<def-group>
  <definition class="compliance" id="sshd_disable_forwarding" version="1">
   <metadata>
        <title>Disable SSH Forwarding</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>Ensure 'DisableForwarding' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
    </metadata>
   <criteria comment="sshd is configured correctly or is not installed" operator="OR">
     <criteria comment="sshd is not installed" operator="AND">
        <extend_definition comment="sshd is not required or requirement is unset"
          definition_ref="sshd_not_required_or_unset" />
          
           <extend_definition comment="rpm package openssh-server removed"
           definition_ref="package_openssh-server_removed" />
          
     </criteria>
     <criteria comment="sshd is installed and configured" operator="AND">
        <extend_definition comment="sshd is required or requirement is unset"
          definition_ref="sshd_required_or_unset" />
        
        <extend_definition comment="rpm package openssh-server installed"
          definition_ref="package_openssh-server_installed" />
        
        <criteria comment="sshd is configured correctly" operator="AND">
          <criteria comment="static configuration is correct" operator="AND">
            <criteria comment="the configuration is correct if it exists" operator="AND"><criterion comment="Check the DisableForwarding in /etc/ssh/sshd_config if any"
              test_ref="test_sshd_disable_forwarding" /><criterion comment="Check the DisableForwarding in /etc/ssh/sshd_config.d if any"
              test_ref="test_sshd_disable_forwarding_config_dir" />
              
            </criteria>
            <criterion comment="the configuration exists" test_ref="test_DisableForwarding_present_sshd_disable_forwarding" />
            
          </criteria>
        </criteria>
      </criteria>
    </criteria>
  </definition>



  

  
  <ind:textfilecontent54_test check="all" check_existence="any_exist"
    comment="tests the value of DisableForwarding setting in the /etc/ssh/sshd_config file"
    id="test_sshd_disable_forwarding" version="1">
    <ind:object object_ref="obj_sshd_disable_forwarding" />
    <ind:state state_ref="state_sshd_disable_forwarding" />
  </ind:textfilecontent54_test>
  
  <ind:textfilecontent54_object id="obj_sshd_disable_forwarding" version="1">
    <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
    <ind:pattern operation="pattern match">^[ \t]*(?i)DisableForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_state id="state_sshd_disable_forwarding" version="1">
    <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
  </ind:textfilecontent54_state>
  
  <ind:textfilecontent54_test check="all" check_existence="any_exist"
    comment="tests the value of DisableForwarding setting in the /etc/ssh/sshd_config.d file"
    id="test_sshd_disable_forwarding_config_dir" version="1">
    <ind:object object_ref="obj_sshd_disable_forwarding_config_dir" />
    <ind:state state_ref="state_sshd_disable_forwarding_config_dir" />
  </ind:textfilecontent54_test>
  
  <ind:textfilecontent54_object id="obj_sshd_disable_forwarding_config_dir" version="1">
    <ind:path>/etc/ssh/sshd_config.d</ind:path>
    <ind:filename operation="pattern match">.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[ \t]*(?i)DisableForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_state id="state_sshd_disable_forwarding_config_dir" version="1">
    <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
  </ind:textfilecontent54_state>

  
  <ind:textfilecontent54_object comment="All confs collection" id="obj_collection_obj_sshd_disable_forwarding" version="1">
    <set>
      <object_reference>obj_sshd_disable_forwarding</object_reference>
      <object_reference>obj_sshd_disable_forwarding_config_dir</object_reference>
      
    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_DisableForwarding_present_sshd_disable_forwarding" version="1"
                              check="all" check_existence="at_least_one_exists"
                              comment="Verify that the value of DisableForwarding is present">
    <ind:object object_ref="obj_collection_obj_sshd_disable_forwarding" />
  </ind:textfilecontent54_test>

  

</def-group>