/ 
Monitoring-Sneck-Checks-0.0.2
/ Monitoring::Sneck::Checks::sshd_config

NAME

Monitoring::Sneck::Checks::sshd_config - checks settings in sshd_config

VERSION

Version 0.0.1

SYNOPSIS

!ssh_no_root|control=CIS-5.2.10 framework=CIS|perl:sshd_config -e PermitRootLogin=no
!ssh_auth||perl:sshd_config -e PasswordAuthentication=no -d PasswordAuthentication=yes -e 'MaxAuthTries=3|4'
!ssh_no_x11||perl:sshd_config -f /usr/local/etc/ssh/sshd_config -e X11Forwarding=no -d X11Forwarding=no

DESCRIPTION

Reads sshd_config, along with any files it includes, and checks the value of each setting given. A value that is not one of those allowed is CRITICAL. So is a setting that is not set and has no --default, or the file not being readable.

The settings are read the way sshd does. Names are not case sensitive, and the first value wins. Only the global settings are looked at, so everything from the first Match on is left out. Values are compared without case and with runs of spaces squashed, so extra spaces in the file do not matter.

sshd's own defaults vary by version and OS, so they are not known. Give --default for any that may be unset, such as -d PermitRootLogin=prohibit-password.

OPTIONS

- -f, --file :: The file. Default :: /etc/ssh/sshd_config

- -e, --expect :: "Name=value", a setting and the value it must have. Several values may be allowed, split by |, such as "MaxAuthTries=3|4". May be given more than once. Required.

- -d, --default :: "Name=value", what sshd uses if it is not set. May be given more than once.

- -I, --include-dir :: The directory relative Include paths are under. sshd takes them from its own config directory, wherever the file it was given is, so give this when checking a copy kept elsewhere. Default :: the directory of --file

METHODS

check

Does the check.

read_config

Reads a sshd_config file into a hash of settings, following Include.

- file :: The file.

- settings :: Hash ref of lower cased names to normalized values, added to. The first value of each wins.

- depth :: How many Includes deep this is.

Returns undef, or what went wrong. Once a Match is found, the settings hash gets the key " match", so nothing after is read.

include_dir

Returns the directory relative Include paths are under, --include-dir, or the directory of --file.