8000 False Positive finding with `harden_sshd_ciphers_openssh_conf_crypto_policy` on Gitlab UBI 9 container · Issue #13440 · ComplianceAsCode/content · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

False Positive finding with harden_sshd_ciphers_openssh_conf_crypto_policy on Gitlab UBI 9 container #13440

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
awilmo8 opened this issue May 7, 2025 · 1 comment
Open

False Positive finding with harden_sshd_ciphers_openssh_conf_crypto_policy on Gitlab UBI 9 container #13440

awilmo8 opened this issue May 7, 2025 · 1 comment
Labels
triaged

Comments

@awilmo8
Copy link
awilmo8 commented May 7, 2025

Description of problem:

  • The check xccdf_org.ssgproject.content_rule_harden_sshd_ciphers_openssh_conf_crypto_policy in STIG mode presents a false positive finding when ran on our minimized UBI 9 containers.
  • I have not identified the specific spot where the check is failing, but the check is either failing to access /etc/crypto-policies/back-ends/openssh.config or the regex is failing to parse the Ciphers line from the config file.

SCAP Security Guide Version:

  • Using the packages available in the Ubuntu 24.04 repository
Package: ssg-base
Version: 0.1.71-1
Priority: optional
Section: universe/admin
Source: scap-security-guide
Origin: Ubuntu

Package: ssg-nondebian
Version: 0.1.71-1
Priority: optional
Section: universe/admin
Source: scap-security-guide

Operating System Version:

RHEL 9.5 / UBI 9.5

Steps to Reproduce:

  1. Setup OpenSCAP, OpenSCAP-Podman, SSG - relevant bootstrap script
  2. Pull the Gitlab CNG Fips container podman pull registry.gitlab.com/gitlab-org/build/cng/gitlab-base:master-fips
  3. Run the check (replace $image with the image hash of the container) - oscap-podman $image xccdf eval --report /tmp/cng-base-stig.html --profile xccdf_org.ssgproject.content_profile_stig /usr/share/xml/scap/ssg/content/ssg-rhel9-ds-1.2.xml
  4. Review the result HTML for "Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config" and see that it fails
  5. run the container, exec into it and check the ciphers manually -
  • podman run --rm -it $image /bin/bash
  • cat /etc/crypto-policies/back-ends/openssh.config | grep Ciphers

Actual Results:

fail

Expected Results:

pass

Additional Information/Debugging Steps:

  • This is not related to our containers not having aes192-ctr as I still get this issue when I tailor that out of the check.
  • I was unable to find the exact check code when digging through the XML - if you can point me to the check in the code I can do more testing to see if I can provide a fix.
@Mab879 Mab879 added the triaged label May 15, 2025
@Mab879
Copy link
Member
Mab879 commented May 15, 2025

That SSG version is rather old, December 2023. Can you please try using the latest release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Mab879 @awilmo8
0