mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 14:03:24 +00:00
os_sshd_permit_root_login_configure remediation code appends "permitrootlogin no" #205
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @cipineda on GitHub.
Originally assigned to: @brodjieski on GitHub.
Summary
The file created by the remediation code is appending the text "permitrootlogin no", each time the script is executed.
My file /etc/ssh/sshd_config.d/01-mscp-sshd.conf has 369 lines with the same text, I guess this is looping because of a previous issue (#194) I have open with you guys.
Steps to reproduce
This code, simply appends the text "permitrootlogin no", it does not check if the file is there and if the text already exists, it simply appends to it.
include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi echo "permitrootlogin no" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then breakOperating System version
ProductName: macOS
ProductVersion: 13.1
BuildVersion: 22C5050e
ProductName: macOS
ProductVersion: 13.0.1
BuildVersion: 22A400
Intel or Apple Silicon
Intel based process and Apple Silicon Mac
What is the current bug behavior?
the file /etc/ssh/sshd_config.d/01-mscp-sshd.conf has 369 with the same text "permitrootlogin no"
What is the expected correct behavior?
The remediation script should validate if the text already exists, and then simply exit
Relevant logs and/or screenshots
Output of checks
cat /etc/ssh/sshd_config.d/01-mscp-sshd.conf | wc -l369
cat 01-mscp-sshd.confpermitrootlogin no
permitrootlogin no
permitrootlogin no
permitrootlogin no
permitrootlogin no
permitrootlogin no
Possible fixes
check if the text "permitrootlogin no" exists on the file, if yes, then do not add to the conf file
result_value=$(cat ${include_dir}01-mscp-sshd.conf | grep "permitrootlogin no" | wc -l | xargs) if [[ $result_value -eq 0 ]]; then echo "permitrootlogin no" >> "${include_dir}01-mscp-sshd.conf" fi@robertgendler commented on GitHub:
this fix was merged into main. closing the issue.
@sambacha commented on GitHub:
This issue still exists
@brodjieski commented on GitHub:
The remediation script will only run the code if it has identified a failed check. If you are seeing that the remediation code continues to run, and is appending multiple entries, then the check still is not passing, and there is a misconfiguration on the system. Verify that your sshd configuration is not configured with
permitrootloginto be any other value thanno.This typically is the case if there is an entry for
permitrootlogindefined in the/etc/ssh/sshd_configfile prior to theIncludedirective, or an included config file that is processed before the01-mscp-sshd.conffile with the entry present.Use
sudo /usr/sbin/sshd -T | /usr/bin/awk '/permitrootlogin/{print $2}'to ensure the return value isno.If we were to add the test for the existence of
permitrootlogin noto the01-mscp-sshd.conffile, while it would help prevent multiple entries in the file, it wouldn't solve the issue of a misconfiguration. Seeing this duplicate entry in the file is a good indicator that something is not quite right with the setup.@robertgendler commented on GitHub:
@sambacha what branch are you working off of? Because I'm not seeing this happen when using the most current
@golbiga commented on GitHub:
We're going to look into updating the ssh fix to prevent duplicates.
@sambacha commented on GitHub:
Sonoma
@robertgendler commented on GitHub:
Still not seeing it. I've tried re-creating the issue and it's working fine and not duplicating "permitrootlogin no"
You'll need to provide either a copy of the rule file from your set up or screenshot or something?