CMP-3978: Incorporate SSH version into obsolete parameter rules

[rhmdnd]

• Add parameter for obsolete sshd configuration options
• Only check ssh protocol if openssh < 7.0
• Only check UsePrivilegeSeparation if openssh < 7.5

[evgenyz]

Why not just platform: package[openssh-server]<7.0?

[evgenyz]

See: linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/rule.yml

[Mab879]

You will need add the package to shared/applicability/package.yml

[Mab879]

I will leave this open for now so ya'll can testing on this if needed.

[xiaojiey]

/retest

[openshift-ci]

@rhmdnd: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	2c0f9b1	link	true	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[xiaojiey]

verification pass:

1. on a 4.21 rhcos9 based cluster and openssh-server-8.7p1-45:

$ oc  debug node/ip-10-0-20-230.us-east-2.compute.internal -- chroot /host rpm -q openssh-server
Starting pod/ip-10-0-20-230us-east-2computeinternal-debug ...
To use host binaries, run `chroot /host`
openssh-server-8.7p1-45.el9.x86_64
Removing debug pod ...
$ cat ~/func/tailored-profile-ssh-rules_new.yaml 
apiVersion: compliance.openshift.io/v1alpha1
kind: TailoredProfile
metadata:
  annotations:
    compliance.openshift.io/product-type: Node
  name: ssh-rules-test-new
  namespace: openshift-compliance
spec:
  description: "TailoredProfile to test specific SSH rules"
  title: "SSH Rules Test Profile"
  enableRules:
    - name: upstream-rhcos4-sshd-allow-only-protocol2
      rationale: "Test SSH protocol 2 enforcement"
    - name: upstream-rhcos4-sshd-disable-rhosts-rsa
      rationale: "Test RhostsRSA disabled"
    - name: upstream-rhcos4-sshd-use-priv-separation
      rationale: "Test privilege separation enabled"
$ cat ~/func/tailored-profile-ssh-rules_old.yaml 
apiVersion: compliance.openshift.io/v1alpha1
kind: TailoredProfile
metadata:
  annotations:
    compliance.openshift.io/product-type: Node
  name: ssh-rules-test-old
  namespace: openshift-compliance
spec:
  description: "TailoredProfile to test specific SSH rules"
  title: "SSH Rules Test Profile"
  enableRules:
    - name: rhcos4-sshd-allow-only-protocol2
      rationale: "Test SSH protocol 2 enforcement"
    - name: rhcos4-sshd-disable-rhosts-rsa
      rationale: "Test RhostsRSA disabled"
    - name: rhcos4-sshd-use-priv-separation
      rationale: "Test privilege separation enabled"
$ oc-compliance bind -N test -S default-auto-apply tailoredprofile/ssh-rules-test-new tailoredprofile/ssh-rules-test-old
Creating ScanSettingBinding test
xiyuan@xiyuan-thinkpadp1gen7:~/isc/content$ cat ~/func/tailored-profile-ssh-rules_old.yaml 
apiVersion: compliance.openshift.io/v1alpha1
kind: TailoredProfile
metadata:
  annotations:
    compliance.openshift.io/product-type: Node
  name: ssh-rules-test-old
  namespace: openshift-compliance
spec:
  description: "TailoredProfile to test specific SSH rules"
  title: "SSH Rules Test Profile"
  enableRules:
    - name: rhcos4-sshd-allow-only-protocol2
      rationale: "Test SSH protocol 2 enforcement"
    - name: rhcos4-sshd-disable-rhosts-rsa
      rationale: "Test RhostsRSA disabled"
    - name: rhcos4-sshd-use-priv-separation
      rationale: "Test privilege separation enabled"
$ oc-compliance bind -N test -S default-auto-apply tailoredprofile/ssh-rules-test-new tailoredprofile/ssh-rules-test-old
Creating ScanSettingBinding test
$ oc get suite
test   DONE          NON-COMPLIANT
$ oc get cr
NAME                                                    STATE
ssh-rules-test-new-master-sshd-disable-rhosts-rsa-1     Applied
ssh-rules-test-new-worker-sshd-disable-rhosts-rsa-1     Applied
ssh-rules-test-old-master-sshd-allow-only-protocol2-1   Applied
ssh-rules-test-old-master-sshd-disable-rhosts-rsa-1     Applied
ssh-rules-test-old-master-sshd-use-priv-separation-1    Applied
ssh-rules-test-old-worker-sshd-allow-only-protocol2-1   Applied
ssh-rules-test-old-worker-sshd-disable-rhosts-rsa-1     Applied
ssh-rules-test-old-worker-sshd-use-priv-separation-1    Applied
$ oc-compliance rerun-now scansettingbinding test
Rerunning scans from 'test': ssh-rules-test-new-master, ssh-rules-test-new-worker, ssh-rules-test-old-master, ssh-rules-test-old-worker
Re-running scan 'openshift-compliance/ssh-rules-test-new-master'
Re-running scan 'openshift-compliance/ssh-rules-test-new-worker'
Re-running scan 'openshift-compliance/ssh-rules-test-old-master'
Re-running scan 'openshift-compliance/ssh-rules-test-old-worker'
###The other two rules didn't show because the openssh-server version > 7.5
$ oc  get ccr
NAME                                                  STATUS   SEVERITY
ssh-rules-test-new-master-sshd-disable-rhosts-rsa     PASS     medium
ssh-rules-test-new-worker-sshd-disable-rhosts-rsa     PASS     medium
ssh-rules-test-old-master-sshd-allow-only-protocol2   FAIL     high
ssh-rules-test-old-master-sshd-disable-rhosts-rsa     FAIL     medium
ssh-rules-test-old-master-sshd-use-priv-separation    FAIL     medium
ssh-rules-test-old-worker-sshd-allow-only-protocol2   FAIL     high
ssh-rules-test-old-worker-sshd-disable-rhosts-rsa     FAIL     medium
ssh-rules-test-old-worker-sshd-use-priv-separation    FAIL     medium

2. On 4.21 RHCOS10 based cluster, the verification blocked by bug https://issues.redhat.com/browse/CMP-4034

3. Also tested on a 4.14 cluster, and get the same test result with 4.21.

[xiaojiey]

/lgtm