All;
I ran into a bug in the latest SSG for RHEL6 (0.1.21-2). There is definitely an issue with the check for approved Ciphers. Initially the check passed with no entry at all for Ciphers. I then placed a Cipher line with (1) valid cipher: pass. Finally I put an entry in sshd_config with a bogus cipher: passed. I just ran into this at the end of my workday today so I didn't get much of a chance to analyze it. Plus I'm really just starting to dig into the 'innards' of the content so I don't fully realize the connections of all the various sections (rule/def/tst/obj/ste). I'm also pretty sure that some of the other checks against sshd_config are off. The check for 'PermitRootLogin no' passed even though the file contains '#PermitRootLogin yes' and typically the checks are looking for the presence of the target string, not the absence of it.
Any input would be appreciated.
Thanks,
Les Kimmel Systems Engineer, CSC