diff --git a/controls/cis_ubuntu2404.yml b/controls/cis_ubuntu2404.yml index a2f073cd94c..8826b8c0026 100644 --- a/controls/cis_ubuntu2404.yml +++ b/controls/cis_ubuntu2404.yml @@ -1705,11 +1705,10 @@ controls: levels: - l1_server - l1_workstation - related_rules: + rules: - var_sshd_set_maxstartups=10:30:60 - sshd_set_maxstartups - status: planned - notes: TODO. Partial/incorrect implementation exists.See related rules. Analogous to ubuntu2204/5.2.19. + status: automated - id: 5.1.19 title: Ensure sshd PermitEmptyPasswords is disabled (Automated) diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value_full.fail.sh similarity index 52% rename from linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value.fail.sh rename to linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value_full.fail.sh index 7987ffeca9d..9d9ff5a4f5a 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value.fail.sh +++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value_full.fail.sh @@ -2,7 +2,7 @@ # variables = var_sshd_set_maxstartups=10:30:60 if grep -q "^MaxStartups" /etc/ssh/sshd_config; then - sed -i "s/^MaxStartups.*/MaxStartups 10:30:60/" /etc/ssh/sshd_config + sed -i "s/^MaxStartups.*/MaxStartups 10:30:59/" /etc/ssh/sshd_config else - echo "MaxStartups 20:40:60" >> /etc/ssh/sshd_config + echo "MaxStartups 10:30:59" >> /etc/ssh/sshd_config fi diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value_rate.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value_rate.fail.sh new file mode 100644 index 00000000000..4451e83b700 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value_rate.fail.sh @@ -0,0 +1,8 @@ +#!/bin/bash +# variables = var_sshd_set_maxstartups=10:30:60 + +if grep -q "^MaxStartups" /etc/ssh/sshd_config; then + sed -i "s/^MaxStartups.*/MaxStartups 10:29:60/" /etc/ssh/sshd_config +else + echo "MaxStartups 10:29:60" >> /etc/ssh/sshd_config +fi diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value_start.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value_start.fail.sh new file mode 100644 index 00000000000..4a7ee0ad713 --- /dev/null +++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_maxstartups/tests/lenient_value_start.fail.sh @@ -0,0 +1,8 @@ +#!/bin/bash +# variables = var_sshd_set_maxstartups=10:30:60 + +if grep -q "^MaxStartups" /etc/ssh/sshd_config; then + sed -i "s/^MaxStartups.*/MaxStartups 11:30:60/" /etc/ssh/sshd_config +else + echo "MaxStartups 11:30:60" >> /etc/ssh/sshd_config +fi