diff --git a/components/crypto-policies.yml b/components/crypto-policies.yml index b15f25fbd36..499a93a4531 100644 --- a/components/crypto-policies.yml +++ b/components/crypto-policies.yml @@ -12,6 +12,10 @@ rules: - configure_openssl_crypto_policy - configure_openssl_tls_crypto_policy - configure_ssh_crypto_policy +- crypto_sub_policy_sshd_ciphers +- crypto_sub_policy_sshd_macs +- crypto_sub_policy_sshd_cbc +- crypto_sub_policy_weak_macs - harden_openssl_crypto_policy - harden_ssh_client_crypto_policy - harden_sshd_ciphers_openssh_conf_crypto_policy diff --git a/components/openssh.yml b/components/openssh.yml index e89f5bbba93..c428e322967 100644 --- a/components/openssh.yml +++ b/components/openssh.yml @@ -9,6 +9,9 @@ packages: - openssh-clients - openssh-server rules: +- crypto_sub_policy_sshd_cbc +- crypto_sub_policy_sshd_ciphers +- crypto_sub_policy_sshd_macs - directory_groupowner_sshd_config_d - directory_owner_sshd_config_d - directory_permissions_sshd_config_d diff --git a/controls/cis_rhel8.yml b/controls/cis_rhel8.yml index a3365c4ea77..f188d8e53a7 100644 --- a/controls/cis_rhel8.yml +++ b/controls/cis_rhel8.yml @@ -556,24 +556,18 @@ controls: levels: - l1_server - l1_workstation - status: pending - notes: |- - It is necessary a new rule to ensure a module disabling CBC in - /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. - related_rules: - - configure_crypto_policy + status: automated + rules: + - crypto_sub_policy_sshd_cbc - id: 1.6.4 title: Ensure system wide crypto policy disables macs less than 128 bits (Automated) levels: - l1_server - l1_workstation - status: pending - notes: |- - It is necessary a new rule to ensure a module disabling weak MACs in - /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. - related_rules: - - configure_crypto_policy + status: automated + rules: + - crypto_sub_policy_weak_macs - id: 1.7.1 title: Ensure message of the day is configured properly (Automated) @@ -1504,8 +1498,7 @@ controls: notes: |- Introduced in CIS RHEL8 v3.0.0 rules: - - sshd_use_approved_ciphers - - sshd_approved_ciphers=cis_rhel8 + - crypto_sub_policy_sshd_ciphers - id: 4.2.7 title: Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured (Automated) @@ -1594,8 +1587,7 @@ controls: - l1_workstation status: automated rules: - - sshd_use_strong_macs - - sshd_strong_macs=cis_rhel8 + - crypto_sub_policy_sshd_macs - id: 4.2.15 title: Ensure sshd MaxAuthTries is configured (Automated) diff --git a/docs/templates/template_reference.md b/docs/templates/template_reference.md index a6bc1095c21..62f9232bf62 100644 --- a/docs/templates/template_reference.md +++ b/docs/templates/template_reference.md @@ -245,6 +245,21 @@ - Languages: OVAL, Kubernetes +#### crypto_sub_policy +- Configures a sub policy for system wide crypto policies. Creates a module + file `module_name.pmod` in `/etc/crypto-policies/policies/modules/` that + contains `key = value`. Then, it applies this module. + +- Parameters: + + - **module_name** - crypto sub policy name, eg. `NO-SSHWEAKCIPHERS` + + - **key** - entry key, eg. `cipher@SSH` + + - **value** - entry value, eg. `-3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC -CHACHA20-POLY1305` + +- Languages: Ansible, Bash, OVAL + #### dconf_ini_file - Checks for `dconf` configuration. Additionally checks if the configuration is locked so it cannot be overridden by the user. diff --git a/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_sshd_cbc/rule.yml b/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_sshd_cbc/rule.yml new file mode 100644 index 00000000000..be58854686b --- /dev/null +++ b/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_sshd_cbc/rule.yml @@ -0,0 +1,33 @@ +documentation_complete: true + +title: Implement Custom Crypto Policy to disable CBC mode ciphers + +{{% set module_name = "NO-SSHCBC" %}} +{{% set key = "cipher@SSH" %}} +{{% set value = "-*-CBC" %}} + +description: |- + Create a custom crypto policy module for SSHD to disable CBC mode ciphers. + {{{ describe_crypto_sub_policy(module_name, key, value) }}} + +rationale: |- + CBC mode ciphers are vulnerable to certain attacks, such as the BEAST attack. + Disabling CBC mode ciphers helps protect against these attacks and ensures that only + strong, proven cryptographic algorithms are used to protect SSH communications. + +severity: medium + +identifiers: + cce@rhel8: CCE-86956-0 + +ocil_clause: 'the custom crypto policy module for SSHD to disable CBC mode ciphers does not exist' + +ocil: |- + {{{ ocil_crypto_sub_policy(module_name, key, value) }}} + +template: + name: crypto_sub_policy + vars: + module_name: {{{ module_name }}} + key: {{{ key }}} + value: {{{ value }}} diff --git a/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_sshd_ciphers/rule.yml b/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_sshd_ciphers/rule.yml new file mode 100644 index 00000000000..9dee0b6e111 --- /dev/null +++ b/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_sshd_ciphers/rule.yml @@ -0,0 +1,32 @@ +documentation_complete: true + +title: Implement Custom Crypto Policy for SSHD Ciphers + +{{% set module_name = "NO-SSHWEAKCIPHERS" %}} +{{% set key = "cipher@SSH" %}} +{{% set value = "-3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC -CHACHA20-POLY1305" %}} + +description: |- + Create a custom crypto policy module for SSHD to enforce the use of strong ciphers. + {{{ describe_crypto_sub_policy(module_name, key, value) }}} + +rationale: |- + Weak ciphers that are used for authentication to the cryptographic module cannot be + relied upon to provide confidentiality or integrity, and system data may be compromised. + +severity: medium + +identifiers: + cce@rhel8: CCE-86707-7 + +ocil_clause: 'the custom crypto policy module for SSH does not exist' + +ocil: |- + {{{ ocil_crypto_sub_policy(module_name, key, value) }}} + +template: + name: crypto_sub_policy + vars: + module_name: {{{ module_name }}} + key: {{{ key }}} + value: {{{ value }}} diff --git a/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_sshd_macs/rule.yml b/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_sshd_macs/rule.yml new file mode 100644 index 00000000000..1bbf6cb333d --- /dev/null +++ b/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_sshd_macs/rule.yml @@ -0,0 +1,36 @@ +documentation_complete: true + +title: Implement Custom Crypto Policy for SSHD MACs + +{{% set module_name = "NO-SSHWEAKMACS" %}} +{{% set key = "mac@SSH" %}} +{{% set value = "-HMAC-MD5* -UMAC-64* -UMAC-128*" %}} + +description: |- + Create a custom crypto policy module for SSHD to enforce the use of strong MACs. + {{{ describe_crypto_sub_policy(module_name, key, value) }}} + +rationale: |- + Message Authentication Codes (MACs) are cryptographic mechanisms used to verify the + integrity and authenticity of data transmitted over SSH connections. Weak MACs that + are used for authentication to the cryptographic module cannot be relied upon to + provide integrity, and system data may be compromised. Implementing a custom crypto + policy that disables weak MAC algorithms helps ensure that only strong, proven + cryptographic algorithms are used to protect SSH communications. + +severity: medium + +identifiers: + cce@rhel8: CCE-86952-9 + +ocil_clause: 'the custom crypto policy module for SSH does not exist' + +ocil: |- + {{{ ocil_crypto_sub_policy(module_name, key, value) }}} + +template: + name: crypto_sub_policy + vars: + module_name: {{{ module_name }}} + key: {{{ key }}} + value: {{{ value }}} diff --git a/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_weak_macs/rule.yml b/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_weak_macs/rule.yml new file mode 100644 index 00000000000..6a97bab810d --- /dev/null +++ b/linux_os/guide/system/software/integrity/crypto/crypto_sub_policy_weak_macs/rule.yml @@ -0,0 +1,36 @@ +documentation_complete: true + +title: Implement Custom Crypto Policy to Disable Weak MAC Algorithms + +{{% set module_name = "NO-WEAKMAC" %}} +{{% set key = "mac" %}} +{{% set value = "-*-128*" %}} + +description: |- + Create a custom crypto policy module to disable weak MACs. + {{{ describe_crypto_sub_policy(module_name, key, value) }}} + +rationale: |- + Message Authentication Codes (MACs) are cryptographic mechanisms used to verify the + integrity and authenticity of data transmitted over SSH connections. Weak MACs + that are used for authentication to the cryptographic module cannot be relied upon to + provide integrity, and system data may be compromised. Implementing a custom crypto + policy that disables weak MAC algorithms helps ensure that only strong, proven + cryptographic algorithms are used to protect system data. + +severity: medium + +identifiers: + cce@rhel8: CCE-86958-6 + +ocil_clause: 'the custom crypto policy module to disable weak MACs does not exist' + +ocil: |- + {{{ ocil_crypto_sub_policy(module_name, key, value) }}} + +template: + name: crypto_sub_policy + vars: + module_name: {{{ module_name }}} + key: {{{ key }}} + value: {{{ value }}} diff --git a/products/rhel8/profiles/default.profile b/products/rhel8/profiles/default.profile index 21898474dbc..362f53b9eb2 100644 --- a/products/rhel8/profiles/default.profile +++ b/products/rhel8/profiles/default.profile @@ -726,3 +726,4 @@ selections: - service_rlogin_disabled - service_zebra_disabled - package_rsh-server_removed + - sshd_use_strong_macs diff --git a/shared/macros/01-general.jinja b/shared/macros/01-general.jinja index c945a9b92c1..3d68145ac9a 100644 --- a/shared/macros/01-general.jinja +++ b/shared/macros/01-general.jinja @@ -1446,3 +1446,20 @@ Create a rule description for rules using the `audit_rules_kernel_module_loading If the auditd daemon is configured to use the auditctl utility, add the line to file /etc/audit/audit.rules. {{% endmacro %}} + +{{# +Create a description text for rules that use the crypto_sub_policy template. + +:param module_name: crypto sub policy name, eg. `NO-SSHWEAKCIPHERS` +:type module_name: str +:param key: The entry key, eg. cipher@SSH +:type key: str +:param value: The entry value, eg. -3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC -CHACHA20-POLY1305 +:type value: str +#}} +{{% macro describe_crypto_sub_policy(module_name, key, value) %}} + Add the following line to the file /etc/crypto-policies/policies/modules/{{{ module_name }}}.pmod: + 
+    {{{ key }}} = {{{ value }}}
+
+{{%- endmacro %}} diff --git a/shared/macros/10-ocil.jinja b/shared/macros/10-ocil.jinja index 27c1ea4cffa..44de9ea778f 100644 --- a/shared/macros/10-ocil.jinja +++ b/shared/macros/10-ocil.jinja @@ -1538,3 +1538,20 @@ Create an OCIL text for rules that use the audit_rules_watch platform. -w {{{ path }}} -p wa -k {{{ key }}} {{% endif %}} {{% endmacro %}} + +{{# +Create an OCIL text for rules that use the crypto_sub_policy template. + +:param module_name: crypto sub policy name, eg. `NO-SSHWEAKCIPHERS` +:type module_name: str +:param key: The entry key, eg. cipher@SSH +:type key: str +:param value: The entry value, eg. -3DES-CBC -AES-128-CBC -AES-192-CBC -AES-256-CBC -CHACHA20-POLY1305 +:type value: str +#}} +{{% macro ocil_crypto_sub_policy(module_name, key, value) %}} + Verify that /etc/crypto-policies/policies/modules/{{{ module_name }}}.pmod exists and has the following content: + 
+    {{{ key }}} = {{{ value }}}
+
+{{% endmacro %}} diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 872b9b99746..929b62c3bea 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -72,7 +72,6 @@ CCE-86702-8 CCE-86703-6 CCE-86704-4 CCE-86706-9 -CCE-86707-7 CCE-86708-5 CCE-86709-3 CCE-86710-1 @@ -172,10 +171,7 @@ CCE-86934-7 CCE-86935-4 CCE-86936-2 CCE-86937-0 -CCE-86952-9 CCE-86955-2 -CCE-86956-0 -CCE-86958-6 CCE-86959-4 CCE-86963-6 CCE-86965-1 diff --git a/shared/templates/crypto_sub_policy/ansible.template b/shared/templates/crypto_sub_policy/ansible.template new file mode 100644 index 00000000000..9cdddb333ec --- /dev/null +++ b/shared/templates/crypto_sub_policy/ansible.template @@ -0,0 +1,26 @@ +# platform = multi_platform_all +# reboot = true +# strategy = configure +# complexity = low +# disruption = low + +- name: "{{{ rule_title }}} - Create custom crypto policy - {{{ KEY }}}" + ansible.builtin.lineinfile: + path: /etc/crypto-policies/policies/modules/{{{ MODULE_NAME }}}.pmod + owner: root + group: root + mode: '0644' + line: {{{ KEY }}} = {{{ VALUE }}} + create: true + regexp: "{{{ KEY }}}" + +- name: "{{{ rule_title }}} - Check current crypto policy" + ansible.builtin.command: update-crypto-policies --show + register: current_crypto_policy + changed_when: false + failed_when: false + check_mode: false + +- name: "{{{ rule_title }}} - Update crypto-policies" + ansible.builtin.command: update-crypto-policies --set DEFAULT:{{{ MODULE_NAME }}} + when: current_crypto_policy.stdout.strip() != "DEFAULT:{{{ MODULE_NAME }}}" diff --git a/shared/templates/crypto_sub_policy/bash.template b/shared/templates/crypto_sub_policy/bash.template new file mode 100644 index 00000000000..120cc074d75 --- /dev/null +++ b/shared/templates/crypto_sub_policy/bash.template @@ -0,0 +1,9 @@ +# platform = multi_platform_all +# reboot = true +# strategy = configure +# complexity = low +# disruption = low + +{{{ bash_file_contents("/etc/crypto-policies/policies/modules/" ~ MODULE_NAME ~ ".pmod", KEY ~ " = " ~ VALUE) }}} + +sudo update-crypto-policies --set DEFAULT:{{{ MODULE_NAME }}} diff --git a/shared/templates/crypto_sub_policy/oval.template b/shared/templates/crypto_sub_policy/oval.template new file mode 100644 index 00000000000..d62e790a22a --- /dev/null +++ b/shared/templates/crypto_sub_policy/oval.template @@ -0,0 +1,21 @@ + + + {{{ oval_metadata("Ensure that the custom crypto policy module " ~ MODULE_NAME ~ " is configured", rule_title=rule_title) }}} + + + + + + + + + + /etc/crypto-policies/policies/modules/ + {{{ MODULE_NAME }}}.pmod + ^{{{ KEY }}} = {{{ VALUE | escape_regex }}}$ + 1 + + diff --git a/shared/templates/crypto_sub_policy/template.yml b/shared/templates/crypto_sub_policy/template.yml new file mode 100644 index 00000000000..b57de6fbb63 --- /dev/null +++ b/shared/templates/crypto_sub_policy/template.yml @@ -0,0 +1,4 @@ +supported_languages: + - ansible + - bash + - oval diff --git a/shared/templates/crypto_sub_policy/tests/correct.pass.sh b/shared/templates/crypto_sub_policy/tests/correct.pass.sh new file mode 100644 index 00000000000..e7db70141c8 --- /dev/null +++ b/shared/templates/crypto_sub_policy/tests/correct.pass.sh @@ -0,0 +1,4 @@ +#!/bin/bash +cat > /etc/crypto-policies/policies/modules/{{{ MODULE_NAME }}}.pmod << EOF +{{{ KEY }}} = {{{ VALUE }}} +EOF diff --git a/shared/templates/crypto_sub_policy/tests/empty.fail.sh b/shared/templates/crypto_sub_policy/tests/empty.fail.sh new file mode 100644 index 00000000000..73a0455cebf --- /dev/null +++ b/shared/templates/crypto_sub_policy/tests/empty.fail.sh @@ -0,0 +1,2 @@ +#!/bin/bash +touch /etc/crypto-policies/policies/modules/{{{ MODULE_NAME }}}.pmod diff --git a/shared/templates/crypto_sub_policy/tests/file_dne.fail.sh b/shared/templates/crypto_sub_policy/tests/file_dne.fail.sh new file mode 100644 index 00000000000..e1519d3eb0a --- /dev/null +++ b/shared/templates/crypto_sub_policy/tests/file_dne.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash + +if [[ -f /etc/crypto-policies/policies/modules/{{{ MODULE_NAME }}}.pmod ]] +then + rm /etc/crypto-policies/policies/modules/{{{ MODULE_NAME }}}.pmod +fi diff --git a/shared/templates/crypto_sub_policy/tests/invalid.fail.sh b/shared/templates/crypto_sub_policy/tests/invalid.fail.sh new file mode 100644 index 00000000000..4e93ca370a5 --- /dev/null +++ b/shared/templates/crypto_sub_policy/tests/invalid.fail.sh @@ -0,0 +1,4 @@ +#!/bin/bash +cat > /etc/crypto-policies/policies/modules/{{{ MODULE_NAME }}}.pmod << EOF +{{{ KEY }}} = ABCDEFGHIJKLMNOPQRSTUVWXYZ +EOF diff --git a/tests/data/profile_stability/rhel8/cis.profile b/tests/data/profile_stability/rhel8/cis.profile index 8cead5964cb..0ba872705bb 100644 --- a/tests/data/profile_stability/rhel8/cis.profile +++ b/tests/data/profile_stability/rhel8/cis.profile @@ -109,6 +109,10 @@ configure_crypto_policy configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage +crypto_sub_policy_sshd_cbc +crypto_sub_policy_sshd_ciphers +crypto_sub_policy_sshd_macs +crypto_sub_policy_weak_macs dconf_db_up_to_date dconf_gnome_banner_enabled dconf_gnome_disable_automount @@ -349,7 +353,6 @@ set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth socket_systemd-journal-remote_disabled -sshd_approved_ciphers=cis_rhel8 sshd_disable_empty_passwords sshd_disable_rhosts sshd_disable_root_login @@ -367,10 +370,7 @@ sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 -sshd_use_approved_ciphers sshd_use_strong_kex -sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile sudo_require_authentication diff --git a/tests/data/profile_stability/rhel8/cis_server_l1.profile b/tests/data/profile_stability/rhel8/cis_server_l1.profile index 6fb27ec0032..fe37de884b8 100644 --- a/tests/data/profile_stability/rhel8/cis_server_l1.profile +++ b/tests/data/profile_stability/rhel8/cis_server_l1.profile @@ -44,6 +44,10 @@ configure_crypto_policy configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage +crypto_sub_policy_sshd_cbc +crypto_sub_policy_sshd_ciphers +crypto_sub_policy_sshd_macs +crypto_sub_policy_weak_macs dconf_db_up_to_date dconf_gnome_banner_enabled dconf_gnome_disable_automount @@ -251,7 +255,6 @@ set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth socket_systemd-journal-remote_disabled -sshd_approved_ciphers=cis_rhel8 sshd_disable_empty_passwords sshd_disable_rhosts sshd_disable_root_login @@ -269,10 +272,7 @@ sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 -sshd_use_approved_ciphers sshd_use_strong_kex -sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile sudo_require_authentication diff --git a/tests/data/profile_stability/rhel8/cis_workstation_l1.profile b/tests/data/profile_stability/rhel8/cis_workstation_l1.profile index e01bf4b95eb..7b1d3a66369 100644 --- a/tests/data/profile_stability/rhel8/cis_workstation_l1.profile +++ b/tests/data/profile_stability/rhel8/cis_workstation_l1.profile @@ -44,6 +44,10 @@ configure_crypto_policy configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage +crypto_sub_policy_sshd_cbc +crypto_sub_policy_sshd_ciphers +crypto_sub_policy_sshd_macs +crypto_sub_policy_weak_macs dconf_db_up_to_date dconf_gnome_banner_enabled dconf_gnome_disable_automount @@ -245,7 +249,6 @@ set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth socket_systemd-journal-remote_disabled -sshd_approved_ciphers=cis_rhel8 sshd_disable_empty_passwords sshd_disable_rhosts sshd_disable_root_login @@ -263,10 +266,7 @@ sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 -sshd_use_approved_ciphers sshd_use_strong_kex -sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile sudo_require_authentication diff --git a/tests/data/profile_stability/rhel8/cis_workstation_l2.profile b/tests/data/profile_stability/rhel8/cis_workstation_l2.profile index ea03d59545b..2d580418751 100644 --- a/tests/data/profile_stability/rhel8/cis_workstation_l2.profile +++ b/tests/data/profile_stability/rhel8/cis_workstation_l2.profile @@ -109,6 +109,10 @@ configure_crypto_policy configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage +crypto_sub_policy_sshd_cbc +crypto_sub_policy_sshd_ciphers +crypto_sub_policy_sshd_macs +crypto_sub_policy_weak_macs dconf_db_up_to_date dconf_gnome_banner_enabled dconf_gnome_disable_automount @@ -345,7 +349,6 @@ set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth socket_systemd-journal-remote_disabled -sshd_approved_ciphers=cis_rhel8 sshd_disable_empty_passwords sshd_disable_rhosts sshd_disable_root_login @@ -363,10 +366,7 @@ sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 -sshd_use_approved_ciphers sshd_use_strong_kex -sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile sudo_require_authentication