Update ssh_config resource to support returning the current sshd_config file in use. #7070

aaronlippold · 2024-06-27T14:44:48Z

Signed-off-by: Aaron Lippold lippold@gmail.com
@DMedina6 is implementing and @aaronlippold is reviewing

Description

Updates to the testing requirements for various benchmarks require the ability to dynamically ask the sshd process which configuration file on the system is being used to configure the system.

This PR adds that ability to the ssh_config resource with a new resource sshd_active_config to active this and then inherit the rest of its interface from the existing sshd_config resource.

This is a blocker for profile updates to the latest revision of security profiles for the DoD STIGs.

PR Tasks

Related Issue

N/A

Types of changes

Bug fix (non-breaking change which fixes an issue)
New content (non-breaking change)
Breaking change (a content change which would break existing functionality or processes)

Checklist:

I have read the CONTRIBUTING document.

Signed-off-by: Aaron Lippold <lippold@gmail.com>

netlify · 2024-06-27T14:45:04Z

✅ Deploy Preview for chef-inspec ready!

Name	Link
🔨 Latest commit	`18d80a2`
🔍 Latest deploy log	https://app.netlify.com/sites/chef-inspec/deploys/669ff9bb024dd500083849a2
😎 Deploy Preview	https://deploy-preview-7070--chef-inspec.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

chef-expeditor · 2024-06-27T14:45:51Z

Hello aaronlippold! Thanks for the pull request!

Here is what will happen next:

Your PR will be reviewed by the maintainers.
Possible Outcomes
a. If everything looks good, one of them will approve it, and your PR will be merged.
b. The maintainer may request follow-on work (e.g. code fix, linting, etc). We would encourage you to address this work in 2-3 business days to keep the conversation going and to get your contribution in sooner.
c. Cases exist where a PR is neither aligned to Chef InSpec's product roadmap, or something the team can own or maintain long-term. In these cases, the maintainer will provide justification and close out the PR.

Thank you for contributing!

aaronlippold · 2024-06-27T15:22:43Z

odd thing we are seeing is that git is not allowing us to add the docs ... seeing if I can resolve it. gitignore seems to be correct.

…testing

… with a non-constant value (inspec#7079) * fix: update io reads to fix codescanning vuln Signed-off-by: Sonu Saha <sonu.saha@progress.com> * fix: remove kernel#open fallback and update open method to handle local files Signed-off-by: Sonu Saha <sonu.saha@progress.com> * fix: replace io.readlines to file.readlines Signed-off-by: Sonu Saha <sonu.saha@progress.com> * chore: fix lint offense, unnecessary space Signed-off-by: Sonu Saha <sonu.saha@progress.com> * fix: raise exception for standard errors as FetcherFailure Signed-off-by: Sonu Saha <sonu.saha@progress.com> * chore: update exception message Signed-off-by: Sonu Saha <sonu.saha@progress.com> --------- Signed-off-by: Sonu Saha <sonu.saha@progress.com>

Signed-off-by: Sonu Saha <sonu.saha@progress.com>

Obvious fix; these changes are the result of automation not creative thinking.

Signed-off-by: Ian Maddaus <ian.maddaus@progress.com>

Obvious fix; these changes are the result of automation not creative thinking.

Signed-off-by: Aaron Lippold <lippold@gmail.com>

aaronlippold · 2024-07-10T18:51:21Z

Thank you @IanMadd for the assist. @DMedina6 will update the two doc files and then look to see if we need to add a unit test or not for this enhancement.

lib/inspec/resources/ssh_config.rb

aaronlippold · 2024-07-13T23:27:56Z

docs-chef-io/content/inspec/resources/sshd_active_config.md

+    identifier = "inspec/resources/os/sshd_active_config.md sshd_active_config resource"
+    parent = "inspec/resources/os"
+++
+Use the `sshd_active_config` Chef InSpec audit resource to test configuration data for the OpenSSH daemon located at `/etc/ssh/sshd_active_config` on Linux and Unix platforms. sshd---the OpenSSH daemon---listens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command execution, and data exchanges.


I don't think /etc/ssh/sshd_active_config is what should be here correct?

The sshd active config finds the path of the sshd_config file by interrogating the active sshd process for the config file it is loaded with. Then we can say, all other functions and properties of the ssh and sshd resource are the same with the addition of the active_path variable available to the sshd_active_config resource which will be the path of the config file the sshd service reported as loaded.

My mistake. This has been corrected.

docs-chef-io/content/inspec/resources/sshd_active_config.md

clintoncwolfe

This looks very good from where I sit. There is a linting concern - I opened a PR against your branch to resolve, mitre#1 .

I've also asked Product for clearance to include this in the next release of InSpec 6.

clintoncwolfe · 2024-07-23T12:08:43Z

docs-chef-io/content/inspec/resources/sshd_active_config.md

+
+### Version
+
+This resource first became available in v1.0.0 of InSpec.


This has been approved by Product and is expected to be in v6.8.0 - you may update the docs.

Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>

updated version

clintoncwolfe

Thanks!

…/inspec into sshd-config-active-testing

…ig file in use. (#7070) * modify resource * windows compatibility * end line * removing comments to clean things up Signed-off-by: Aaron Lippold <lippold@gmail.com> * CHEF-12175: Remove use of `Kernel.open` or `IO.read` or similar sinks with a non-constant value (#7079) * fix: update io reads to fix codescanning vuln Signed-off-by: Sonu Saha <sonu.saha@progress.com> * fix: remove kernel#open fallback and update open method to handle local files Signed-off-by: Sonu Saha <sonu.saha@progress.com> * fix: replace io.readlines to file.readlines Signed-off-by: Sonu Saha <sonu.saha@progress.com> * chore: fix lint offense, unnecessary space Signed-off-by: Sonu Saha <sonu.saha@progress.com> * fix: raise exception for standard errors as FetcherFailure Signed-off-by: Sonu Saha <sonu.saha@progress.com> * chore: update exception message Signed-off-by: Sonu Saha <sonu.saha@progress.com> --------- Signed-off-by: Sonu Saha <sonu.saha@progress.com> * fix: Missing regular expression anchor (#7077) Signed-off-by: Sonu Saha <sonu.saha@progress.com> * Bump version to 6.6.27 by Chef Expeditor Obvious fix; these changes are the result of automation not creative thinking. * Fix gitignore file in docs dir (#7082) Signed-off-by: Ian Maddaus <ian.maddaus@progress.com> * Bump version to 6.6.28 by Chef Expeditor Obvious fix; these changes are the result of automation not creative thinking. * adding docs now that the gitignore is fixed. Signed-off-by: Aaron Lippold <lippold@gmail.com> * add docs for sshd_active_config resource * fix docs * unit tests * rubocop on ssh_config.rb, sshd_con_test.rb, and sshd_active_config.md * rename active path in method * doc fix * Linting Corrections for Active SSHD Config (#1) Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com> * Update sshd_active_config.md updated version * doc version update --------- Signed-off-by: Aaron Lippold <lippold@gmail.com> Signed-off-by: Sonu Saha <sonu.saha@progress.com> Signed-off-by: Ian Maddaus <ian.maddaus@progress.com> Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com> Co-authored-by: Daniel Medina <dmedina@mitre.org> Co-authored-by: Sonu Saha <98935583+ahasunos@users.noreply.github.com> Co-authored-by: Chef Expeditor <chef-ci@chef.io> Co-authored-by: Ian Maddaus <IanMadd@users.noreply.github.com> Co-authored-by: Clinton Wolfe <clintoncwolfe@gmail.com>

DMedina6 and others added 4 commits June 25, 2024 16:58

modify resource

2c08ca0

windows compatibility

02c4192

end line

ecbefb6

removing comments to clean things up

3b32f4f

Signed-off-by: Aaron Lippold <lippold@gmail.com>

aaronlippold requested a review from a team as a code owner June 27, 2024 14:44

aaronlippold requested review from clintoncwolfe and sathish-progress June 27, 2024 14:44

aaronlippold added the Partner: MITRE label Jun 27, 2024

aaronlippold marked this pull request as draft June 27, 2024 14:45

aaronlippold and others added 7 commits July 9, 2024 12:09

Merge remote-tracking branch 'upstream/main' into sshd-config-active-…

74ac917

…testing

fix: Missing regular expression anchor (inspec#7077)

22af36e

Signed-off-by: Sonu Saha <sonu.saha@progress.com>

Bump version to 6.6.27 by Chef Expeditor

bc40aa3

Obvious fix; these changes are the result of automation not creative thinking.

Fix gitignore file in docs dir (inspec#7082)

4ce13a7

Signed-off-by: Ian Maddaus <ian.maddaus@progress.com>

Bump version to 6.6.28 by Chef Expeditor

ed09c8e

Obvious fix; these changes are the result of automation not creative thinking.

adding docs now that the gitignore is fixed.

b09b86e

Signed-off-by: Aaron Lippold <lippold@gmail.com>

github-actions bot added the Documentation ZH multi-repo label for the docs-team label Jul 10, 2024

Merge branch 'inspec:main' into sshd-config-active-testing

b108def

aaronlippold commented Jul 11, 2024

View reviewed changes

lib/inspec/resources/ssh_config.rb Outdated Show resolved Hide resolved

aaronlippold commented Jul 11, 2024

View reviewed changes

lib/inspec/resources/ssh_config.rb Show resolved Hide resolved

DMedina6 added 5 commits July 13, 2024 14:13

add docs for sshd_active_config resource

04b3f6f

fix docs

0a17cd0

unit tests

1f6c99e

rubocop on ssh_config.rb, sshd_con_test.rb, and sshd_active_config.md

edf533d

rename active path in method

a290d87

aaronlippold marked this pull request as ready for review July 13, 2024 23:22

aaronlippold requested a review from a team as a code owner July 13, 2024 23:22

aaronlippold commented Jul 13, 2024

View reviewed changes

docs-chef-io/content/inspec/resources/sshd_active_config.md Show resolved Hide resolved

DMedina6 and others added 2 commits July 15, 2024 12:53

doc fix

38a4977

Merge branch 'inspec:main' into sshd-config-active-testing

54a9e47

clintoncwolfe reviewed Jul 23, 2024

View reviewed changes

clintoncwolfe and others added 3 commits July 23, 2024 12:15

Linting Corrections for Active SSHD Config (#1)

ee129e2

Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>

Merge branch 'inspec:main' into sshd-config-active-testing

ab876ce

Update sshd_active_config.md

0cec320

updated version

clintoncwolfe approved these changes Jul 23, 2024

View reviewed changes

clintoncwolfe added the Expeditor: Bump Minor Version label Jul 23, 2024

DMedina6 added 2 commits July 23, 2024 14:42

doc version update

b97340b

Merge branch 'sshd-config-active-testing' of https://github.com/mitre…

18d80a2

…/inspec into sshd-config-active-testing

Vasu1105 merged commit 0ab3568 into inspec:main Jul 24, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update ssh_config resource to support returning the current sshd_config file in use. #7070

Update ssh_config resource to support returning the current sshd_config file in use. #7070

Uh oh!

aaronlippold commented Jun 27, 2024 •

edited

Loading

Uh oh!

netlify bot commented Jun 27, 2024 •

edited

Loading

Uh oh!

chef-expeditor bot commented Jun 27, 2024

Uh oh!

aaronlippold commented Jun 27, 2024

Uh oh!

aaronlippold commented Jul 10, 2024

Uh oh!

Uh oh!

Uh oh!

aaronlippold Jul 13, 2024 •

edited

Loading

Uh oh!

DMedina6 Jul 16, 2024

Uh oh!

Uh oh!

clintoncwolfe left a comment

Uh oh!

clintoncwolfe Jul 23, 2024

Uh oh!

DMedina6 Jul 23, 2024

Uh oh!

clintoncwolfe left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants


		### Version

		This resource first became available in v1.0.0 of InSpec.

Update ssh_config resource to support returning the current sshd_config file in use. #7070

Update ssh_config resource to support returning the current sshd_config file in use. #7070

Uh oh!

Conversation

aaronlippold commented Jun 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

PR Tasks

Related Issue

Types of changes

Checklist:

Uh oh!

netlify bot commented Jun 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for chef-inspec ready!

Uh oh!

chef-expeditor bot commented Jun 27, 2024

Uh oh!

aaronlippold commented Jun 27, 2024

Uh oh!

aaronlippold commented Jul 10, 2024

Uh oh!

Uh oh!

Uh oh!

aaronlippold Jul 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DMedina6 Jul 16, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

clintoncwolfe left a comment

Choose a reason for hiding this comment

Uh oh!

clintoncwolfe Jul 23, 2024

Choose a reason for hiding this comment

Uh oh!

DMedina6 Jul 23, 2024

Choose a reason for hiding this comment

Uh oh!

clintoncwolfe left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

aaronlippold commented Jun 27, 2024 •

edited

Loading

netlify bot commented Jun 27, 2024 •

edited

Loading

aaronlippold Jul 13, 2024 •

edited

Loading