Verify Group Who Owns /etc/sysconfig/sshd File
Description
To properly set the group owner of /etc/sysconfig/sshd, run the command:
$ sudo chgrp root /etc/sysconfig/sshd
Rationale
The /etc/sysconfig/sshd file contains configuration options for the SSH daemon.
Protection of this file is important for system security. The file should be owned by the root
group to prevent unauthorized changes.
Shell script
The following script can be run on the host to remediate the issue.
#!/bin/bash
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-core; then
newgroup=""
if getent group "0" >/dev/null 2>&1; then
newgroup="0"
fi
if [[ -z "${newgroup}" ]]; then
>&2 echo "0 is not a defined group on the system"
else
if ! stat -c "%g %G" "/etc/sysconfig/sshd" | grep -E -w -q "0"; then
chgrp --no-dereference "$newgroup" /etc/sysconfig/sshd
fi
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Gather the package facts
package_facts:
manager: auto
tags:
- CCE-89268-7
- configure_strategy
- file_groupowner_etc_sysconfig_sshd
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
- name: Set the file_groupowner_etc_sysconfig_sshd_newgroup variable if represented
by gid
ansible.builtin.set_fact:
file_groupowner_etc_sysconfig_sshd_newgroup: '0'
when: '"kernel-core" in ansible_facts.packages'
tags:
- CCE-89268-7
- configure_strategy
- file_groupowner_etc_sysconfig_sshd
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
- name: Test for existence /etc/sysconfig/sshd
ansible.builtin.stat:
path: /etc/sysconfig/sshd
register: file_exists
when: '"kernel-core" in ansible_facts.packages'
tags:
- CCE-89268-7
- configure_strategy
- file_groupowner_etc_sysconfig_sshd
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
- name: Ensure group owner on /etc/sysconfig/sshd
ansible.builtin.file:
path: /etc/sysconfig/sshd
follow: false
group: '{{ file_groupowner_etc_sysconfig_sshd_newgroup }}'
when:
- '"kernel-core" in ansible_facts.packages'
- file_exists.stat is defined and file_exists.stat.exists
tags:
- CCE-89268-7
- configure_strategy
- file_groupowner_etc_sysconfig_sshd
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
