19 lines
1007 B
Bash
19 lines
1007 B
Bash
# The OpenSSH version, as 9.6 or 9.9.
|
|
V=$(ssh -V 2>&1 | grep -oE 'OpenSSH_[0-9]+\.[0-9]+' | cut -d_ -f2)
|
|
changelog() {
|
|
if is_rhel; then rpm -q --changelog openssh-server
|
|
elif [ -f /usr/share/doc/openssh-server/changelog.Debian.gz ]; then zcat /usr/share/doc/openssh-server/changelog.Debian.gz
|
|
else apt-get changelog openssh-server 2>/dev/null; fi
|
|
}
|
|
|
|
task 1 "The SSH product and version nmap found"
|
|
need "/root/lab-answers/1 names OpenSSH and its version" 'answer 1 | grep -q openssh && answer 1 | grep -qF "$V"'
|
|
|
|
task 2 "A CVE fixed in openssh-server"
|
|
need "/root/lab-answers/2 has a CVE ID" 'grep -Eqi "CVE-[0-9]{4}-[0-9]{4,}" /root/lab-answers/2'
|
|
need "the CVE is in the package's changelog" 'c=$(grep -Eoi "CVE-[0-9]{4}-[0-9]{4,}" /root/lab-answers/2 | head -1); changelog | grep -qiw "$c"'
|
|
|
|
task 3 "A CIS scan report in /root/cis.html" rhel
|
|
need "/root/cis.html is an OpenSCAP report" 'grep -q "OpenSCAP" /root/cis.html'
|
|
need "it's from a CIS profile" 'grep -Eq "content_profile_cis" /root/cis.html'
|