<def-group>
  <definition class="compliance" id="sshd_enable_strictmodes" version="1">
   <metadata>
        <title>Enable Use of Strict Mode Checking</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>Ensure 'StrictModes' is configured with value 'yes' in /etc/ssh/sshd_config or in /etc/ssh/sshd_config.d</description>
    </metadata>
   <criteria comment="sshd is configured correctly or is not installed" operator="OR">
     <criteria comment="sshd is not installed" operator="AND">
        <extend_definition comment="sshd is not required or requirement is unset"
          definition_ref="sshd_not_required_or_unset" />
          
           <extend_definition comment="rpm package openssh-server removed"
           definition_ref="package_openssh-server_removed" />
          
     </criteria>
     <criteria comment="sshd is installed and configured" operator="AND">
        <extend_definition comment="sshd is required or requirement is unset"
          definition_ref="sshd_required_or_unset" />
        
        <extend_definition comment="rpm package openssh-server installed"
          definition_ref="package_openssh-server_installed" />
        
        <criteria comment="sshd is configured correctly" operator="AND">
          <criteria comment="the configuration is correct if it exists" operator="AND"><criterion comment="Check the StrictModes in /etc/ssh/sshd_config if any"
            test_ref="test_sshd_enable_strictmodes" /><criterion comment="Check the StrictModes in /etc/ssh/sshd_config.d if any"
            test_ref="test_sshd_enable_strictmodes_config_dir" />
            
          </criteria>
          <criterion comment="the configuration exists" test_ref="test_StrictModes_present_sshd_enable_strictmodes" />
          
        </criteria>
      </criteria>
    </criteria>
  </definition>



  

  
  <ind:textfilecontent54_test check="all" check_existence="any_exist"
    comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config file"
    id="test_sshd_enable_strictmodes" version="1">
    <ind:object object_ref="obj_sshd_enable_strictmodes" />
    <ind:state state_ref="state_sshd_enable_strictmodes" />
  </ind:textfilecontent54_test>
  
  <ind:textfilecontent54_object id="obj_sshd_enable_strictmodes" version="1">
    <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
    <ind:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_state id="state_sshd_enable_strictmodes" version="1">
    <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
  </ind:textfilecontent54_state>
  
  <ind:textfilecontent54_test check="all" check_existence="any_exist"
    comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config.d file"
    id="test_sshd_enable_strictmodes_config_dir" version="1">
    <ind:object object_ref="obj_sshd_enable_strictmodes_config_dir" />
    <ind:state state_ref="state_sshd_enable_strictmodes_config_dir" />
  </ind:textfilecontent54_test>
  
  <ind:textfilecontent54_object id="obj_sshd_enable_strictmodes_config_dir" version="1">
    <ind:path>/etc/ssh/sshd_config.d</ind:path>
    <ind:filename operation="pattern match">.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  <ind:textfilecontent54_state id="state_sshd_enable_strictmodes_config_dir" version="1">
    <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
  </ind:textfilecontent54_state>

  
  <ind:textfilecontent54_object comment="All confs collection" id="obj_collection_obj_sshd_enable_strictmodes" version="1">
    <set>
      <object_reference>obj_sshd_enable_strictmodes</object_reference>
      <object_reference>obj_sshd_enable_strictmodes_config_dir</object_reference>
      
    </set>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test id="test_StrictModes_present_sshd_enable_strictmodes" version="1"
                              check="all" check_existence="at_least_one_exists"
                              comment="Verify that the value of StrictModes is present">
    <ind:object object_ref="obj_collection_obj_sshd_enable_strictmodes" />
  </ind:textfilecontent54_test>

  
</def-group>