Verify User Who Owns /etc/sysconfig/sshd File
Description
To properly set the owner of /etc/sysconfig/sshd, run the command:
$ sudo chown root /etc/sysconfig/sshd
Rationale
The /etc/sysconfig/sshd file contains configuration options for the SSH daemon.
Protection of this file is important for system security. The file should be owned by root
to prevent unauthorized changes.
Shell script
The following script can be run on the host to remediate the issue.
#!/bin/bash
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-core; then
newown=""
if id "0" >/dev/null 2>&1; then
newown="0"
fi
if [[ -z "$newown" ]]; then
>&2 echo "0 is not a defined user on the system"
else
if ! stat -c "%u %U" "/etc/sysconfig/sshd" | grep -E -w -q "0"; then
chown --no-dereference "$newown" /etc/sysconfig/sshd
fi
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Gather the package facts
package_facts:
manager: auto
tags:
- CCE-89269-5
- configure_strategy
- file_owner_etc_sysconfig_sshd
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
- name: Set the file_owner_etc_sysconfig_sshd_newown variable if represented by uid
ansible.builtin.set_fact:
file_owner_etc_sysconfig_sshd_newown: '0'
when: '"kernel-core" in ansible_facts.packages'
tags:
- CCE-89269-5
- configure_strategy
- file_owner_etc_sysconfig_sshd
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
- name: Test for existence /etc/sysconfig/sshd
ansible.builtin.stat:
path: /etc/sysconfig/sshd
register: file_exists
when: '"kernel-core" in ansible_facts.packages'
tags:
- CCE-89269-5
- configure_strategy
- file_owner_etc_sysconfig_sshd
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
- name: Ensure owner on /etc/sysconfig/sshd
ansible.builtin.file:
path: /etc/sysconfig/sshd
follow: false
owner: '{{ file_owner_etc_sysconfig_sshd_newown }}'
when:
- '"kernel-core" in ansible_facts.packages'
- file_exists.stat is defined and file_exists.stat.exists
tags:
- CCE-89269-5
- configure_strategy
- file_owner_etc_sysconfig_sshd
- low_complexity
- low_disruption
- medium_severity
- no_reboot_needed
