Skip to content

Comments

CNF-21212: RAN Hardening - HIGH Severity Compliance Remediations#529

Open
sebrandon1 wants to merge 2 commits intoopenshift-kni:mainfrom
sebrandon1:high-severity-hardening
Open

CNF-21212: RAN Hardening - HIGH Severity Compliance Remediations#529
sebrandon1 wants to merge 2 commits intoopenshift-kni:mainfrom
sebrandon1:high-severity-hardening

Conversation

@sebrandon1
Copy link
Contributor

@sebrandon1 sebrandon1 commented Jan 14, 2026 •
edited
Loading

Summary

Add 2 MachineConfigs for HIGH severity compliance remediations from the OpenShift Compliance Operator (E8/CIS benchmarks).

Remediation Groups

HIGH Severity Settings

Group Category MachineConfig Setting Value
H1 Crypto Policy 75-crypto-policy-high.yaml crypto-policy DEFAULT:NO-SHA1
H2 PAM Auth 75-pam-auth-high.yaml nullok removed from PAM

Implementation Notes

  • Crypto policy: Uses a systemd oneshot unit with idempotency check
  • PAM hardening: Uses sed to remove nullok option (prevents empty password auth)

Compliance Checks Remediated

  • rhcos4-e8-worker-configure-crypto-policy
  • rhcos4-e8-master-configure-crypto-policy
  • rhcos4-e8-worker-no-empty-passwords
  • rhcos4-e8-master-no-empty-passwords

Related

Test plan

  • Apply MachineConfigs to a test cluster
  • Verify crypto policy: update-crypto-policies --show (expect DEFAULT:NO-SHA1)
  • Verify PAM: grep nullok /etc/pam.d/{system,password}-auth (expect no output)
  • Run Compliance Operator scan to verify checks pass

🤖 Generated with Claude Code

@sebrandon1 @claude
CNF-21212: RAN Hardening - HIGH Severity Compliance Remediations
c8ed970 
Add MachineConfigs for HIGH severity compliance remediations from the
OpenShift Compliance Operator (E8/CIS benchmarks):

- 75-crypto-policy-high.yaml: Configure system-wide crypto policy (DEFAULT:NO-SHA1)
- 75-pam-auth-high.yaml: Remove nullok from PAM to disable empty passwords
- 75-sshd-high.yaml: Set PermitEmptyPasswords no via sshd_config.d drop-in

These are the most critical security hardening settings per the Compliance
Operator severity classification.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Jan 14, 2026

@sebrandon1: This pull request references CNF-21212 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Summary

  • Add 3 MachineConfigs for HIGH severity compliance remediations from the OpenShift Compliance Operator (E8/CIS benchmarks)
  • These are the most critical security hardening settings per CO severity classification
  • Related Jira: CNF-21212

HIGH Severity Settings

Group Category MachineConfig Description
H1 Crypto Policy 75-crypto-policy-high.yaml Configure system-wide crypto policy (DEFAULT:NO-SHA1)
H2 PAM Auth 75-pam-auth-high.yaml Remove nullok from PAM to disable empty passwords
H3 SSHD 75-sshd-high.yaml Set PermitEmptyPasswords no via sshd_config.d drop-in

Implementation Notes

  • Crypto policy uses a systemd oneshot unit with idempotency check
  • PAM hardening uses sed to remove nullok option (prevents empty password auth)
  • SSHD uses a drop-in file approach for minimal impact

Test plan

  • Apply MachineConfigs to a test cluster
  • Verify crypto policy is set: update-crypto-policies --show
  • Verify PAM files don't contain nullok: grep nullok /etc/pam.d/{system,password}-auth
  • Verify sshd config: sshd -T | grep permitemptypasswords
  • Run Compliance Operator scan to verify remediations

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested review from SchSeba and ffromani January 14, 2026 17:16
@openshift-ci
Copy link

openshift-ci bot commented Jan 14, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sebrandon1
Once this PR has been reviewed and has the lgtm label, please assign imiller0 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@sebrandon1 sebrandon1 mentioned this pull request Jan 14, 2026
Closed
4 tasks
@sebrandon1 @claude
Remove SSHD config - consolidating into PR openshift-kni#466
ac3d010 
SSHD hardening settings (all severities) will be consolidated into
PR openshift-kni#466. This PR now focuses on non-SSHD HIGH severity items only:
- crypto-policy
- PAM auth (no empty passwords)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Jan 14, 2026

@sebrandon1: This pull request references CNF-21212 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Summary

  • Add 2 MachineConfigs for HIGH severity compliance remediations from the OpenShift Compliance Operator (E8/CIS benchmarks)
  • These are the most critical security hardening settings per CO severity classification
  • Related Jira: CNF-21212

HIGH Severity Settings

Group Category MachineConfig Description
H1 Crypto Policy 75-crypto-policy-high.yaml Configure system-wide crypto policy (DEFAULT:NO-SHA1)
H2 PAM Auth 75-pam-auth-high.yaml Remove nullok from PAM to disable empty passwords

Note: The HIGH severity SSHD setting (PermitEmptyPasswords) is consolidated with other SSHD settings in PR #466 to keep all SSH hardening together.

Implementation Notes

  • Crypto policy uses a systemd oneshot unit with idempotency check
  • PAM hardening uses sed to remove nullok option (prevents empty password auth)

Test plan

  • Apply MachineConfigs to a test cluster
  • Verify crypto policy is set: update-crypto-policies --show
  • Verify PAM files don't contain nullok: grep nullok /etc/pam.d/{system,password}-auth
  • Run Compliance Operator scan to verify remediations

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Jan 14, 2026

@sebrandon1: This pull request references CNF-21212 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Summary

Add 2 MachineConfigs for HIGH severity compliance remediations from the OpenShift Compliance Operator (E8/CIS benchmarks).

Remediation Groups

HIGH Severity Settings

Group Category MachineConfig Setting Value
H1 Crypto Policy 75-crypto-policy-high.yaml crypto-policy DEFAULT:NO-SHA1
H2 PAM Auth 75-pam-auth-high.yaml nullok removed from PAM

Implementation Notes

  • Crypto policy: Uses a systemd oneshot unit with idempotency check
  • PAM hardening: Uses sed to remove nullok option (prevents empty password auth)

Compliance Checks Remediated

  • rhcos4-e8-worker-configure-crypto-policy
  • rhcos4-e8-master-configure-crypto-policy
  • rhcos4-e8-worker-no-empty-passwords
  • rhcos4-e8-master-no-empty-passwords

Related

Test plan

  • Apply MachineConfigs to a test cluster
  • Verify crypto policy: update-crypto-policies --show (expect DEFAULT:NO-SHA1)
  • Verify PAM: grep nullok /etc/pam.d/{system,password}-auth (expect no output)
  • Run Compliance Operator scan to verify checks pass

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link
Collaborator

openshift-ci-robot commented Jan 20, 2026

@sebrandon1: This pull request references CNF-21212 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Summary

Add 2 MachineConfigs for HIGH severity compliance remediations from the OpenShift Compliance Operator (E8/CIS benchmarks).

Remediation Groups

HIGH Severity Settings

Group Category MachineConfig Setting Value
H1 Crypto Policy 75-crypto-policy-high.yaml crypto-policy DEFAULT:NO-SHA1
H2 PAM Auth 75-pam-auth-high.yaml nullok removed from PAM

Implementation Notes

  • Crypto policy: Uses a systemd oneshot unit with idempotency check
  • PAM hardening: Uses sed to remove nullok option (prevents empty password auth)

Compliance Checks Remediated

  • rhcos4-e8-worker-configure-crypto-policy
  • rhcos4-e8-master-configure-crypto-policy
  • rhcos4-e8-worker-no-empty-passwords
  • rhcos4-e8-master-no-empty-passwords

Related

Test plan

  • Apply MachineConfigs to a test cluster
  • Verify crypto policy: update-crypto-policies --show (expect DEFAULT:NO-SHA1)
  • Verify PAM: grep nullok /etc/pam.d/{system,password}-auth (expect no output)
  • Run Compliance Operator scan to verify checks pass

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ffromani ffromani Awaiting requested review from ffromani

@SchSeba SchSeba Awaiting requested review from SchSeba

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sebrandon1 @openshift-ci-robot