refactor[rules] ssh fixes

Updated ssh fixes to match os_ssh_fips_compliant

rules/os/os_ssh_server_alive_count_max_configure.yaml

@@ -19,17 +19,35 @@ result:
 fix: |
   [source,bash]
   ----
-  for u in $(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk '$2 > 500 {print $1}'); do
-    config=$(/usr/bin/sudo -u $u /usr/bin/ssh -Gv . 2>&1 | /usr/bin/awk '/Reading configuration data/ {print $NF}'| /usr/bin/tr -d '\r')
-    configarray=( ${(f)config} )
-    for c in $configarray; do
-      if [[ "$c" == "/etc/ssh/crypto.conf" ]]; then
-        continue
+  include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/ssh_config | /usr/bin/tr -d '*')
+
+  fips_ssh_config=("ServerAliveCountMax $ODV")
+  for ssh_config in $fips_ssh_config; do
+    ssh_setting=$(echo $ssh_config | /usr/bin/cut -d " " -f1)
+    /usr/bin/grep -qEi "^$ssh_setting" "${include_dir}01-mscp-ssh.conf" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/" "${include_dir}01-mscp-ssh.conf" || echo "$ssh_config" >> "${include_dir}01-mscp-ssh.conf"
+    for u in $(/usr/bin/dscl . list /users shell | /usr/bin/egrep -v '(^_)|(root)|(/usr/bin/false)' | /usr/bin/awk '{print $1}'); do
+      config=$(/usr/bin/sudo -u $u /usr/bin/ssh -Gv . 2>&1)
+      configfiles=$(echo "$config" | /usr/bin/awk '/Reading configuration data/ {print $NF}'| /usr/bin/tr -d '\r')
+      configarray=( ${(f)configfiles} )
+      if ! echo $config | /usr/bin/grep -q -i "$ssh_config" ; then
+        for c in $configarray; do
+          if [[ "$c" == "/etc/ssh/crypto.conf" ]]; then
+            continue
+          fi
+
+          /usr/bin/sudo -u $u /usr/bin/grep -qEi "^$ssh_setting" "$c" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/I" "$c"
+          if [[ "$c" =~ ".ssh/config" ]]; then
+            if /usr/bin/grep -qEi "$ssh_setting" "$c" 2> /dev/null; then
+              old_file=$(cat ~$u/.ssh/config)
+              echo "$ssh_config" > ~$u/.ssh/config
+              echo "$old_file" >> ~$u/.ssh/config
+            fi
+          fi
+        done
       fi
-      /usr/bin/sudo -u $u /usr/bin/grep -q '^ServerAliveCountMax' "$c" && /usr/bin/sed -i '' 's/.*ServerAliveCountMax.*/ServerAliveCountMax $ODV/' "$c" || /bin/echo 'ServerAliveCountMax $ODV' >> "$c"
     done
   done
-  ----
+  ----  
 references:
   cce:
     - CCE-94300-1

rules/os/os_ssh_server_alive_interval_configure.yaml

@@ -21,17 +21,35 @@ result:
 fix: |
   [source,bash]
   ----
-  for u in $(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk '$2 > 500 {print $1}'); do
-    config=$(/usr/bin/sudo -u $u /usr/bin/ssh -Gv . 2>&1 | /usr/bin/awk '/Reading configuration data/ {print $NF}'| /usr/bin/tr -d '\r')
-    configarray=( ${(f)config} )
-    for c in $configarray; do
-      if [[ "$c" == "/etc/ssh/crypto.conf" ]]; then
-        continue
+  include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/ssh_config | /usr/bin/tr -d '*')
+
+  fips_ssh_config=("ServerAliveInterval $ODV")
+  for ssh_config in $fips_ssh_config; do
+    ssh_setting=$(echo $ssh_config | /usr/bin/cut -d " " -f1)
+    /usr/bin/grep -qEi "^$ssh_setting" "${include_dir}01-mscp-ssh.conf" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/" "${include_dir}01-mscp-ssh.conf" || echo "$ssh_config" >> "${include_dir}01-mscp-ssh.conf"
+    for u in $(/usr/bin/dscl . list /users shell | /usr/bin/egrep -v '(^_)|(root)|(/usr/bin/false)' | /usr/bin/awk '{print $1}'); do
+      config=$(/usr/bin/sudo -u $u /usr/bin/ssh -Gv . 2>&1)
+      configfiles=$(echo "$config" | /usr/bin/awk '/Reading configuration data/ {print $NF}'| /usr/bin/tr -d '\r')
+      configarray=( ${(f)configfiles} )
+      if ! echo $config | /usr/bin/grep -q -i "$ssh_config" ; then
+        for c in $configarray; do
+          if [[ "$c" == "/etc/ssh/crypto.conf" ]]; then
+            continue
+          fi
+
+          /usr/bin/sudo -u $u /usr/bin/grep -qEi "^$ssh_setting" "$c" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/I" "$c"
+          if [[ "$c" =~ ".ssh/config" ]]; then
+            if /usr/bin/grep -qEi "$ssh_setting" "$c" 2> /dev/null; then
+              old_file=$(cat ~$u/.ssh/config)
+              echo "$ssh_config" > ~$u/.ssh/config
+              echo "$old_file" >> ~$u/.ssh/config
+            fi
+          fi
+        done
       fi
-      /usr/bin/sudo -u $u /usr/bin/grep -q '^ServerAliveInterval' "$c" && /usr/bin/sed -i '' 's/.*ServerAliveInterval.*/ServerAliveInterval $ODV/' "$c" || /bin/echo 'ServerAliveInterval $ODV' >> "$c"
     done
   done
-  ----
+  ---- 
 references:
   cce:
     - CCE-94301-9