sshd_config custom path (#161)

* sshd_config custom path

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* ssh config custom path

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

* custom user for sshd_config file and folder

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

Author: micheelengronne

controls/ssh_spec.rb

@@ -49,7 +49,7 @@
   impact 1.0
   title 'Client: Specify the AddressFamily to your need'
   desc 'OpenSSH should be configured to the network family. Set it to inet if you use IPv4 only. For IPv6 only set it to inet6.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('AddressFamily') { should match(/inet|inet6|any/) }
   end
 end
@@ -58,7 +58,7 @@
   impact 1.0
   title 'Client: Specify expected ssh port'
   desc 'Always specify which port the SSH client should connect. Prevent unexpected settings.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('Port') { should eq('22') }
   end
 end
@@ -67,7 +67,7 @@
   impact 1.0
   title 'Client: Specify protocol version 2'
   desc "Only SSH protocol version 2 connections should be permitted. Version 1 of the protocol contains security vulnerabilities. Don't use legacy insecure SSHv1 connections anymore."
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('Protocol') { should eq('2') }
   end
 end
@@ -76,7 +76,7 @@
   impact 1.0
   title 'Client: Disable batch mode'
   desc 'Avoid batch mode in the default configuration.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('BatchMode') { should eq('no') }
   end
 end
@@ -85,7 +85,7 @@
   impact 1.0
   title 'Client: Check Host IPs'
   desc 'Make sure that SSH checks the host IP address in the known_hosts file, to avoid DNS spoofing effects.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('CheckHostIP') { should eq('yes') }
   end
 end
@@ -94,7 +94,7 @@
   impact 1.0
   title 'Client: Ask when checking host keys'
   desc "Don't automatically add new hosts keys to the list of known hosts."
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('StrictHostKeyChecking') { should match(/ask|yes/) }
   end
 end
@@ -103,7 +103,7 @@
   impact 1.0
   title 'Client: Check for secure ssh ciphers'
   desc 'Configure a list of ciphers to the best secure ciphers (avoid older and weaker ciphers)'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('Ciphers') { should eq(ssh_crypto.valid_ciphers) }
   end
 end
@@ -112,7 +112,7 @@
   impact 1.0
   title 'Client: Check for secure ssh Key-Exchange Algorithm'
   desc 'Configure a list of Key-Exchange Algorithms (Kexs) to the best secure Kexs (avoid older and weaker Key-Exchange Algorithm)'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('KexAlgorithms') { should eq(ssh_crypto.valid_kexs) }
   end
 end
@@ -121,7 +121,7 @@
   impact 1.0
   title 'Client: Check for secure ssh Message Authentication Codes'
   desc 'Configure a list of Message Authentication Codes (MACs) to the best secure MACs (avoid older and weaker Message Authentication Codes)'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('MACs') { should eq(ssh_crypto.valid_macs) }
   end
 end
@@ -130,7 +130,7 @@
   impact 1.0
   title 'Client: Disable agent forwarding'
   desc 'Prevent agent forwarding by default, as it can be used in a limited way to enable attacks.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('ForwardAgent') { should eq('no') }
   end
 end
@@ -139,7 +139,7 @@
   impact 1.0
   title 'Client: Disable X11Forwarding'
   desc 'Prevent X11 forwarding by default, as it can be used in a limited way to enable attacks.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('ForwardX11') { should eq('no') }
   end
 end
@@ -148,7 +148,7 @@
   impact 1.0
   title 'Client: Disable HostbasedAuthentication'
   desc 'This option is a weak way for authentication and provide attacker more ways to enter the system.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('HostbasedAuthentication') { should eq('no') }
   end
 end
@@ -158,7 +158,7 @@
   title 'Client: Disable rhosts-based authentication'
   desc 'Avoid rhosts-based authentication, as it opens more ways for an attacker to enter a system.'
   only_if { ssh_crypto.ssh_version < 7.6 }
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('RhostsRSAAuthentication') { should eq('no') }
   end
 end
@@ -168,7 +168,7 @@
   title 'Client: Enable RSA authentication'
   desc 'Make sure RSA authentication is used by default.'
   only_if { ssh_crypto.ssh_version < 7.6 }
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('RSAAuthentication') { should eq('yes') }
   end
 end
@@ -177,7 +177,7 @@
   impact 1.0
   title 'Client: Disable password-based authentication'
   desc 'Avoid password-based authentications.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('PasswordAuthentication') { should eq('no') }
   end
 end
@@ -186,7 +186,7 @@
   impact 1.0
   title 'Client: Disable GSSAPIAuthentication'
   desc 'If you do not use GSSAPI authentication then disable it.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('GSSAPIAuthentication') { should eq('no') }
   end
 end
@@ -195,7 +195,7 @@
   impact 1.0
   title 'Client: Disable GSSAPIDelegateCredentials'
   desc 'If you do not use GSSAPI authentication then disable it.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('GSSAPIDelegateCredentials') { should eq('no') }
   end
 end
@@ -204,7 +204,7 @@
   impact 1.0
   title 'Client: Disable tunnels'
   desc 'Avoid using SSH tunnels.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('Tunnel') { should eq('no') }
   end
 end
@@ -213,7 +213,7 @@
   impact 1.0
   title 'Client: Do not permit local commands'
   desc 'Do not permit any local command execution.'
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('PermitLocalCommand') { should eq('no') }
   end
 end
@@ -223,7 +223,7 @@
   title 'Client: Do not allow Roaming'
   desc 'Workaround for SSH Client Bug CVE-2016-0777 and CVE-2016-0778'
   only_if { ssh_crypto.ssh_version < 7.2 }
-  describe ssh_config do
+  describe ssh_config(ssh_custom_path + '/ssh_config') do
     its('UseRoaming') { should eq('no') }
   end
 end