Do not use PrintLastLog for Archlinux

[matclab]

Close #896

[matclab]

Do not merge until we are sure it is intended from Arch !

[schurzi]

Do not merge until we are sure it is intended from Arch !

Thanks for putting in the extra work!

[matclab]

Reported in https://gitlab.archlinux.org/archlinux/packaging/packages/openssh/-/issues/15, waiting for comment there.

[matclab]

It was intended. This PR may be merges if it looks good to you.

[schurzi]

I know you copied this over from the FreeBSD tests, but I don't think we should do that here in this case. I would much rather prefer that we adapt our baseline (https://github.com/dev-sec/linux-baseline). Are you up to adding your changes there instead?

[matclab]

I guess you're talking about ssh-baseline ?
I'm not familar at all with ruby.

Would this diff be ok:

diff --git a/controls/sshd_spec.rb b/controls/sshd_spec.rb
index a81db94c74..6f04a6f263 100644
--- a/controls/sshd_spec.rb
+++ b/controls/sshd_spec.rb
@@ -466,8 +466,10 @@
   impact 1.0
   title 'Server: PrintLastLog'
   desc 'This tells the SSH daemon to print out information about the last time you logged in.'
-  describe sshd_config("#{sshd_custom_path}/sshd_config") do
-    its('PrintLastLog') { should eq('no') }
+  if os.name != 'arch'
+    describe sshd_config("#{sshd_custom_path}/sshd_config") do
+      its('PrintLastLog') { should eq('no') }
+    end
   end
 end

[schurzi]

I guess you're talking about ssh-baseline ? I'm not familar at all with ruby.

You are absolutely right ;)

Would this diff be ok:

diff --git a/controls/sshd_spec.rb b/controls/sshd_spec.rb
index a81db94c74..6f04a6f263 100644
--- a/controls/sshd_spec.rb
+++ b/controls/sshd_spec.rb
@@ -466,8 +466,10 @@
   impact 1.0
   title 'Server: PrintLastLog'
   desc 'This tells the SSH daemon to print out information about the last time you logged in.'
-  describe sshd_config("#{sshd_custom_path}/sshd_config") do
-    its('PrintLastLog') { should eq('no') }
+  if os.name != 'arch'
+    describe sshd_config("#{sshd_custom_path}/sshd_config") do
+      its('PrintLastLog') { should eq('no') }
+    end
   end
 end

Using a plain if in controls is discouraged, there is a special construct only_if for this kind of conditions. A example use in the baseline is implemented there: https://github.com/dev-sec/ssh-baseline/blob/master/controls/sshd_spec.rb#L515. Checking for a specific OS looks like that: https://github.com/dev-sec/cis-docker-benchmark/blob/master/controls/docker_daemon_configuration_files.rb#L498

I am a bit split between detecting the OS or detecting the support of the config option, for example sshd -G | grep -qi PrintLastLog would do a specific detection if this version of sshd supports the option.

You are welcome to contribute this but I can also adapt the baseline if you are not comfortable introducing changes there.