rework CRYPTO_POLICY check to work with fedora

dev-sec / ssh-baseline

DevSec SSH Baseline - InSpec Profile

https://dev-sec.io/baselines/ssh/

Apache License 2.0

283 stars 78 forks source link

rework CRYPTO_POLICY check to work with fedora #177

Closed schurzi closed 4 years ago

schurzi commented 4 years ago

since fedora uses different version scheme it was not covered by previous check. Also add checks for ssh client, to see if we successfully override CRYPTO_POLICY there

Signed-off-by: Martin Schurz Martin.Schurz@t-systems.com

micheelengronne commented 4 years ago

Do you consider that can be merged ?

schurzi commented 4 years ago

I think so, yes. I ran this locally on all kitchen hosts in https://github.com/dev-sec/ansible-ssh-hardening/blob/master/.kitchen.yml and it didn't generate unexpected errors. I'm currently preparing another update on ansibe-ssh-hardening to solve the fedora setup correctly. So there would be currently one expected error, since the ansible role doesn't handle fedora the right way.

Do you have any improvements or recommendations regarding the code?