Skip to content

Do not use PrintLastLog for Archlinux #897

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Do not use PrintLastLog for Archlinux #897

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions molecule/ssh_hardening/verify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,11 @@
ansible.builtin.command: >
docker run
--volume /run/docker.sock:/run/docker.sock
--volume ./waivers_{{ lookup('env', 'MOLECULE_DISTRO') }}.yaml:/waivers.yaml
docker.io/cincproject/auditor exec
-t docker://instance
--no-show-progress --no-color
--waiver-file /waivers.yaml
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know you copied this over from the FreeBSD tests, but I don't think we should do that here in this case. I would much rather prefer that we adapt our baseline (https://github.com/dev-sec/linux-baseline). Are you up to adding your changes there instead?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess you're talking about ssh-baseline ?
I'm not familar at all with ruby.

Would this diff be ok:

diff --git a/controls/sshd_spec.rb b/controls/sshd_spec.rb
index a81db94c74..6f04a6f263 100644
--- a/controls/sshd_spec.rb
+++ b/controls/sshd_spec.rb
@@ -466,8 +466,10 @@
   impact 1.0
   title 'Server: PrintLastLog'
   desc 'This tells the SSH daemon to print out information about the last time you logged in.'
-  describe sshd_config("#{sshd_custom_path}/sshd_config") do
-    its('PrintLastLog') { should eq('no') }
+  if os.name != 'arch'
+    describe sshd_config("#{sshd_custom_path}/sshd_config") do
+      its('PrintLastLog') { should eq('no') }
+    end
   end
 end

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess you're talking about ssh-baseline ? I'm not familar at all with ruby.

You are absolutely right ;)

Would this diff be ok:

diff --git a/controls/sshd_spec.rb b/controls/sshd_spec.rb
index a81db94c74..6f04a6f263 100644
--- a/controls/sshd_spec.rb
+++ b/controls/sshd_spec.rb
@@ -466,8 +466,10 @@
   impact 1.0
   title 'Server: PrintLastLog'
   desc 'This tells the SSH daemon to print out information about the last time you logged in.'
-  describe sshd_config("#{sshd_custom_path}/sshd_config") do
-    its('PrintLastLog') { should eq('no') }
+  if os.name != 'arch'
+    describe sshd_config("#{sshd_custom_path}/sshd_config") do
+      its('PrintLastLog') { should eq('no') }
+    end
   end
 end

Using a plain if in controls is discouraged, there is a special construct only_if for this kind of conditions. A example use in the baseline is implemented there: https://github.com/dev-sec/ssh-baseline/blob/master/controls/sshd_spec.rb#L515. Checking for a specific OS looks like that: https://github.com/dev-sec/cis-docker-benchmark/blob/master/controls/docker_daemon_configuration_files.rb#L498

I am a bit split between detecting the OS or detecting the support of the config option, for example sshd -G | grep -qi PrintLastLog would do a specific detection if this version of sshd supports the option.

You are welcome to contribute this but I can also adapt the baseline if you are not comfortable introducing changes there.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi,
I've taken a step back on using ansible for hardenning for now, thus it would certainly be more efficient if you adapt the baseline yourself…
Sorry for not doing the whole job…

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@matclab no hard feelings. Many thanks for bringing this to our attention, I will take over from here.

--no-distinct-exit https://github.com/dev-sec/ssh-baseline/archive/refs/heads/master.zip
register: test_results
changed_when: false
Expand Down
3 changes: 3 additions & 0 deletions molecule/ssh_hardening/waivers_arch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
sshd-45:
run: false
justification: "PrintLastLog is unsupported on ArchLinux.
2 changes: 1 addition & 1 deletion roles/ssh_hardening/templates/opensshd.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -253,7 +253,7 @@ UseDNS {{ 'yes' if (ssh_use_dns|bool) else 'no' }}

PrintMotd {{ 'yes' if (ssh_print_motd|bool) else 'no' }}

{% if ansible_facts.os_family != 'FreeBSD' %}
{% if ansible_facts.os_family not in ('FreeBSD','Archlinux') %}
PrintLastLog {{ 'yes' if (ssh_print_last_log|bool) else 'no' }}
{% endif %}

Expand Down