SSH host keys don't exist at bootable container build time

[matusmarhefka]

Add warnings to rules configuring SSH host keys permissions and ownership that remediation is not possible at bootable container build time because SSH host keys are generated post-deployment (only once bootable container is booted).

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key'.
--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_private_key
@@ -5,6 +5,10 @@
 [description]:
 SSH server private keys, files that match the /etc/ssh/*_key glob, must be
 group-owned by ssh_keys group.
+
+[warning]:
+Remediation is not possible at bootable container build time because SSH host
+keys are generated post-deployment.
 
 [reference]:
 R50

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key'.
--- xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_groupownership_sshd_pub_key
@@ -5,6 +5,10 @@
 [description]:
 SSH server public keys, files that match the /etc/ssh/*.pub glob, must be
 group-owned by root group.
+
+[warning]:
+Remediation is not possible at bootable container build time because SSH host
+keys are generated post-deployment.
 
 [reference]:
 R50

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key'.
--- xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_ownership_sshd_private_key
@@ -5,6 +5,10 @@
 [description]:
 SSH server private keys, files that match the /etc/ssh/*_key glob, must be owned
 by root user.
+
+[warning]:
+Remediation is not possible at bootable container build time because SSH host
+keys are generated post-deployment.
 
 [reference]:
 R50

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key'.
--- xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_ownership_sshd_pub_key
@@ -5,6 +5,10 @@
 [description]:
 SSH server public keys, files that match the /etc/ssh/*.pub glob, must be owned
 by root user.
+
+[warning]:
+Remediation is not possible at bootable container build time because SSH host
+keys are generated post-deployment.
 
 [reference]:
 R50

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key'.
--- xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
+++ xccdf_org.ssgproject.content_rule_file_permissions_sshd_private_key
@@ -7,6 +7,10 @@
 If those files are owned by the root user and the root group, they have to have the 0600 permission or stricter.
 If they are owned by the root user, but by a dedicated group ssh_keys, they can have the 0640 permission or stricter.
 
+[warning]:
+Remediation is not possible at bootable container build time because SSH host
+keys are generated post-deployment.
+
 [reference]:
 12
 

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key'.
--- xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key
+++ xccdf_org.ssgproject.content_rule_file_permissions_sshd_pub_key
@@ -4,6 +4,10 @@
 
 [description]:
 To properly set the permissions of /etc/ssh/*.pub, run the command: $ sudo chmod 0644 /etc/ssh/*.pub
+
+[warning]:
+Remediation is not possible at bootable container build time because SSH host
+keys are generated post-deployment.
 
 [reference]:
 12

[codeclimate]

Code Climate has analyzed commit 0709b7c and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.6% (0.0% change).

View more on Code Climate.