Feature: cisSshd
Description
A sub-feature of cis that configures sshd per CIS benchmark requirements. Must be used with the cis feature.
What it does
Restricts SSH ciphers and MACs to CIS-approved algorithms and configures an SSH login banner. Also includes Garden Linux firewall rules for IPv4 and IPv6.
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
exec.config (ref) | Applies CIS SSH configuration and enables the Garden Linux firewall services. |
file.include.markers.yaml (ref) | Maps files to test-coverage marker IDs. |
info.yaml (ref) | Declares type: element and included/excluded features. |
file.include/etc/firewall/ipv4_flush.sh (file.include) | Script that flushes all IPv4 firewall rules. |
file.include/etc/firewall/ipv4_gl_default.conf (file.include) | Default Garden Linux IPv4 firewall rules. |
file.include/etc/firewall/ipv6_flush.sh (file.include) | Script that flushes all IPv6 firewall rules. |
file.include/etc/firewall/ipv6_gl_default.conf (file.include) | Default Garden Linux IPv6 firewall rules. |
file.include/etc/ssh/sshd-banner (file.include) | SSH pre-login banner text displayed to connecting users per CIS requirement. |
file.include/etc/systemd/system/gardenlinux-fw-ipv4.service (file.include) | systemd service that applies the Garden Linux IPv4 firewall rules at boot. |
file.include/etc/systemd/system/gardenlinux-fw-ipv6.service (file.include) | systemd service that applies the Garden Linux IPv6 firewall rules at boot. |
Related features
This feature has no include or exclude relationships.