Local SSH

Fetches the local SSH configuration on a host using sshd -T, and runs passed policies against the output.

This plugin is intended to be run as part of an agent on a single host machine, where SSH configuration needs to be validated.

This page is for operators who run the plugin-local-ssh plugin with the CCF Agent, and for developers who write policies for it. It documents v0.5.0 and is generated from the plugin's README at v0.5.0.

Policies

The policy bundles that work with this plugin, at their newest releases. The controls are the ones the bundle's policies list in their metadata.

Bundle	Latest version	Controls covered	Compatible plugin lines
`plugin-local-ssh-policies`	`v0.3.1`	none listed	latest

When writing OPA / Rego policies for this plugin, they must be added under the compliance_framework.local_ssh rego module:

# deny_password_auth.rego
# package compliance_framework.local_ssh.[YOUR_RULE_PATH]
package compliance_framework.local_ssh.deny_password_auth

The plugin expects Rego policies to output a violation key to indicate failed resources, which will be reported to the compliance framework. Additional data can be added to violations, that describe what failed, and recommendations on how to fix them. Policies should also expose top-level title and description values so evidence can be created for both passing and failing evaluations.

Here is an example rego policy which ensures that passwords are turned off for SSH-able hosts.

# deny_password_auth.rego
package compliance_framework.local_ssh.deny_password_auth

import future.keywords.in

title := "SSH password authentication is disabled"
description := "Checks whether SSH password authentication is disabled on the host machine."

violation[{
    # ID identifies the violation for mapping to risk templates
    "id": "ssh_password_auth",

    # Title describes the violation
    "title": "Host SSH is using password authentication.",
    # Description adds more details about the violation
    "description": "Host SSH should not use password, as this is insecure to brute force attacks from external sources.",
    # Remarks indicate how this can be fixed or remediated
    "remarks": "Migrate to using SSH Public Keys, and switch off password authentication."
}] {
	"yes" in input.passwordauthentication
}

Policies​

Policies