oscap-ssh doesn't read environment variables on login

[Mixer9]

Description of Problem:

oscap-ssh doesn't read profile on login to see any environment variables that are set. ie. http_proxy and https_proxy, this causes the --fetch-remote-resources to fail and thus the scan isn't as helpful.

OpenSCAP Version:

openscap-1.2.16-8.el7_5.x86_64 scap-security-guide-0.1.36-9.el7_5.noarch openscap-scanner-1.2.16-8.el7_5.x86_64

Operating System & Version:

Red Hat Enterprise Linux Server release 7.5 (Maipo)

Steps to Reproduce:

1. Create server behind a web proxy
2. set environment variables for https_proxy on remote server in yours and roots profile.
3. run remote scan against server using oscap-ssh using --fetch-remote-resources, this should fail to download

Actual Results:

oscap-ssh --sudo user@remotehost 22 xccdf eval --fetch-remote-resources --profile xccdf_org.ssgproject.content_profile_standard /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
Connecting to 'user@remotehost' on port '22'...
Connected!
Copying input file '/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml' to remote working directory '/tmp/tmp.VRhDoffIM9'...
ssg-rhel7-ds.xml                                                                                                            100%   14MB  43.8MB/s   00:00
Starting the evaluation...
**Downloading: https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 ... error**
WARNING: Skipping https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content

Expected Results:

I expect it to read the environment upon login and use the proxy to get the file.

Additional Information / Debugging Steps:

[matejak]

What do you mean by "set environment variables"? You could set them in /root/.profile, or in /root/.bashrc, or in both files. If it is not the case, try both files, this may help.

[Mixer9]

I have set them in they account that ssh uses, I have set them in root's account, and I have set them in /etc/profile.d/proxy.sh and it appears that oscap-ssh doesn't pick ANY of these up because the download fails still. On Mon, Sep 24, 2018 at 8:37 AM Matěj Týč notifications@github.com wrote:

What do you mean by "set environment variables"? You could set them in /root/.profile, or in /root/.bashrc, or in both files. If it is not the case, try both files, this may help.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/OpenSCAP/openscap/issues/1195#issuecomment-423977170, or mute the thread https://github.com/notifications/unsubscribe-auth/Ah5iv8Oadz_og4qSkM2rw5cSNavg2zX6ks5ueOAjgaJpZM4W0ue4 .

-- Chris Hood chris.hood@gmail.com RHCE (RedHat Certified Engineer) RHCVA (RedHat Certified Virtualization Administrator) RHCDS (RedHat Certified Data Center Specialist) C|EH (Certified Ethical Hacker)

[matejak]

OK, actually the only relevant account is the account you connect to via ssh. How have you configured that one? Using ~/.bashrc, or using ~/.profile? On a different note, have you exported those variable assignments?

[Mixer9]

yes I have exported those variables in both the .bashrc and .bash_profile, as well as the /etc/profile.d/proxy.sh file

On Wed, Sep 26, 2018 at 7:04 AM Matěj Týč notifications@github.com wrote:

OK, actually the only relevant account is the account you connect to via ssh. How have you configured that one? Using ~/.bashrc, or using ~/.profile? On a different note, have you exported those variable assignments?

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/OpenSCAP/openscap/issues/1195#issuecomment-424690464, or mute the thread https://github.com/notifications/unsubscribe-auth/Ah5ivxtzors1yg6oLya-goPVGTl1Mbbiks5ue21dgaJpZM4W0ue4 .

-- Chris Hood chris.hood@gmail.com RHCE (RedHat Certified Engineer) RHCVA (RedHat Certified Virtualization Administrator) RHCDS (RedHat Certified Data Center Specialist) C|EH (Certified Ethical Hacker)

[matejak]

@Mixer9 OK, so please try to make sure that you have everything defined in ~/.profile as well, and try to invoke oscap-ssh using SSH_ADDITIONAL_OPTIONS="-t", this could help.

[evgenyz]

Related #883.