{{% set path = "/etc/ssh" %}}
{{% set key_regex = ".*_key$" %}}
{{% set root_uid_and_gid = 0 %}}
{{% set dedicated_ssh_groupname = groups.get("dedicated_ssh_keyowner", {}).get("name") %}}
{{% macro _name(user_name, type) -%}}
{{{ type }}}_ssh_key_owner_{{{ user_name }}}
{{%- endmacro %}}
{{% macro _test_object_state(username, groupname) %}}
{{{ path }}}
{{{ key_regex }}}
{{{ caller() }}}
{{% endmacro %}}
{{{ oval_metadata("The system sshd key is owned by root:root and has the 0600 permission" ~ (", or by a root:" ~ dedicated_ssh_groupname ~ " with the 0640 permission") if dedicated_ssh_groupname, rule_title=rule_title) }}}
{{{ path }}}
{{{ key_regex }}}
exclude_symlinks__sshd_private_key
{{{ _name('root', 'filter') }}}
{{% if dedicated_ssh_groupname -%}}
{{{ _name(dedicated_ssh_groupname, 'filter') }}}
{{%- endif %}}
symbolic link
{{% call _test_object_state("root", "root") %}}
{{{ root_uid_and_gid }}}
{{{ root_uid_and_gid }}}
false
false
false
{{# intentionally not considered: true #}}
{{# intentionally not considered: true #}}
false
{{% if product in ["ol9", "sle12", "sle15", "slmicro5", "slmicro6"] -%}}
{{# intentionally not considered: true #}}
{{%- else %}}
false
{{%- endif %}}
false
false
false
false
false
{{% endcall %}}
{{% if dedicated_ssh_groupname -%}}
{{% call _test_object_state("root", dedicated_ssh_groupname) %}}
{{{ root_uid_and_gid }}}
false
false
false
{{# intentionally not considered: true #}}
{{# intentionally not considered: true #}}
false
{{# intentionally not considered: true #}}
false
false
false
false
false
{{% endcall %}}
{{% if product != 'rhcos4' -%}}
/etc/group
{{%- else %}}
{{# CoreOS doesn't list all groups in /etc/group - that's probably related to the FS immutability #}}
/usr/lib/group
{{%- endif %}}
^{{{ dedicated_ssh_groupname }}}:\w+:(\w+):.*
1
{{%- endif %}}