Rudder plugins » CIS

System current configuration :

root@alma9-cis:~# sshd -T | grep ciphers
ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr

Test performed by the CIS module with default parameters :

root@alma9-cis:~# sshd -T | grep -Piq -- '^ciphers\s+\"?chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr'
root@alma9-cis:~# echo $?
1

This is wrong because we cannot predict that the node actually supports all authorized ciphers, so it should fail only if the node would support any unallowed cipher.

Furthermore, even changing the list of allowed ciphers to the list of ciphers actually supported by the node, this still fails :

root@alma9-cis:~# sshd -T | grep ciphers
ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
root@alma9-cis:~# sshd -T | grep -Piq -- '^ciphers\s+\"?chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr'
root@alma9-cis:~# echo $?
1

Here ist seems to fail only because the order of ciphers listed by openSSH differs from the order in the allowed ciphers list.

This is bad because we cannot be sure about the order in which sshd will list its allowed ciphers.

So it seems that our test is way too strict as the grep we use needs the sshd daemon to output the exact list of ciphers we allow (and not a subset of it), plus they need to be output in the exact same order for our test to suceed.