Added harden_sshd job to disable ssh port forwarding [fixes #174089050]

jobs/harden_sshd/spec

@@ -0,0 +1,19 @@
+---
+name: harden_sshd
+
+templates:
+  pre-start.sh.erb: bin/pre-start
+
+properties:
+  allow_tcp_forwarding:
+    description: Specifies whether TCP forwarding is permitted
+    default: false
+  allow_stream_local_forwarding:
+    description: Specifies whether forwarding Unix domain sockets is permitted
+    default: false
+  gateway_ports:
+    description: Specifies whether remote hosts are allowed to connect to ports forwarded for the client
+    default: false
+  permit_tunnel:
+    description: Specifies whether tun(4) device forwarding	is allowed
+    default: false

jobs/harden_sshd/templates/pre-start.sh.erb

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+<% unless p('allow_tcp_forwarding') %>
+    sed "/^ *AllowTcpForwarding/d" -i /etc/ssh/sshd_config
+    echo 'AllowTcpForwarding no' >> /etc/ssh/sshd_config
+<% end %>
+
+<% unless p('allow_stream_local_forwarding') %>
+    sed "/^ *AllowStreamLocalForwarding/d" -i /etc/ssh/sshd_config
+    echo 'AllowStreamLocalForwarding no' >> /etc/ssh/sshd_config
+<% end %>
+
+<% unless p('gateway_ports') %>
+    sed "/^ *GatewayPorts/d" -i /etc/ssh/sshd_config
+    echo 'GatewayPorts no' >> /etc/ssh/sshd_config
+<% end %>
+
+<% unless p('permit_tunnel') %>
+    sed "/^ *PermitTunnel/d" -i /etc/ssh/sshd_config
+    echo 'PermitTunnel no' >> /etc/ssh/sshd_config
+<% end %>
+
+systemctl restart sshd

src/os-conf-acceptance-tests/assets/manifest.yml

@@ -73,6 +73,8 @@ instance_groups:
         AUHr4fJ43qurkZx5FKJcYjpyh+gYou8QGfn/F23O9dlJMrrvGKF4ZruJtIa+uvIA
         mnvqfMDS/A8=
         -----END CERTIFICATE-----
+  - name: harden_sshd
+    release: os-conf
   - name: limits_not_recommended
     release: os-conf
     properties:

src/os-conf-acceptance-tests/harden_sshd_test.go

@@ -0,0 +1,23 @@
+package os_conf_acceptance_tests_test
+
+import (
+	"time"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+	"github.com/onsi/gomega/gbytes"
+	"github.com/onsi/gomega/gexec"
+)
+
+var _ = Describe("HardenSshd", func() {
+	It("hardens the sshd", func() {
+		By("disabeling port forwarding", func() {
+			session := boshSSH("os-conf/0", "sudo sshd -T | sort")
+			Eventually(session, 30*time.Second).Should(gbytes.Say("allowstreamlocalforwarding no"))
+			Eventually(session, 30*time.Second).Should(gbytes.Say("allowtcpforwarding no"))
+			Eventually(session, 30*time.Second).Should(gbytes.Say("gatewayports no"))
+			Eventually(session, 30*time.Second).Should(gbytes.Say("permittunnel no"))
+			Eventually(session, 30*time.Second).Should(gexec.Exit(0))
+		})
+	})
+})