openstack/openstack-ansible-security
Code Issues Proposed changes

Merge "Set permissions on sshd host keys [+Docs]"

Browse Source
This commit is contained in:
Jenkins
2016-12-10 22:14:36 +00:00
committed by Gerrit Code Review
parent 325fe758d3 f92f29d134
commit 1bec8e6bcc
3 changed files with 32 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
doc/metadata/rhel7/RHEL-07-040640.rst
View File

@@ -1,7 +1,9 @@
---
id: RHEL-07-040640
status: not implemented
tag: misc
status: implemented
tag: sshd
---
This STIG requirement is not yet implemented.
The permissions on ssh public host keys is set to ``0644``. If the existing
permissions are more restrictive than ``0644``, the tasks do not make changes
to the files.

8
doc/metadata/rhel7/RHEL-07-040650.rst
View File

@@ -1,7 +1,9 @@
---
id: RHEL-07-040650
status: not implemented
tag: misc
status: implemented
tag: sshd
---
This STIG requirement is not yet implemented.
The permissions on ssh private host keys is set to ``0600``. If the existing
permissions are more restrictive than ``0600``, the tasks do not make changes
to the files.

22
tasks/rhel7stig/sshd.yml
View File

@@ -85,3 +85,25 @@
- medium
- sshd
- RHEL-07-040261
- name: Public host key files must have mode 0644 or less
file:
path: "{{ item }}"
mode: "u-xX,g-wxs,o-wxt"
with_fileglob:
- /etc/ssh/*.pub
tags:
- medium
- sshd
- RHEL-07-040640
- name: Private host key files must have mode 0600 or less
file:
path: "{{ item }}"
mode: "u-xX,g-rwxs,o-rwxt"
with_fileglob:
- /etc/ssh/*_key
tags:
- medium
- sshd
- RHEL-07-040650