Rule: sshd_include_crypto_policy, drop remediations, improve OVAL #13028

[evgenyz]

Description:

• We are dropping all remediations for now, as the recommended one is questionable.
• OVAL now recognizes Include directive in any drop-in file, in case-insensitive and tolerant to different separators way.
• Dropping the not osbuild platform as well.

Rationale:

• Current remediation causes a lot of troubles and most likely not efficient: Fix ssh include cryptopolicy #12931.
• We should not force the location of the Include directive in the check, any drop-in file is OK.
• Platform is not needed if the rule does not try to remediate the system in a barbaric way.

Origin: #13028

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy'.
--- xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy
+++ xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy
@@ -7,6 +7,9 @@
 In order to accomplish this the SSHD configuration should include the configuration file provided by the system crypto policy.
 The following line should be present in /etc/ssh/sshd_config or in a file included by this file (a file within the /etc/ssh/sshd_config.d directory):
 Include /etc/crypto-policies/back-ends/opensshserver.config
+
+[warning]:
+There is no automated remediation because recommended action could severely disrupt the system and might not be efficient in fixing the problem.
 
 [reference]:
 CCI-001453

New data stream is missing bash remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy'.
New data stream is missing ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy'.
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy'
--- xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy
+++ xccdf_org.ssgproject.content_rule_sshd_include_crypto_policy
@@ -1 +1 @@
-oval:ssg-installed_env_is_osbuild:def:1
+

[vojtapolasek]

Looks good. Merging bypassing Automatus tests. They fail because the rule is currently only in RHEL 9 datastream.