Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[5.2.18] Script breaks due to space separation in ALLOWED_USERS #227

Closed
lgaida opened this issue Jan 3, 2024 · 0 comments · Fixed by #228
Closed

[5.2.18] Script breaks due to space separation in ALLOWED_USERS #227

lgaida opened this issue Jan 3, 2024 · 0 comments · Fixed by #228
Assignees

Comments

@lgaida
Copy link
Contributor

lgaida commented Jan 3, 2024

In sshd_config the AllowUsers entry allows multiple users to be supplied by using space-separation but the script responsible for configuring it (5.2.18_sshd_limit_access) breaks if you use multiple space-separated users.

It works for a single user. E.g:
5.2.18_sshd_limit_acces.cfg

# Configuration for 5.2.18_sshd_limit_access
status=enabled
# Put here ssh user hardening list, there is a default in script to not break your configuration
# However, it can erase current configuration
ALLOWED_USERS='johndoe'
ALLOWED_GROUPS=''
DENIED_USERS=''
DENIED_GROUPS=''
5.2.18_sshd_limit_access  [ OK ] ^AllowUsers[[:space:]]*johndoe is present in /etc/ssh/sshd_config

But breaks when adding a second user. E.g:
5.2.18_sshd_limit_acces.cfg

# Configuration for 5.2.18_sshd_limit_access
status=enabled
# Put here ssh user hardening list, there is a default in script to not break your configuration
# However, it can erase current configuration
ALLOWED_USERS='johndoe janedoe'
ALLOWED_GROUPS=''
DENIED_USERS=''
DENIED_GROUPS=''
5.2.18_sshd_limit_access  [ OK ] ^AllowUsers[[:space:]]*johndoe is present in /etc/ssh/sshd_config
5.2.18_sshd_limit_access  [ KO ] ^janedoe'[[:space:]]*janedoe is not present in /etc/ssh/sshd_config

It is not even checking the right thing. Using this script with a .cfg with multiple allowed users and --apply will result in a broken sshd_config since a new line will be added to the sshd_config

janedoe' janedoe
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants