CMP-3916: Fix sshd_disable_gssapi_auth remediation for Kubernetes #14108
+31
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add shared Kubernetes configuration that disables GSSAPI authentication in SSHD by setting GSSAPIAuthentication to 'no' with higher priority. This is necessary because the default 50-redhat.conf file contains GSSAPIAuthentication set to 'yes', which must be overridden for compliance requirements.
Collaborator
|
/test e2e-aws-openshift-node-compliance |
Collaborator
|
/retest-required |
Collaborator
|
The rule fail_sshd_disable_gssapi_auth still fail with the PR: |
rhmdnd
requested changes
Nov 10, 2025
| # disruption = low | ||
| {{{ kubernetes_sshd_set() }}} | ||
| --- | ||
| {{{ kubernetes_sshd_dropin('GSSAPIAuthentication no', config_basename='75-complianceascode-sshd_disable_gssapi_auth.conf') }}} |
Collaborator
There was a problem hiding this comment.
I wonder if we just want to make this change for all k8s remediations - https://github.com/ComplianceAsCode/content/blob/master/shared/templates/sshd_lineinfile/kubernetes.template#L11
Collaborator
There was a problem hiding this comment.
SSHD configuration is processed lexographically and uses the first found value:
Unless noted otherwise, for each keyword, the first obtained value will be used.
https://man.openbsd.org/sshd_config
This remediation will come after the 50-*.conf settings.
Collaborator
There was a problem hiding this comment.
Can we keep this remediation in the distributed config so that it doesn't conflict with the 50-redhat.conf value, which sets this parameter to yes and the rule can't determine which one to use.
…g from '75-complianceascode-sshd_disable_gssapi_auth.conf' to '00-complianceascode-sshd_disable_gssapi_auth.conf' to ensure higher priority in SSHD settings for compliance requirements.
Collaborator
|
verification fail with a397a93:
|
rhmdnd
reviewed
Nov 11, 2025
| # disruption = low | ||
| {{{ kubernetes_sshd_set() }}} | ||
| --- | ||
| {{{ kubernetes_sshd_dropin('GSSAPIAuthentication no', config_basename='00-complianceascode-sshd_disable_gssapi_auth.conf') }}} |
Collaborator
There was a problem hiding this comment.
I think we have to find a way to write this to the old configuration file (/etc/ssh/sshd_config) so that we don't end up with multiple values in the same directory. The rule doesn't know to use the 00-complianceascode-* value instead of the one in 50-redhat.conf.
Collaborator
There was a problem hiding this comment.
Are we able to try something like this to see if it only sets the parameter once?
diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/kubernetes/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/kubernetes/shared.yml
index c89d87fc25..456fb7d063 100644
--- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/kubernetes/shared.yml
+++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/kubernetes/shared.yml
@@ -3,6 +3,6 @@
# strategy = restrict
# complexity = low
# disruption = low
-{{{ kubernetes_sshd_set() }}}
+{{{ kubernetes_disable_sshd_config_option('GSSAPIAuthentication') }}}
---
-{{{ kubernetes_sshd_dropin('GSSAPIAuthentication no', config_basename='00-complianceascode-sshd_disable_gssapi_auth.conf') }}}
+{{{ kubernetes_disable_sshd_config_option_dropin('GSSAPIAuthentication') }}}
diff --git a/shared/macros/10-kubernetes.jinja b/shared/macros/10-kubernetes.jinja
index 15a7eea152..e66f7567b5 100644
--- a/shared/macros/10-kubernetes.jinja
+++ b/shared/macros/10-kubernetes.jinja
@@ -248,6 +248,29 @@ spec:
{{{ kubernetes_machine_config_file(path='/etc/ssh/sshd_config.d/' + config_basename, file_permissions_mode='0600', source=sshd_dropin_content, ocp_version_range=ocp_version_range) }}}
{{%- endmacro -%}}
+{{#
+ Disable SSH options in existing configuration files.
+
+ GSSAPI authentication is enabled by default in
+ `/etc/ssh/sshd_config.d/50-redhat.com`. Using a drop-in file for another
+ parameter in the same directory breaks the rule. Even if the drop-in file is
+ placed correctly, and disables the GSSAPI, the rule still detects that there
+ is a string in `/etc/ssh/sshd_config.d/50-redhat.conf` that has
+ `GSSAPIAuthentication yes`.
+
+ We need this specific macro so that we can override the setting in
+ `/etc/ssh/sshd_config.d/50-redhat.conf` on 4.13+ and `/etc/ssh/sshd_config` on
+ 4.12.
+
+#}}
+{{%- macro kubernetes_disable_existing_sshd_config_option(parameter) -%}}
+{{{ kubernetes_machine_config_file(path='/etc/ssh/sshd_config', file_permissions_mode='0600', source=parameter + ' no' , ocp_version_range='<4.13.0') }}}
+{{%- endmacro -%}}
+
+{{%- macro kubernetes_disable_existing_sshd_config_dropin(parameter) -%}}
+{{{ kubernetes_machine_config_file(path='/etc/ssh/sshd_config.d/50-redhat.conf', file_permissions_mode='0600', source=parameter + ' no' , ocp_version_range='>=4.13.0') }}}
+{{%- endmacro -%}}
+
{{% macro usbguard_config_source() %}}
#Updated the shared Kubernetes configuration to disable GSSAPI authentication by introducing new macros. This change ensures compliance by overriding the default settings in `/etc/ssh/sshd_config.d/50-redhat.conf` and `/etc/ssh/sshd_config` for different OpenShift versions.
|
@Vincent056: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Collaborator
|
Override the file /etc/ssh/sshd_config.d/50-redhat.conf might not be a good idea. There are several configurations in the file before auto-remediations applied; however, most of the configurations will disappear after auto remediation applied. After the remediation applied: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add shared Kubernetes configuration that disables GSSAPI authentication in SSHD by setting GSSAPIAuthentication to 'no' with higher priority. This is necessary because the default
50-redhat.conffile contains GSSAPIAuthentication set to 'yes', which must be overridden for compliance requirements.