1.1 on exposed ports.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).protocols('tls1.1') do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 135, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "tls1.2", "title": "Enable TLS 1.2 on exposed ports.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'tls1.2' do\n title 'Enable TLS 1.2 on exposed ports.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).protocols('tls1.2') do\n it(proc_desc) { should be_enabled }\n it { should be_enabled }\n end\n end\nend\n", "source_location": { "line": 150, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "kx-ecdh", "title": "Enable ECDH as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-ecdh' do\n title 'Enable ECDH as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_ECDH/i) do\n it(proc_desc) { should be_enabled }\n it { should be_enabled }\n end\n end\nend\n", "source_location": { "line": 169, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "kx-rsa", "title": "Disable RSA as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-rsa' do\n title 'Disable RSA as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_RSA/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 184, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "kx-dh", "title": "Disable DH as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-dh' do\n title 'Disable DH as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_DH/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 199, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "kx-krb5", "title": "Disable KRB5 as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-krb5' do\n title 'Disable KRB5 as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_KRB5/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 214, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "kx-psk", "title": "Disable PSK as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-psk' do\n title 'Disable PSK as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_PSK/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 229, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "kx-gostr", "title": "Disable GOSTR as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-gostr' do\n title 'Disable GOSTR as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_GOSTR/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 244, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "kx-srp", "title": "Disable SRP as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-srp' do\n title 'Disable SRP as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_SRP/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 259, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "au-ecdsa-rsa", "title": "Enable ECDSA or RSA as AU from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'au-ecdsa-rsa' do\n title 'Enable ECDSA or RSA as AU from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/(RSA|ECDSA)_WITH/i) do\n it(proc_desc) { should be_enabled }\n it { should be_enabled }\n end\n end\nend\n", "source_location": { "line": 279, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "au-anon", "title": "Disable ANON as AU from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'au-anon' do\n title 'Disable ANON as AU from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/ANON_WITH/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 294, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "au-dss", "title": "Disable DSS as AU from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'au-dss' do\n title 'Disable DSS as AU from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/DSS_WITH/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 309, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "au-psk", "title": "Disable PSK as AU from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'au-psk' do\n title 'Disable PSK as AU from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/PSK_WITH/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 324, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "au-export", "title": "Disable EXPORT as AU from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'au-export' do\n title 'Disable EXPORT as AU from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/((EXPORT)(\\d*)_WITH)/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 339, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "enc-aes-gcm-chacha20", "title": "Enable AES256 or AES128 or AES256-GCM or AES128-GCM or CHACHA20 as Enc", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-aes-gcm-chacha20' do\n title 'Enable AES256 or AES128 or AES256-GCM or AES128-GCM or CHACHA20 as Enc'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_(AES_256|AES_128|CHACHA20|AES_256_GCM|AES_128_GCM)/i) do\n it(proc_desc) { should be_enabled }\n it { should be_enabled }\n end\n end\nend\n", "source_location": { "line": 360, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "enc-cbc", "title": "Disable CBC as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-cbc' do\n title 'Disable CBC as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/(WITH_(\\w+)_(CBC))/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 375, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "enc-rc4", "title": "Disable RC4 as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-rc4' do\n title 'Disable RC4 as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_RC4/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 390, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "enc-export", "title": "Disable EXPORT as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-export' do\n title 'Disable EXPORT as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_EXPORT/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 405, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "enc-des", "title": "Disable DES, 3DES as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-des' do\n title 'Disable DES, 3DES as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/(WITH_(\\d*)(des))/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 420, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "enc-enull", "title": "Disable eNULL as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-enull' do\n title 'Disable eNULL as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_NULL/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 435, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "enc-camellia", "title": "Disable CAMELLIA as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-camellia' do\n title 'Disable CAMELLIA as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_CAMELLIA/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 450, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "enc-seed", "title": "Disable SEED as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-seed' do\n title 'Disable SEED as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_SEED/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 465, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "enc-idea", "title": "Disable IDEA as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-idea' do\n title 'Disable IDEA as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_IDEA/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 480, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "enc-aes-ccm", "title": "Disable AES-CCM from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-aes-ccm' do\n title 'Disable AES-CCM from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/(WITH_AES_(\\w+)_(CCM))/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 495, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "mac-sha384-sha256-poly1305", "title": "Enable SHA384 or SHA256 or POLY1305 as Mac from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'mac-sha384-sha256-poly1305' do\n title 'Enable SHA384 or SHA256 or POLY1305 as Mac from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/_(SHA384|SHA256|POLY1305)$/i) do\n it(proc_desc) { should be_enabled }\n it { should be_enabled }\n end\n end\nend\n", "source_location": { "line": 515, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "mac-md5", "title": "Disable MD5 Mac from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'mac-md5' do\n title 'Disable MD5 Mac from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/_MD5$/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 530, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "mac-sha", "title": "Disable SHA(1) Mac from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'mac-sha' do\n title 'Disable SHA(1) Mac from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/_SHA$/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 545, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "mac-null", "title": "Disable NULL Mac from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'mac-null' do\n title 'Disable NULL Mac from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/_NULL$/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 560, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] }, { "id": "robotattack", "title": "Return Of Bleichenbacher's Oracle Threat", "desc": "ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server.", "descriptions": [ { "label": "default", "data": "ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server." } ], "impact": 0.5, "refs": [ { "url": "https://ia.cr/2017/1189", "ref": "Paper: Return Of Bleichenbacher's Oracle Threat (ROBOT)" } ], "tags": { "sslattack": null, "tlsattack": null }, "code": "control 'robotattack' do\n title \"Return Of Bleichenbacher's Oracle Threat\"\n desc 'ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server.'\n ref \"Paper: Return Of Bleichenbacher's Oracle Threat (ROBOT)\", url: 'https://ia.cr/2017/1189'\n tag 'sslattack', 'tlsattack'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_RSA/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 575, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [] } ], "status": "loaded" }, { "name": "ssh-baseline", "version": "2.5.9", "sha256": "9711876ce056d66d542014dba4ce21921d7e5a13b5487f985694da27b2b3f21b", "title": "DevSec SSH Baseline", "maintainer": "DevSec Hardening Framework Team", "summary": "Test-suite for best-practice SSH hardening", "license": "Apache-2.0", "copyright": "DevSec Hardening Framework Team", "copyright_email": "hello@dev-sec.io", "supports": [ { "platform-family": "unix" } ], "attributes": [ { "name": "ssh_custom_user", "options": { "value": "root" } }, { "name": "ssh_custom_path", "options": { "value": "/etc/ssh" } }, { "name": "sshd_valid_ciphers", "options": { "value": "aes256-ctr,aes192-ctr,aes128-ctr" } }, { "name": "sshd_valid_kexs", "options": { "value": "diffie-hellman-group-exchange-sha256" } }, { "name": "sshd_valid_macs", "options": { "value": "hmac-sha2-512,hmac-sha2-256,hmac-ripemd160" } }, { "name": "sshd_permittunnel", "options": { "value": "no" } }, { "name": "sshd_tcpforwarding", "options": { "value": "no" } }, { "name": "sshd_agentforwarding", "options": { "value": "no" } }, { "name": "sshd_gatewayports", "options": { "value": "no" } }, { "name": "sshd_x11forwarding", "options": { "value": "no" } }, { "name": "sshd_banner", "options": { "value": "none" } }, { "name": "sshd_max_auth_tries", "options": { "value": 2 } }, { "name": "sshd_custom_user", "options": { "value": "root" } }, { "name": "sshd_custom_path", "options": { "value": "/etc/ssh" } }, { "name": "sshd_custom_port", "options": { "value": "22" } }, { "name": "sshd_custom_hostkeys_path", "options": { "value": "/etc/ssh" } } ], "parent_profile": "acme-inspec-profile", "groups": [ { "id": "controls/ssh_spec.rb", "controls": [ "ssh-01", "ssh-02", "ssh-03", "ssh-04", "ssh-05", "ssh-06", "ssh-07", "ssh-08", "ssh-09", "ssh-10", "ssh-11", "ssh-12", "ssh-13", "ssh-14", "ssh-15", "ssh-16", "ssh-17", "ssh-18", "ssh-19", "ssh-20", "ssh-21" ], "title": "SSH client config" }, { "id": "controls/sshd_spec.rb", "controls": [ "sshd-01", "sshd-02", "sshd-03", "sshd-04", "sshd-05", "sshd-06", "sshd-07", "sshd-08", "sshd-09", "sshd-10", "sshd-11", "sshd-12", "sshd-13", "sshd-14", "sshd-15", "sshd-16", "sshd-17", "sshd-18", "sshd-19", "sshd-20", "sshd-21", "sshd-22", "sshd-23", "sshd-24", "sshd-25", "sshd-27", "sshd-28", "sshd-29", "sshd-30", "sshd-31", "sshd-32", "sshd-33", "sshd-34", "sshd-35", "sshd-36", "sshd-37", "sshd-38", "sshd-39", "sshd-40", "sshd-41", "sshd-42", "sshd-43", "sshd-44", "sshd-45", "sshd-46", "sshd-47", "sshd-48" ], "title": "SSH server config" } ], "controls": [ { "id": "ssh-01", "title": "client: Check ssh_config owner, group and permissions.", "desc": "The ssh_config should owned by root or a specified user, only be writable by owner and readable to all.", "descriptions": [ { "label": "default", "data": "The ssh_config should owned by root or a specified user, only be writable by owner and readable to all." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-01' do\n impact 1.0\n title 'client: Check ssh_config owner, group and permissions.'\n desc 'The ssh_config should owned by root or a specified user, only be writable by owner and readable to all.'\n\n describe file(ssh_custom_path + '/ssh_config') do\n it { should exist }\n it { should be_file }\n it { should be_owned_by ssh_custom_user }\n it { should be_grouped_into os.darwin? ? 'wheel' : ssh_custom_user }\n it { should_not be_executable }\n it { should be_readable.by('owner') }\n it { should be_readable.by('group') }\n it { should be_readable.by('other') }\n it { should be_writable.by('owner') }\n it { should_not be_writable.by('group') }\n it { should_not be_writable.by('other') }\n end\nend\n", "source_location": { "line": 28, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected to exist", "run_time": 0.001924, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected to be file", "run_time": 0.072301, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected to be owned by \"root\"", "run_time": 0.1088, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected to be grouped into \"wheel\"", "run_time": 0.072288, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected not to be executable", "run_time": 0.000346, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected to be readable by owner", "run_time": 0.000161, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected to be readable by group", "run_time": 0.000132, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected to be readable by other", "run_time": 0.00014, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected to be writable by owner", "run_time": 0.000129, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected not to be writable by group", "run_time": 0.000127, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/ssh_config is expected not to be writable by other", "run_time": 0.000143, "start_time": "2020-07-06T17:54:48-04:00" } ] }, { "id": "ssh-02", "title": "Client: Specify the AddressFamily to your need", "desc": "OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6.", "descriptions": [ { "label": "default", "data": "OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-02' do\n impact 1.0\n title 'Client: Specify the AddressFamily to your need'\n desc 'OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('AddressFamily') { should match(/inet|inet6|any/) }\n end\nend\n", "source_location": { "line": 48, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration AddressFamily is expected to match /inet|inet6|any/", "run_time": 0.017692, "start_time": "2020-07-06T17:54:48-04:00", "message": "expected nil to match /inet|inet6|any/" } ] }, { "id": "ssh-03", "title": "Client: Specify expected ssh port", "desc": "Always specify which port the SSH client should connect. Prevent unexpected settings.", "descriptions": [ { "label": "default", "data": "Always specify which port the SSH client should connect. Prevent unexpected settings." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-03' do\n impact 1.0\n title 'Client: Specify expected ssh port'\n desc 'Always specify which port the SSH client should connect. Prevent unexpected settings.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('Port') { should eq('22') }\n end\nend\n", "source_location": { "line": 57, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration Port is expected to eq \"22\"", "run_time": 0.001996, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"22\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-04", "title": "Client: Specify protocol version 2", "desc": "Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore.", "descriptions": [ { "label": "default", "data": "Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-04' do\n impact 1.0\n title 'Client: Specify protocol version 2'\n desc \"Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore.\"\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('Protocol') { should eq('2') }\n end\nend\n", "source_location": { "line": 66, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration Protocol is expected to eq \"2\"", "run_time": 0.000356, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"2\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-05", "title": "Client: Disable batch mode", "desc": "Avoid batch mode in the default configuration.", "descriptions": [ { "label": "default", "data": "Avoid batch mode in the default configuration." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-05' do\n impact 1.0\n title 'Client: Disable batch mode'\n desc 'Avoid batch mode in the default configuration.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('BatchMode') { should eq('no') }\n end\nend\n", "source_location": { "line": 75, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration BatchMode is expected to eq \"no\"", "run_time": 0.000338, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-06", "title": "Client: Check Host IPs", "desc": "Make sure that SSH checks the host IP address in the known_hosts file, to avoid DNS spoofing effects.", "descriptions": [ { "label": "default", "data": "Make sure that SSH checks the host IP address in the known_hosts file, to avoid DNS spoofing effects." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-06' do\n impact 1.0\n title 'Client: Check Host IPs'\n desc 'Make sure that SSH checks the host IP address in the known_hosts file, to avoid DNS spoofing effects.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('CheckHostIP') { should eq('yes') }\n end\nend\n", "source_location": { "line": 84, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration CheckHostIP is expected to eq \"yes\"", "run_time": 0.000352, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"yes\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-07", "title": "Client: Ask when checking host keys", "desc": "Don't automatically add new hosts keys to the list of known hosts.", "descriptions": [ { "label": "default", "data": "Don't automatically add new hosts keys to the list of known hosts." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-07' do\n impact 1.0\n title 'Client: Ask when checking host keys'\n desc \"Don't automatically add new hosts keys to the list of known hosts.\"\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('StrictHostKeyChecking') { should match(/ask|yes/) }\n end\nend\n", "source_location": { "line": 93, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration StrictHostKeyChecking is expected to match /ask|yes/", "run_time": 0.000442, "start_time": "2020-07-06T17:54:48-04:00", "message": "expected nil to match /ask|yes/" } ] }, { "id": "ssh-08", "title": "Client: Check for secure ssh ciphers", "desc": "Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)", "descriptions": [ { "label": "default", "data": "Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-08' do\n impact 1.0\n title 'Client: Check for secure ssh ciphers'\n desc 'Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('Ciphers') { should eq(ssh_crypto.valid_ciphers) }\n end\nend\n", "source_location": { "line": 102, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration Ciphers is expected to eq \"aes256-ctr,aes192-ctr,aes128-ctr\"", "run_time": 0.000475, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"aes256-ctr,aes192-ctr,aes128-ctr\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-09", "title": "Client: Check for secure ssh Key-Exchange Algorithm", "desc": "Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)", "descriptions": [ { "label": "default", "data": "Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-09' do\n impact 1.0\n title 'Client: Check for secure ssh Key-Exchange Algorithm'\n desc 'Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('KexAlgorithms') { should eq(ssh_crypto.valid_kexs) }\n end\nend\n", "source_location": { "line": 111, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration KexAlgorithms is expected to eq \"diffie-hellman-group-exchange-sha256\"", "run_time": 0.000488, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"diffie-hellman-group-exchange-sha256\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-10", "title": "Client: Check for secure ssh Message Authentication Codes", "desc": "Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)", "descriptions": [ { "label": "default", "data": "Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-10' do\n impact 1.0\n title 'Client: Check for secure ssh Message Authentication Codes'\n desc 'Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('MACs') { should eq(ssh_crypto.valid_macs) }\n end\nend\n", "source_location": { "line": 120, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration MACs is expected to eq \"hmac-sha2-512,hmac-sha2-256,hmac-ripemd160\"", "run_time": 0.000534, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"hmac-sha2-512,hmac-sha2-256,hmac-ripemd160\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-11", "title": "Client: Disable agent forwarding", "desc": "Prevent agent forwarding by default, as it can be used in a limited way to enable attacks.", "descriptions": [ { "label": "default", "data": "Prevent agent forwarding by default, as it can be used in a limited way to enable attacks." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-11' do\n impact 1.0\n title 'Client: Disable agent forwarding'\n desc 'Prevent agent forwarding by default, as it can be used in a limited way to enable attacks.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('ForwardAgent') { should eq('no') }\n end\nend\n", "source_location": { "line": 129, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration ForwardAgent is expected to eq \"no\"", "run_time": 0.000456, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-12", "title": "Client: Disable X11Forwarding", "desc": "Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks.", "descriptions": [ { "label": "default", "data": "Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-12' do\n impact 1.0\n title 'Client: Disable X11Forwarding'\n desc 'Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('ForwardX11') { should eq('no') }\n end\nend\n", "source_location": { "line": 138, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration ForwardX11 is expected to eq \"no\"", "run_time": 0.000397, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-13", "title": "Client: Disable HostbasedAuthentication", "desc": "This option is a weak way for authentication and provide attacker more ways to enter the system.", "descriptions": [ { "label": "default", "data": "This option is a weak way for authentication and provide attacker more ways to enter the system." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-13' do\n impact 1.0\n title 'Client: Disable HostbasedAuthentication'\n desc 'This option is a weak way for authentication and provide attacker more ways to enter the system.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('HostbasedAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 147, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration HostbasedAuthentication is expected to eq \"no\"", "run_time": 0.000376, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-14", "title": "Client: Disable rhosts-based authentication", "desc": "Avoid rhosts-based authentication, as it opens more ways for an attacker to enter a system.", "descriptions": [ { "label": "default", "data": "Avoid rhosts-based authentication, as it opens more ways for an attacker to enter a system." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-14' do\n impact 1.0\n title 'Client: Disable rhosts-based authentication'\n desc 'Avoid rhosts-based authentication, as it opens more ways for an attacker to enter a system.'\n only_if { ssh_crypto.ssh_version < 7.6 }\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('RhostsRSAAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 156, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 1.8e-05, "start_time": "2020-07-06T17:54:48-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "ssh-15", "title": "Client: Enable RSA authentication", "desc": "Make sure RSA authentication is used by default.", "descriptions": [ { "label": "default", "data": "Make sure RSA authentication is used by default." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-15' do\n impact 1.0\n title 'Client: Enable RSA authentication'\n desc 'Make sure RSA authentication is used by default.'\n only_if { ssh_crypto.ssh_version < 7.6 }\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('RSAAuthentication') { should eq('yes') }\n end\nend\n", "source_location": { "line": 166, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:48-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "ssh-16", "title": "Client: Disable password-based authentication", "desc": "Avoid password-based authentications.", "descriptions": [ { "label": "default", "data": "Avoid password-based authentications." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-16' do\n impact 1.0\n title 'Client: Disable password-based authentication'\n desc 'Avoid password-based authentications.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('PasswordAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 176, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration PasswordAuthentication is expected to eq \"no\"", "run_time": 0.000363, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-17", "title": "Client: Disable GSSAPIAuthentication", "desc": "If you do not use GSSAPI authentication then disable it.", "descriptions": [ { "label": "default", "data": "If you do not use GSSAPI authentication then disable it." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-17' do\n impact 1.0\n title 'Client: Disable GSSAPIAuthentication'\n desc 'If you do not use GSSAPI authentication then disable it.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('GSSAPIAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 185, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration GSSAPIAuthentication is expected to eq \"no\"", "run_time": 0.000341, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-18", "title": "Client: Disable GSSAPIDelegateCredentials", "desc": "If you do not use GSSAPI authentication then disable it.", "descriptions": [ { "label": "default", "data": "If you do not use GSSAPI authentication then disable it." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-18' do\n impact 1.0\n title 'Client: Disable GSSAPIDelegateCredentials'\n desc 'If you do not use GSSAPI authentication then disable it.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('GSSAPIDelegateCredentials') { should eq('no') }\n end\nend\n", "source_location": { "line": 194, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration GSSAPIDelegateCredentials is expected to eq \"no\"", "run_time": 0.000359, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-19", "title": "Client: Disable tunnels", "desc": "Avoid using SSH tunnels.", "descriptions": [ { "label": "default", "data": "Avoid using SSH tunnels." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-19' do\n impact 1.0\n title 'Client: Disable tunnels'\n desc 'Avoid using SSH tunnels.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('Tunnel') { should eq('no') }\n end\nend\n", "source_location": { "line": 203, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration Tunnel is expected to eq \"no\"", "run_time": 0.000457, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-20", "title": "Client: Do not permit local commands", "desc": "Do not permit any local command execution.", "descriptions": [ { "label": "default", "data": "Do not permit any local command execution." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-20' do\n impact 1.0\n title 'Client: Do not permit local commands'\n desc 'Do not permit any local command execution.'\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('PermitLocalCommand') { should eq('no') }\n end\nend\n", "source_location": { "line": 212, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSH Configuration PermitLocalCommand is expected to eq \"no\"", "run_time": 0.000358, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "ssh-21", "title": "Client: Do not allow Roaming", "desc": "Workaround for SSH Client Bug CVE-2016-0777 and CVE-2016-0778", "descriptions": [ { "label": "default", "data": "Workaround for SSH Client Bug CVE-2016-0777 and CVE-2016-0778" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssh-21' do\n impact 1.0\n title 'Client: Do not allow Roaming'\n desc 'Workaround for SSH Client Bug CVE-2016-0777 and CVE-2016-0778'\n only_if { ssh_crypto.ssh_version < 7.2 }\n describe ssh_config(ssh_custom_path + '/ssh_config') do\n its('UseRoaming') { should eq('no') }\n end\nend\n", "source_location": { "line": 221, "ref": "ssh-baseline-master/controls/ssh_spec.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 8e-06, "start_time": "2020-07-06T17:54:48-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "sshd-01", "title": "Server: Check for secure ssh ciphers", "desc": "Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)", "descriptions": [ { "label": "default", "data": "Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-01' do\n impact 1.0\n title 'Server: Check for secure ssh ciphers'\n desc 'Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('Ciphers') { should eq(sshd_valid_ciphers) }\n end\nend\n", "source_location": { "line": 46, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration Ciphers is expected to eq \"aes256-ctr,aes192-ctr,aes128-ctr\"", "run_time": 0.000655, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"aes256-ctr,aes192-ctr,aes128-ctr\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-02", "title": "Server: Check for secure ssh Key-Exchange Algorithm", "desc": "Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)", "descriptions": [ { "label": "default", "data": "Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-02' do\n impact 1.0\n title 'Server: Check for secure ssh Key-Exchange Algorithm'\n desc 'Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('KexAlgorithms') { should eq(sshd_valid_kexs) }\n end\nend\n", "source_location": { "line": 55, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration KexAlgorithms is expected to eq \"diffie-hellman-group-exchange-sha256\"", "run_time": 0.000634, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"diffie-hellman-group-exchange-sha256\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-03", "title": "Server: Check for secure ssh Message Authentication Codes", "desc": "Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)", "descriptions": [ { "label": "default", "data": "Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-03' do\n impact 1.0\n title 'Server: Check for secure ssh Message Authentication Codes'\n desc 'Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('MACs') { should eq(sshd_valid_macs) }\n end\nend\n", "source_location": { "line": 64, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration MACs is expected to eq \"hmac-sha2-512,hmac-sha2-256,hmac-ripemd160\"", "run_time": 0.000634, "start_time": "2020-07-06T17:54:48-04:00", "message": "\nexpected: \"hmac-sha2-512,hmac-sha2-256,hmac-ripemd160\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-04", "title": "Server: Check SSH folder owner, group and permissions.", "desc": "The SSH folder should owned by root or a defined user, only be writable by owner and readable by others.", "descriptions": [ { "label": "default", "data": "The SSH folder should owned by root or a defined user, only be writable by owner and readable by others." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-04' do\n impact 1.0\n title 'Server: Check SSH folder owner, group and permissions.'\n desc 'The SSH folder should owned by root or a defined user, only be writable by owner and readable by others.'\n describe file(sshd_custom_path) do\n it { should exist }\n it { should be_directory }\n it { should be_owned_by sshd_custom_user }\n it { should be_grouped_into os.darwin? ? 'wheel' : sshd_custom_user }\n it { should be_executable }\n it { should be_readable.by('owner') }\n it { should be_readable.by('group') }\n it { should be_readable.by('other') }\n it { should be_writable.by('owner') }\n it { should_not be_writable.by('group') }\n it { should_not be_writable.by('other') }\n end\nend\n", "source_location": { "line": 73, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "passed", "code_desc": "File /etc/ssh is expected to exist", "run_time": 0.000258, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh is expected to be directory", "run_time": 0.104896, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh is expected to be owned by \"root\"", "run_time": 0.036472, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh is expected to be grouped into \"wheel\"", "run_time": 0.00709, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh is expected to be executable", "run_time": 0.000412, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh is expected to be readable by owner", "run_time": 0.000246, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh is expected to be readable by group", "run_time": 0.000201, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh is expected to be readable by other", "run_time": 0.000284, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh is expected to be writable by owner", "run_time": 0.000213, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh is expected not to be writable by group", "run_time": 0.000227, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh is expected not to be writable by other", "run_time": 0.000199, "start_time": "2020-07-06T17:54:48-04:00" } ] }, { "id": "sshd-05", "title": "Server: Check sshd_config owner, group and permissions.", "desc": "The sshd_config should owned by root or a defined user, only be writable/readable by owner and not be executable.", "descriptions": [ { "label": "default", "data": "The sshd_config should owned by root or a defined user, only be writable/readable by owner and not be executable." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-05' do\n impact 1.0\n title 'Server: Check sshd_config owner, group and permissions.'\n desc 'The sshd_config should owned by root or a defined user, only be writable/readable by owner and not be executable.'\n\n describe file(sshd_custom_path + '/sshd_config') do\n it { should exist }\n it { should be_file }\n it { should be_owned_by sshd_custom_user }\n it { should be_grouped_into os.darwin? ? 'wheel' : sshd_custom_user }\n it { should_not be_executable }\n it { should be_readable.by('owner') }\n it { should_not be_readable.by('group') }\n it { should_not be_readable.by('other') }\n it { should be_writable.by('owner') }\n it { should_not be_writable.by('group') }\n it { should_not be_writable.by('other') }\n end\nend\n", "source_location": { "line": 92, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "passed", "code_desc": "File /etc/ssh/sshd_config is expected to exist", "run_time": 0.000164, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/sshd_config is expected to be file", "run_time": 0.006094, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/sshd_config is expected to be owned by \"root\"", "run_time": 0.035865, "start_time": "2020-07-06T17:54:48-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/sshd_config is expected to be grouped into \"wheel\"", "run_time": 0.007643, "start_time": "2020-07-06T17:54:49-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/sshd_config is expected not to be executable", "run_time": 0.000298, "start_time": "2020-07-06T17:54:49-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/sshd_config is expected to be readable by owner", "run_time": 0.000177, "start_time": "2020-07-06T17:54:49-04:00" }, { "status": "failed", "code_desc": "File /etc/ssh/sshd_config is expected not to be readable by group", "run_time": 0.000247, "start_time": "2020-07-06T17:54:49-04:00", "message": "expected File /etc/ssh/sshd_config not to be readable by group" }, { "status": "failed", "code_desc": "File /etc/ssh/sshd_config is expected not to be readable by other", "run_time": 0.000199, "start_time": "2020-07-06T17:54:49-04:00", "message": "expected File /etc/ssh/sshd_config not to be readable by other" }, { "status": "passed", "code_desc": "File /etc/ssh/sshd_config is expected to be writable by owner", "run_time": 0.00017, "start_time": "2020-07-06T17:54:49-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/sshd_config is expected not to be writable by group", "run_time": 0.000146, "start_time": "2020-07-06T17:54:49-04:00" }, { "status": "passed", "code_desc": "File /etc/ssh/sshd_config is expected not to be writable by other", "run_time": 0.000154, "start_time": "2020-07-06T17:54:49-04:00" } ] }, { "id": "sshd-06", "title": "Server: Do not permit root-based login or do not allow password and keyboard-interactive authentication", "desc": "Reduce the potential risk to gain full privileges access of the system because of weak password and keyboard-interactive authentication, do not allow logging in as the root user or with password authentication.", "descriptions": [ { "label": "default", "data": "Reduce the potential risk to gain full privileges access of the system because of weak password and keyboard-interactive authentication, do not allow logging in as the root user or with password authentication." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-06' do\n impact 1.0\n title 'Server: Do not permit root-based login or do not allow password and keyboard-interactive authentication'\n desc 'Reduce the potential risk to gain full privileges access of the system because of weak password and keyboard-interactive authentication, do not allow logging in as the root user or with password authentication.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PermitRootLogin') { should match(/no|without-password|prohibit-password/) }\n end\nend\n", "source_location": { "line": 112, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration PermitRootLogin is expected to match /no|without-password|prohibit-password/", "run_time": 0.000823, "start_time": "2020-07-06T17:54:49-04:00", "message": "expected nil to match /no|without-password|prohibit-password/" } ] }, { "id": "sshd-07", "title": "Server: Specify the listen ssh Port", "desc": "Always specify which port the SSH server should listen to. Prevent unexpected settings.", "descriptions": [ { "label": "default", "data": "Always specify which port the SSH server should listen to. Prevent unexpected settings." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-07' do\n impact 1.0\n title 'Server: Specify the listen ssh Port'\n desc 'Always specify which port the SSH server should listen to. Prevent unexpected settings.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('Port') { should eq(sshd_custom_port) }\n end\nend\n", "source_location": { "line": 121, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration Port is expected to eq \"22\"", "run_time": 0.000716, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"22\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-08", "title": "Server: Specify the AddressFamily to your need", "desc": "OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6.", "descriptions": [ { "label": "default", "data": "OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-08' do\n impact 1.0\n title 'Server: Specify the AddressFamily to your need'\n desc 'OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('AddressFamily') { should match(/inet|inet6|any/) }\n end\nend\n", "source_location": { "line": 130, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration AddressFamily is expected to match /inet|inet6|any/", "run_time": 0.000805, "start_time": "2020-07-06T17:54:49-04:00", "message": "expected nil to match /inet|inet6|any/" } ] }, { "id": "sshd-09", "title": "Server: Specify ListenAddress", "desc": "Limit the SSH server to listen to a specific address. Don't let it listen on all interfaces to avoid logins from unexpected sources.", "descriptions": [ { "label": "default", "data": "Limit the SSH server to listen to a specific address. Don't let it listen on all interfaces to avoid logins from unexpected sources." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-09' do\n impact 1.0\n title 'Server: Specify ListenAddress'\n desc \"Limit the SSH server to listen to a specific address. Don't let it listen on all interfaces to avoid logins from unexpected sources.\"\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('ListenAddress') { should_not eq nil }\n its('ListenAddress') { should_not match(/^\\s*$/) }\n its('ListenAddress') { should_not eq [] }\n end\nend\n", "source_location": { "line": 139, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration ListenAddress is expected not to eq nil", "run_time": 0.00078, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: value != nil\n got: nil\n\n(compared using ==)\n" }, { "status": "passed", "code_desc": "SSHD Configuration ListenAddress is expected not to match /^\\s*$/", "run_time": 0.000118, "start_time": "2020-07-06T17:54:49-04:00" }, { "status": "passed", "code_desc": "SSHD Configuration ListenAddress is expected not to eq []", "run_time": 0.000107, "start_time": "2020-07-06T17:54:49-04:00" } ] }, { "id": "sshd-10", "title": "Server: Specify protocol version 2", "desc": "Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore.", "descriptions": [ { "label": "default", "data": "Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-10' do\n impact 1.0\n title 'Server: Specify protocol version 2'\n desc \"Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore.\"\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('Protocol') { should eq('2') }\n end\nend\n", "source_location": { "line": 150, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration Protocol is expected to eq \"2\"", "run_time": 0.00076, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"2\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-11", "title": "Server: Enable StrictModes", "desc": "Prevent the use of insecure home directory and key file permissions.", "descriptions": [ { "label": "default", "data": "Prevent the use of insecure home directory and key file permissions." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-11' do\n impact 1.0\n title 'Server: Enable StrictModes'\n desc 'Prevent the use of insecure home directory and key file permissions.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('StrictModes') { should eq('yes') }\n end\nend\n", "source_location": { "line": 159, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration StrictModes is expected to eq \"yes\"", "run_time": 0.000757, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"yes\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-12", "title": "Server: Specify SyslogFacility to AUTH", "desc": "Logging should be set to go to the /var/log/auth.log facility by using the SysLog AUTH parameter. This will ensure that any problems around invalid logins or the like are forwarded to a central security file for auditing purposes", "descriptions": [ { "label": "default", "data": "Logging should be set to go to the /var/log/auth.log facility by using the SysLog AUTH parameter. This will ensure that any problems around invalid logins or the like are forwarded to a central security file for auditing purposes" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-12' do\n impact 1.0\n title 'Server: Specify SyslogFacility to AUTH'\n desc 'Logging should be set to go to the /var/log/auth.log facility by using the SysLog AUTH parameter. This will ensure that any problems around invalid logins or the like are forwarded to a central security file for auditing purposes'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('SyslogFacility') { should eq('AUTH') }\n end\nend\n", "source_location": { "line": 168, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration SyslogFacility is expected to eq \"AUTH\"", "run_time": 0.000967, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"AUTH\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-13", "title": "Server: Specify LogLevel to VERBOSE", "desc": "Be verbose in logging, to allow analysis in case of unexpected behavior.", "descriptions": [ { "label": "default", "data": "Be verbose in logging, to allow analysis in case of unexpected behavior." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-13' do\n impact 1.0\n title 'Server: Specify LogLevel to VERBOSE'\n desc 'Be verbose in logging, to allow analysis in case of unexpected behavior.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('LogLevel') { should eq('VERBOSE') }\n end\nend\n", "source_location": { "line": 177, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration LogLevel is expected to eq \"VERBOSE\"", "run_time": 0.00104, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"VERBOSE\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-14", "title": "Server: Specify SSH HostKeys", "desc": "Specify HostKey for protection against Man-In-The-Middle Attacks", "descriptions": [ { "label": "default", "data": "Specify HostKey for protection against Man-In-The-Middle Attacks" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-14' do\n impact 1.0\n title 'Server: Specify SSH HostKeys'\n desc 'Specify HostKey for protection against Man-In-The-Middle Attacks'\n\n sshd_valid_hostkeys = ssh_crypto.valid_algorithms.map { |alg| \"#{sshd_custom_hostkeys_path}/ssh_host_#{alg}_key\" }\n sshd_valid_hostkeys = sshd_valid_hostkeys[0] if sshd_valid_hostkeys.length == 1\n\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('HostKey') { should cmp sshd_valid_hostkeys }\n end\nend\n", "source_location": { "line": 186, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration HostKey is expected to cmp == [\"/etc/ssh/ssh_host_rsa_key\", \"/etc/ssh/ssh_host_ecdsa_key\", \"/etc/ssh/ssh_host_ed25519_key\"]", "run_time": 0.001153, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: [\"/etc/ssh/ssh_host_rsa_key\", \"/etc/ssh/ssh_host_ecdsa_key\", \"/etc/ssh/ssh_host_ed25519_key\"]\n got: \n\n(compared using `cmp` matcher)\n" } ] }, { "id": "sshd-15", "title": "Server: Specify UseLogin to NO", "desc": "Disable legacy login mechanism and do not use login for interactive login sessions.", "descriptions": [ { "label": "default", "data": "Disable legacy login mechanism and do not use login for interactive login sessions." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-15' do\n impact 1.0\n title 'Server: Specify UseLogin to NO'\n desc 'Disable legacy login mechanism and do not use login for interactive login sessions.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('UseLogin') { should eq(ssh_crypto.ssh_version < 7.4 ? 'no' : nil) }\n end\nend\n", "source_location": { "line": 199, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "passed", "code_desc": "SSHD Configuration UseLogin is expected to eq nil", "run_time": 0.00081, "start_time": "2020-07-06T17:54:49-04:00" } ] }, { "id": "sshd-16", "title": "Server: Use privilege separation", "desc": "UsePrivilegeSeparation is an option, when enabled will allow the OpenSSH server to run a small (necessary) amount of code as root and the of the code in a chroot jail environment. This enables ssh to deal incoming network traffic in an unprivileged child process to avoid privilege escalation by an attacker.", "descriptions": [ { "label": "default", "data": "UsePrivilegeSeparation is an option, when enabled will allow the OpenSSH server to run a small (necessary) amount of code as root and the of the code in a chroot jail environment. This enables ssh to deal incoming network traffic in an unprivileged child process to avoid privilege escalation by an attacker." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-16' do\n impact 1.0\n title 'Server: Use privilege separation'\n desc 'UsePrivilegeSeparation is an option, when enabled will allow the OpenSSH server to run a small (necessary) amount of code as root and the of the code in a chroot jail environment. This enables ssh to deal incoming network traffic in an unprivileged child process to avoid privilege escalation by an attacker.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('UsePrivilegeSeparation') { should eq(sshd_valid_privseparation) }\n end\nend\n", "source_location": { "line": 208, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration UsePrivilegeSeparation is expected to eq \"sandbox\"", "run_time": 0.000776, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"sandbox\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-17", "title": "Server: Disable PermitUserEnvironment", "desc": "Enabling environment processing may enable users to bypass access restrictions in some configurations using mechanisms such as LD_PRELOAD.", "descriptions": [ { "label": "default", "data": "Enabling environment processing may enable users to bypass access restrictions in some configurations using mechanisms such as LD_PRELOAD." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-17' do\n impact 1.0\n title 'Server: Disable PermitUserEnvironment'\n desc 'Enabling environment processing may enable users to bypass access restrictions in some configurations using mechanisms such as LD_PRELOAD.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PermitUserEnvironment') { should eq('no') }\n end\nend\n", "source_location": { "line": 217, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration PermitUserEnvironment is expected to eq \"no\"", "run_time": 0.000725, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-18", "title": "Server: Specify LoginGraceTime", "desc": "The LoginGraceTime gives the user 30 seconds to accomplish a login. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon.", "descriptions": [ { "label": "default", "data": "The LoginGraceTime gives the user 30 seconds to accomplish a login. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-18' do\n impact 1.0\n title 'Server: Specify LoginGraceTime'\n desc 'The LoginGraceTime gives the user 30 seconds to accomplish a login. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('LoginGraceTime') { should eq('30s') }\n end\nend\n", "source_location": { "line": 226, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration LoginGraceTime is expected to eq \"30s\"", "run_time": 0.000756, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"30s\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-19", "title": "Server: Specify Limit for maximum authentication retries", "desc": "The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the syslog file detailing the login failure. Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. The default is 2 but should be configured based on site policy.", "descriptions": [ { "label": "default", "data": "The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the syslog file detailing the login failure. Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. The default is 2 but should be configured based on site policy." } ], "impact": 1, "refs": [ { "url": "https://www.cisecurity.org/", "ref": "Center for Internet Security" } ], "tags": { "CIS Red Hat Enterprise Linux 7 Benchmark version 01-31-2017": "2.1.1" }, "code": "control 'sshd-19' do\n impact 1.0\n title 'Server: Specify Limit for maximum authentication retries'\n desc 'The MaxAuthTries parameter specifies the maximum number of authentication attempts permitted per connection. When the login failure count reaches half the number, error messages will be written to the syslog file detailing the login failure. Setting the MaxAuthTries parameter to a low number will minimize the risk of successful brute force attacks to the SSH server. The default is 2 but should be configured based on site policy.'\n tag 'CIS Red Hat Enterprise Linux 7 Benchmark version 01-31-2017': '2.1.1'\n ref 'Center for Internet Security', url: 'https://www.cisecurity.org/'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('MaxAuthTries') { should cmp(sshd_max_auth_tries) }\n end\nend\n", "source_location": { "line": 235, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration MaxAuthTries is expected to cmp == 2", "run_time": 0.00076, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: 2\n got: \n\n(compared using `cmp` matcher)\n" } ] }, { "id": "sshd-20", "title": "Server: Specify maximum sessions", "desc": "Specifies the maximum number of open sessions permitted per network connection. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon.", "descriptions": [ { "label": "default", "data": "Specifies the maximum number of open sessions permitted per network connection. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-20' do\n impact 1.0\n title 'Server: Specify maximum sessions'\n desc 'Specifies the maximum number of open sessions permitted per network connection. This could be used to conduct a Denial of Service (DoS) against a running SSH daemon.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('MaxSessions') { should eq('10') }\n end\nend\n", "source_location": { "line": 246, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration MaxSessions is expected to eq \"10\"", "run_time": 0.000652, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"10\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-21", "title": "Server: Specify maximum startups", "desc": "Limit the number of concurrent unauthenticated sessions to prevent Denial of Service (DoS) against a running SSH daemon.", "descriptions": [ { "label": "default", "data": "Limit the number of concurrent unauthenticated sessions to prevent Denial of Service (DoS) against a running SSH daemon." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-21' do\n impact 1.0\n title 'Server: Specify maximum startups'\n desc 'Limit the number of concurrent unauthenticated sessions to prevent Denial of Service (DoS) against a running SSH daemon.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('MaxStartups') { should eq('10:30:100') }\n end\nend\n", "source_location": { "line": 255, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration MaxStartups is expected to eq \"10:30:100\"", "run_time": 0.000626, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"10:30:100\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-22", "title": "Server: Enable PubkeyAuthentication", "desc": "Prefer public key authentication mechanisms, because other methods are weaker (e.g. passwords).", "descriptions": [ { "label": "default", "data": "Prefer public key authentication mechanisms, because other methods are weaker (e.g. passwords)." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-22' do\n impact 1.0\n title 'Server: Enable PubkeyAuthentication'\n desc 'Prefer public key authentication mechanisms, because other methods are weaker (e.g. passwords).'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PubkeyAuthentication') { should eq('yes') }\n end\nend\n", "source_location": { "line": 264, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration PubkeyAuthentication is expected to eq \"yes\"", "run_time": 0.000728, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"yes\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-23", "title": "Server: Disable IgnoreRhosts", "desc": "Ignore legacy .rhosts configuration, because rhosts are a weak way to authenticate systems and provide attacker more ways to enter the system.", "descriptions": [ { "label": "default", "data": "Ignore legacy .rhosts configuration, because rhosts are a weak way to authenticate systems and provide attacker more ways to enter the system." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-23' do\n impact 1.0\n title 'Server: Disable IgnoreRhosts'\n desc 'Ignore legacy .rhosts configuration, because rhosts are a weak way to authenticate systems and provide attacker more ways to enter the system.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('IgnoreRhosts') { should eq('yes') }\n end\nend\n", "source_location": { "line": 273, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration IgnoreRhosts is expected to eq \"yes\"", "run_time": 0.000668, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"yes\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-24", "title": "Server: Enable IgnoreUserKnownHosts", "desc": "This option is a weak way for authentication and provide attacker more ways to enter the system.", "descriptions": [ { "label": "default", "data": "This option is a weak way for authentication and provide attacker more ways to enter the system." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-24' do\n impact 1.0\n title 'Server: Enable IgnoreUserKnownHosts'\n desc 'This option is a weak way for authentication and provide attacker more ways to enter the system.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('IgnoreUserKnownHosts') { should eq('yes') }\n end\nend\n", "source_location": { "line": 282, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration IgnoreUserKnownHosts is expected to eq \"yes\"", "run_time": 0.000641, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"yes\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-25", "title": "Server: Disable HostbasedAuthentication", "desc": "This option is a weak way for authentication and provide attacker more ways to enter the system.", "descriptions": [ { "label": "default", "data": "This option is a weak way for authentication and provide attacker more ways to enter the system." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-25' do\n impact 1.0\n title 'Server: Disable HostbasedAuthentication'\n desc 'This option is a weak way for authentication and provide attacker more ways to enter the system.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('HostbasedAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 291, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration HostbasedAuthentication is expected to eq \"no\"", "run_time": 0.00064, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-27", "title": "Server: Disable password-based authentication", "desc": "Avoid password-based authentications.", "descriptions": [ { "label": "default", "data": "Avoid password-based authentications." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-27' do\n impact 1.0\n title 'Server: Disable password-based authentication'\n desc 'Avoid password-based authentications.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PasswordAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 300, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration PasswordAuthentication is expected to eq \"no\"", "run_time": 0.000645, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-28", "title": "Server: Disable PermitEmptyPasswords", "desc": "Accounts should be protected and users should be accountable. For this reason the usage of empty passwords should never be allowed.", "descriptions": [ { "label": "default", "data": "Accounts should be protected and users should be accountable. For this reason the usage of empty passwords should never be allowed." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-28' do\n impact 1.0\n title 'Server: Disable PermitEmptyPasswords'\n desc 'Accounts should be protected and users should be accountable. For this reason the usage of empty passwords should never be allowed.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PermitEmptyPasswords') { should eq('no') }\n end\nend\n", "source_location": { "line": 309, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration PermitEmptyPasswords is expected to eq \"no\"", "run_time": 0.000882, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-29", "title": "Server: Disable ChallengeResponseAuthentication", "desc": "Avoid challenge-response and password-based authentications.", "descriptions": [ { "label": "default", "data": "Avoid challenge-response and password-based authentications." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-29' do\n impact 1.0\n title 'Server: Disable ChallengeResponseAuthentication'\n desc 'Avoid challenge-response and password-based authentications.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('ChallengeResponseAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 318, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration ChallengeResponseAuthentication is expected to eq \"no\"", "run_time": 0.001119, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-30", "title": "Server: Disable Kerberos", "desc": "Avoid kerberos authentication.", "descriptions": [ { "label": "default", "data": "Avoid kerberos authentication." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-30' do\n impact 1.0\n title 'Server: Disable Kerberos'\n desc 'Avoid kerberos authentication.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('KerberosAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 327, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration KerberosAuthentication is expected to eq \"no\"", "run_time": 0.000701, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-31", "title": "Server: Disable Kerberos or Local Password", "desc": "Avoid kerberos authentication because it use password-based authentication as fallback.", "descriptions": [ { "label": "default", "data": "Avoid kerberos authentication because it use password-based authentication as fallback." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-31' do\n impact 1.0\n title 'Server: Disable Kerberos or Local Password'\n desc 'Avoid kerberos authentication because it use password-based authentication as fallback.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('KerberosOrLocalPasswd') { should eq('no') }\n end\nend\n", "source_location": { "line": 336, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration KerberosOrLocalPasswd is expected to eq \"no\"", "run_time": 0.000675, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-32", "title": "Server: Enable KerberosTicketCleanup", "desc": "Specifies whether to automatically destroy the user's ticket cache file on logout.", "descriptions": [ { "label": "default", "data": "Specifies whether to automatically destroy the user's ticket cache file on logout." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-32' do\n impact 1.0\n title 'Server: Enable KerberosTicketCleanup'\n desc \"Specifies whether to automatically destroy the user's ticket cache file on logout.\"\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('KerberosTicketCleanup') { should eq('yes') }\n end\nend\n", "source_location": { "line": 345, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration KerberosTicketCleanup is expected to eq \"yes\"", "run_time": 0.000674, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"yes\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-33", "title": "Server: Disable GSSAPIAuthentication", "desc": "If you do not use GSSAPI authentication then disable it.", "descriptions": [ { "label": "default", "data": "If you do not use GSSAPI authentication then disable it." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-33' do\n impact 1.0\n title 'Server: Disable GSSAPIAuthentication'\n desc 'If you do not use GSSAPI authentication then disable it.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('GSSAPIAuthentication') { should eq('no') }\n end\nend\n", "source_location": { "line": 354, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration GSSAPIAuthentication is expected to eq \"no\"", "run_time": 0.000688, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-34", "title": "Server: Enable GSSAPICleanupCredentials", "desc": "Automatically destroy the user's credentials cache on logout.", "descriptions": [ { "label": "default", "data": "Automatically destroy the user's credentials cache on logout." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-34' do\n impact 1.0\n title 'Server: Enable GSSAPICleanupCredentials'\n desc \"Automatically destroy the user's credentials cache on logout.\"\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('GSSAPICleanupCredentials') { should eq('yes') }\n end\nend\n", "source_location": { "line": 363, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration GSSAPICleanupCredentials is expected to eq \"yes\"", "run_time": 0.000679, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"yes\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-35", "title": "Server: Disable TCPKeepAlive", "desc": "Avoid the TCPKeepAlive messages to see if the client is still alive, because they are sent over unencrypted connection and are spoofable.", "descriptions": [ { "label": "default", "data": "Avoid the TCPKeepAlive messages to see if the client is still alive, because they are sent over unencrypted connection and are spoofable." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-35' do\n impact 1.0\n title 'Server: Disable TCPKeepAlive'\n desc 'Avoid the TCPKeepAlive messages to see if the client is still alive, because they are sent over unencrypted connection and are spoofable.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('TCPKeepAlive') { should eq('no') }\n end\nend\n", "source_location": { "line": 372, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration TCPKeepAlive is expected to eq \"no\"", "run_time": 0.000663, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-36", "title": "Server: Set a client alive interval", "desc": "ClientAlive messages are sent over encrypted connection and are not spoofable.", "descriptions": [ { "label": "default", "data": "ClientAlive messages are sent over encrypted connection and are not spoofable." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-36' do\n impact 1.0\n title 'Server: Set a client alive interval'\n desc 'ClientAlive messages are sent over encrypted connection and are not spoofable.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('ClientAliveInterval') { should eq('300') }\n end\nend\n", "source_location": { "line": 381, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration ClientAliveInterval is expected to eq \"300\"", "run_time": 0.000644, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"300\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-37", "title": "Server: Configure a few client alive counters", "desc": "This indicates the total number of checkalive message sent by the ssh server without getting any response from the ssh client. ClientAlive messages are sent over encrypted connection and are not spoofable.", "descriptions": [ { "label": "default", "data": "This indicates the total number of checkalive message sent by the ssh server without getting any response from the ssh client. ClientAlive messages are sent over encrypted connection and are not spoofable." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-37' do\n impact 1.0\n title 'Server: Configure a few client alive counters'\n desc 'This indicates the total number of checkalive message sent by the ssh server without getting any response from the ssh client. ClientAlive messages are sent over encrypted connection and are not spoofable.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('ClientAliveCountMax') { should eq('3') }\n end\nend\n", "source_location": { "line": 390, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration ClientAliveCountMax is expected to eq \"3\"", "run_time": 0.000682, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"3\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-38", "title": "Server: Disable tunnels", "desc": "Avoid to use tunnels.", "descriptions": [ { "label": "default", "data": "Avoid to use tunnels." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-38' do\n impact 1.0\n title 'Server: Disable tunnels'\n desc 'Avoid to use tunnels.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PermitTunnel') { should eq(sshd_permittunnel) }\n end\nend\n", "source_location": { "line": 399, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration PermitTunnel is expected to eq \"no\"", "run_time": 0.000676, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-39", "title": "Server: Disable TCP forwarding", "desc": "If you use TCP forwarding in an uncontrolled manner then you can bypass the firewalls", "descriptions": [ { "label": "default", "data": "If you use TCP forwarding in an uncontrolled manner then you can bypass the firewalls" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-39' do\n impact 1.0\n title 'Server: Disable TCP forwarding'\n desc 'If you use TCP forwarding in an uncontrolled manner then you can bypass the firewalls'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('AllowTcpForwarding') { should eq(sshd_tcpforwarding) }\n end\nend\n", "source_location": { "line": 408, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration AllowTcpForwarding is expected to eq \"no\"", "run_time": 0.000642, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-40", "title": "Server: Disable Agent forwarding", "desc": "Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.", "descriptions": [ { "label": "default", "data": "Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-40' do\n impact 1.0\n title 'Server: Disable Agent forwarding'\n desc \"Users with the ability to bypass file permissions on the remote host (for the agent's UNIX-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent.\"\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('AllowAgentForwarding') { should eq(sshd_agentforwarding) }\n end\nend\n", "source_location": { "line": 417, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration AllowAgentForwarding is expected to eq \"no\"", "run_time": 0.000641, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-41", "title": "Server: Disable gateway ports", "desc": "Prevent remote hosts from connecting to forwarded ports on the node.", "descriptions": [ { "label": "default", "data": "Prevent remote hosts from connecting to forwarded ports on the node." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-41' do\n impact 1.0\n title 'Server: Disable gateway ports'\n desc 'Prevent remote hosts from connecting to forwarded ports on the node.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('GatewayPorts') { should eq(sshd_gatewayports) }\n end\nend\n", "source_location": { "line": 426, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration GatewayPorts is expected to eq \"no\"", "run_time": 0.000667, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-42", "title": "Server: Disable X11Forwarding", "desc": "Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks.", "descriptions": [ { "label": "default", "data": "Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-42' do\n impact 1.0\n title 'Server: Disable X11Forwarding'\n desc 'Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('X11Forwarding') { should eq(sshd_x11forwarding) }\n end\nend\n", "source_location": { "line": 435, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration X11Forwarding is expected to eq \"no\"", "run_time": 0.000641, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-43", "title": "Server: Enable X11UseLocalhost", "desc": "SSH daemon should bind the X11 forwarding server to the loopback address. This prevents remote hosts from connecting to the proxy display and reduce the attack surface", "descriptions": [ { "label": "default", "data": "SSH daemon should bind the X11 forwarding server to the loopback address. This prevents remote hosts from connecting to the proxy display and reduce the attack surface" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-43' do\n impact 1.0\n title 'Server: Enable X11UseLocalhost'\n desc 'SSH daemon should bind the X11 forwarding server to the loopback address. This prevents remote hosts from connecting to the proxy display and reduce the attack surface'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('X11UseLocalhost') { should eq('yes') }\n end\nend\n", "source_location": { "line": 444, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration X11UseLocalhost is expected to eq \"yes\"", "run_time": 0.000615, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"yes\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-44", "title": "Server: Disable PrintMotd", "desc": "This specifies that the SSH daemon itself should not read and display the message of the day file.", "descriptions": [ { "label": "default", "data": "This specifies that the SSH daemon itself should not read and display the message of the day file." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-44' do\n impact 1.0\n title 'Server: Disable PrintMotd'\n desc 'This specifies that the SSH daemon itself should not read and display the message of the day file.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PrintMotd') { should eq('no') }\n end\nend\n", "source_location": { "line": 453, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration PrintMotd is expected to eq \"no\"", "run_time": 0.000617, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-45", "title": "Server: PrintLastLog", "desc": "This tells the SSH daemon to print out information about the last time you logged in.", "descriptions": [ { "label": "default", "data": "This tells the SSH daemon to print out information about the last time you logged in." } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-45' do\n impact 1.0\n title 'Server: PrintLastLog'\n desc 'This tells the SSH daemon to print out information about the last time you logged in.'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('PrintLastLog') { should eq('no') }\n end\nend\n", "source_location": { "line": 462, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration PrintLastLog is expected to eq \"no\"", "run_time": 0.000603, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"no\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-46", "title": "Server: Banner", "desc": "Specifies a banner file to serve before authentication succeeds", "descriptions": [ { "label": "default", "data": "Specifies a banner file to serve before authentication succeeds" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-46' do\n impact 1.0\n title 'Server: Banner'\n desc 'Specifies a banner file to serve before authentication succeeds'\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('Banner') { should eq(sshd_banner) }\n end\nend\n", "source_location": { "line": 471, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "failed", "code_desc": "SSHD Configuration Banner is expected to eq \"none\"", "run_time": 0.000795, "start_time": "2020-07-06T17:54:49-04:00", "message": "\nexpected: \"none\"\n got: nil\n\n(compared using ==)\n" } ] }, { "id": "sshd-47", "title": "Server: DebianBanner", "desc": "Specifies whether to include OS distribution in version information", "descriptions": [ { "label": "default", "data": "Specifies whether to include OS distribution in version information" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-47' do\n impact 1.0\n title 'Server: DebianBanner'\n desc 'Specifies whether to include OS distribution in version information'\n case os[:family]\n when 'debian' then\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('DebianBanner') { should eq('no') }\n end\n else\n describe sshd_config(sshd_custom_path + '/sshd_config') do\n its('content') { should_not match(/DebianBanner/) }\n end\n end\nend\n", "source_location": { "line": 480, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "passed", "code_desc": "SSHD Configuration content is expected not to match /DebianBanner/", "run_time": 0.000114, "start_time": "2020-07-06T17:54:49-04:00" } ] }, { "id": "sshd-48", "title": "Server: DH primes", "desc": "Verifies if strong DH primes are used in /etc/ssh/moduli", "descriptions": [ { "label": "default", "data": "Verifies if strong DH primes are used in /etc/ssh/moduli" } ], "impact": 1, "refs": [], "tags": {}, "code": "control 'sshd-48' do\n impact 1.0\n title 'Server: DH primes'\n desc 'Verifies if strong DH primes are used in /etc/ssh/moduli'\n describe bash(\"test $(awk '$5 < 2047 && $5 ~ /^[0-9]+$/ { print $5 }' #{sshd_custom_path}/moduli | uniq | wc -c) -eq 0\") do\n its('exit_status') { should eq 0 }\n its('stdout') { should eq '' }\n its('stderr') { should eq '' }\n end\nend\n", "source_location": { "line": 496, "ref": "ssh-baseline-master/controls/sshd_spec.rb" }, "waiver_data": {}, "results": [ { "status": "passed", "code_desc": "Bash command test $(awk '$5 < 2047 && $5 ~ /^[0-9]+$/ { print $5 }' /etc/ssh/moduli | uniq | wc -c) -eq 0 exit_status is expected to eq 0", "run_time": 0.059415, "start_time": "2020-07-06T17:54:49-04:00" }, { "status": "passed", "code_desc": "Bash command test $(awk '$5 < 2047 && $5 ~ /^[0-9]+$/ { print $5 }' /etc/ssh/moduli | uniq | wc -c) -eq 0 stdout is expected to eq \"\"", "run_time": 0.000176, "start_time": "2020-07-06T17:54:49-04:00" }, { "status": "passed", "code_desc": "Bash command test $(awk '$5 < 2047 && $5 ~ /^[0-9]+$/ { print $5 }' /etc/ssh/moduli | uniq | wc -c) -eq 0 stderr is expected to eq \"\"", "run_time": 0.000114, "start_time": "2020-07-06T17:54:49-04:00" } ] } ], "status": "loaded" }, { "name": "ssl-baseline", "version": "1.6.3", "sha256": "f7457e2248b87a31fa2e459c98655b1ef398e2f4efb6a6a7f4d3a17987a674df", "title": "DevSec SSL/TLS Baseline", "maintainer": "DevSec Hardening Framework Team", "summary": "Ensures a secure configuration for TCP ports", "license": "Apache-2.0", "copyright": "DevSec Hardening Framework Team & Chef Software Inc.", "copyright_email": "hello@dev-sec.io", "supports": [ { "inspec_version": ">= 1.21.0" }, { "platform-family": "unix" } ], "attributes": [ { "name": "invalid_targets", "options": { "value": [ "127.0.0.1", "0.0.0.0", "::1", "::" ] } }, { "name": "exclude_ports", "options": { "value": [] } }, { "name": "target_hostname", "options": { "value": "MM198645-PC" } }, { "name": "force_ssl", "options": { "value": false } } ], "parent_profile": "acme-inspec-profile", "groups": [ { "id": "controls/ssl_test.rb", "controls": [ "debugging", "ssl2", "ssl3", "tls1.0", "tls1.1", "tls1.2", "kx-ecdh", "kx-rsa", "kx-dh", "kx-krb5", "kx-psk", "kx-gostr", "kx-srp", "au-ecdsa-rsa", "au-anon", "au-dss", "au-psk", "au-export", "enc-aes-gcm-chacha20", "enc-cbc", "enc-rc4", "enc-export", "enc-des", "enc-enull", "enc-camellia", "enc-seed", "enc-idea", "enc-aes-ccm", "mac-sha384-sha256-poly1305", "mac-md5", "mac-sha", "mac-null", "robotattack" ] } ], "controls": [ { "id": "debugging", "title": "Inspec::Version=4.19.2", "desc": null, "descriptions": [], "impact": 0, "refs": [], "tags": {}, "code": "control 'debugging' do\n title \"Inspec::Version=#{Inspec::VERSION}\"\n impact 0.0\n describe \"tcpports=\\n#{tcpports.join(\"\\n\")}\" do\n it { should_not eq nil }\n end\n describe \"sslports=\\n#{sslports.join(\"\\n\")}\" do\n it { should_not eq nil }\n end\nend\n", "source_location": { "line": 74, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "passed", "code_desc": "tcpports=\n{:port=>3283, :socket=>#}\n{:port=>49619, :socket=>#}\n{:port=>49619, :socket=>#}\n{:port=>55635, :socket=>#}\n{:port=>60370, :socket=>#} is expected not to eq nil", "run_time": 0.000106, "start_time": "2020-07-06T17:54:49-04:00" }, { "status": "passed", "code_desc": "sslports=\n is expected not to eq nil", "run_time": 9.5e-05, "start_time": "2020-07-06T17:54:49-04:00" } ] }, { "id": "ssl2", "title": "Disable SSL 2 from all exposed SSL ports.", "desc": null, "descriptions": [], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssl2' do\n title 'Disable SSL 2 from all exposed SSL ports.'\n impact 1.0\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).protocols('ssl2') do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 90, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 9e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "ssl3", "title": "Disable SSL 3 from all exposed SSL ports.", "desc": null, "descriptions": [], "impact": 1, "refs": [], "tags": {}, "code": "control 'ssl3' do\n title 'Disable SSL 3 from all exposed SSL ports.'\n impact 1.0\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).protocols('ssl3') do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 105, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "tls1.0", "title": "Disable TLS 1.0 on exposed ports.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'tls1.0' do\n title 'Disable TLS 1.0 on exposed ports.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).protocols('tls1.0') do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 120, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 5e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "tls1.1", "title": "Disable TLS 1.1 on exposed ports.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'tls1.1' do\n title 'Disable TLS 1.1 on exposed ports.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).protocols('tls1.1') do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 135, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 6e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "tls1.2", "title": "Enable TLS 1.2 on exposed ports.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'tls1.2' do\n title 'Enable TLS 1.2 on exposed ports.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).protocols('tls1.2') do\n it(proc_desc) { should be_enabled }\n it { should be_enabled }\n end\n end\nend\n", "source_location": { "line": 150, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "kx-ecdh", "title": "Enable ECDH as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-ecdh' do\n title 'Enable ECDH as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_ECDH/i) do\n it(proc_desc) { should be_enabled }\n it { should be_enabled }\n end\n end\nend\n", "source_location": { "line": 169, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "kx-rsa", "title": "Disable RSA as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-rsa' do\n title 'Disable RSA as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_RSA/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 184, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "kx-dh", "title": "Disable DH as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-dh' do\n title 'Disable DH as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_DH/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 199, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "kx-krb5", "title": "Disable KRB5 as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-krb5' do\n title 'Disable KRB5 as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_KRB5/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 214, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 6e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "kx-psk", "title": "Disable PSK as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-psk' do\n title 'Disable PSK as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_PSK/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 229, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "kx-gostr", "title": "Disable GOSTR as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-gostr' do\n title 'Disable GOSTR as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_GOSTR/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 244, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "kx-srp", "title": "Disable SRP as KX from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'kx-srp' do\n title 'Disable SRP as KX from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_SRP/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 259, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "au-ecdsa-rsa", "title": "Enable ECDSA or RSA as AU from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'au-ecdsa-rsa' do\n title 'Enable ECDSA or RSA as AU from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/(RSA|ECDSA)_WITH/i) do\n it(proc_desc) { should be_enabled }\n it { should be_enabled }\n end\n end\nend\n", "source_location": { "line": 279, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 8e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "au-anon", "title": "Disable ANON as AU from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'au-anon' do\n title 'Disable ANON as AU from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/ANON_WITH/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 294, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 6e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "au-dss", "title": "Disable DSS as AU from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'au-dss' do\n title 'Disable DSS as AU from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/DSS_WITH/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 309, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 9e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "au-psk", "title": "Disable PSK as AU from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'au-psk' do\n title 'Disable PSK as AU from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/PSK_WITH/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 324, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 6e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "au-export", "title": "Disable EXPORT as AU from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'au-export' do\n title 'Disable EXPORT as AU from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/((EXPORT)(\\d*)_WITH)/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 339, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 6e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "enc-aes-gcm-chacha20", "title": "Enable AES256 or AES128 or AES256-GCM or AES128-GCM or CHACHA20 as Enc", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-aes-gcm-chacha20' do\n title 'Enable AES256 or AES128 or AES256-GCM or AES128-GCM or CHACHA20 as Enc'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_(AES_256|AES_128|CHACHA20|AES_256_GCM|AES_128_GCM)/i) do\n it(proc_desc) { should be_enabled }\n it { should be_enabled }\n end\n end\nend\n", "source_location": { "line": 360, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "enc-cbc", "title": "Disable CBC as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-cbc' do\n title 'Disable CBC as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/(WITH_(\\w+)_(CBC))/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 375, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 8e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "enc-rc4", "title": "Disable RC4 as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-rc4' do\n title 'Disable RC4 as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_RC4/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 390, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "enc-export", "title": "Disable EXPORT as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-export' do\n title 'Disable EXPORT as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_EXPORT/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 405, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "enc-des", "title": "Disable DES, 3DES as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-des' do\n title 'Disable DES, 3DES as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/(WITH_(\\d*)(des))/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 420, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 5e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "enc-enull", "title": "Disable eNULL as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-enull' do\n title 'Disable eNULL as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_NULL/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 435, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "enc-camellia", "title": "Disable CAMELLIA as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-camellia' do\n title 'Disable CAMELLIA as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_CAMELLIA/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 450, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "enc-seed", "title": "Disable SEED as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-seed' do\n title 'Disable SEED as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_SEED/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 465, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 5e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "enc-idea", "title": "Disable IDEA as ENC from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-idea' do\n title 'Disable IDEA as ENC from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/WITH_IDEA/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 480, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 5e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "enc-aes-ccm", "title": "Disable AES-CCM from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'enc-aes-ccm' do\n title 'Disable AES-CCM from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/(WITH_AES_(\\w+)_(CCM))/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 495, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "mac-sha384-sha256-poly1305", "title": "Enable SHA384 or SHA256 or POLY1305 as Mac from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'mac-sha384-sha256-poly1305' do\n title 'Enable SHA384 or SHA256 or POLY1305 as Mac from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/_(SHA384|SHA256|POLY1305)$/i) do\n it(proc_desc) { should be_enabled }\n it { should be_enabled }\n end\n end\nend\n", "source_location": { "line": 515, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 5e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "mac-md5", "title": "Disable MD5 Mac from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'mac-md5' do\n title 'Disable MD5 Mac from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/_MD5$/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 530, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 5e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "mac-sha", "title": "Disable SHA(1) Mac from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'mac-sha' do\n title 'Disable SHA(1) Mac from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/_SHA$/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 545, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 6e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "mac-null", "title": "Disable NULL Mac from all exposed SSL/TLS ports and versions.", "desc": null, "descriptions": [], "impact": 0.5, "refs": [], "tags": {}, "code": "control 'mac-null' do\n title 'Disable NULL Mac from all exposed SSL/TLS ports and versions.'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/_NULL$/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 560, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 1.6e-05, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] }, { "id": "robotattack", "title": "Return Of Bleichenbacher's Oracle Threat", "desc": "ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server.", "descriptions": [ { "label": "default", "data": "ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server." } ], "impact": 0.5, "refs": [ { "url": "https://ia.cr/2017/1189", "ref": "Paper: Return Of Bleichenbacher's Oracle Threat (ROBOT)" } ], "tags": { "sslattack": null, "tlsattack": null }, "code": "control 'robotattack' do\n title \"Return Of Bleichenbacher's Oracle Threat\"\n desc 'ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server.'\n ref \"Paper: Return Of Bleichenbacher's Oracle Threat (ROBOT)\", url: 'https://ia.cr/2017/1189'\n tag 'sslattack', 'tlsattack'\n impact 0.5\n only_if { sslports.length > 0 }\n\n sslports.each do |sslport|\n # create a description\n proc_desc = \"on node == #{target_hostname} running #{sslport[:socket].process.inspect} (#{sslport[:socket].pid})\"\n describe ssl(sslport).ciphers(/^TLS_RSA/i) do\n it(proc_desc) { should_not be_enabled }\n it { should_not be_enabled }\n end\n end\nend\n", "source_location": { "line": 575, "ref": "ssl-baseline-master/controls/ssl_test.rb" }, "waiver_data": {}, "results": [ { "status": "skipped", "code_desc": "No-op", "run_time": 7e-06, "start_time": "2020-07-06T17:54:49-04:00", "resource": "No-op", "skip_message": "Skipped control due to only_if condition." } ] } ], "status": "loaded" } ], "statistics": { "duration": 0.605412 }, "version": "4.19.2" }