# Custom Security Configuration Assessment policy for Wazuh 5.0
#
# Structure and rule syntax taken from the Wazuh 5.0-beta documentation:
#   https://documentation.wazuh.com/5.0-beta/user-manual/capabilities/sec-config-assessment/how-to-configure.html
#   https://documentation.wazuh.com/5.0-beta/user-manual/capabilities/sec-config-assessment/use-cases.html
#
# Sections: policy (required), requirements (optional), variables (optional), checks (required).
# Check IDs must be unique across every policy file loaded on the agent. The bundled CIS
# policies use IDs in the tens of thousands, so this file starts at 90000 to stay clear of them.
#
# Deploy: place the file on the agent (or push it through an agent group) and reference it
# from the <sca><policies> block. See the lesson for the full procedure.

policy:
  id: "ssh_baseline"
  file: "sca_ssh_baseline.yml"
  name: "Internal SSH baseline"
  description: "Checks the OpenSSH server configuration against an internal hardening baseline."
  references:
    - https://www.ssh.com/academy/ssh/sshd_config
  # regex_type is optional. "osregex" is the default; "pcre2" is the other allowed value.
  regex_type: "osregex"

requirements:
  title: "Check that an OpenSSH server is present on the endpoint"
  description: "The policy is skipped entirely if the endpoint does not run an SSH server."
  condition: any
  rules:
    - 'f:$sshd_file'

variables:
  $sshd_file: /etc/ssh/sshd_config

checks:
  - id: 90000
    title: "Ensure SSH root login is disabled"
    description: "PermitRootLogin allows direct interactive logon as root over SSH."
    rationale: "Direct root logon removes the audit trail that sudo provides and makes password
      guessing against a known account name worthwhile."
    remediation: "Set PermitRootLogin no in /etc/ssh/sshd_config and reload the sshd service."
    compliance:
      - pci_dss: ["8.3.1"]
      - iso_27001: ["A.9.4.2"]
    condition: all
    rules:
      - 'c:sshd -T -> r:^\s*permitrootlogin\s+no\s*$'

  - id: 90001
    title: "Ensure SSH password authentication is disabled"
    description: "Password authentication permits credential guessing against the SSH service."
    rationale: "Key-based authentication removes the password as a remotely guessable secret."
    remediation: "Set PasswordAuthentication no in /etc/ssh/sshd_config and reload the sshd service."
    compliance:
      - pci_dss: ["8.3.1"]
      - iso_27001: ["A.9.4.2"]
    condition: all
    rules:
      - 'c:sshd -T -> r:^\s*passwordauthentication\s+no\s*$'

  - id: 90002
    title: "Ensure SSH MaxAuthTries is 4 or lower"
    description: "MaxAuthTries caps the number of authentication attempts per connection."
    rationale: "A low limit slows online guessing and makes the failures visible in the logs."
    remediation: "Set MaxAuthTries 4 in /etc/ssh/sshd_config and reload the sshd service."
    compliance:
      - pci_dss: ["8.3.4"]
    condition: all
    rules:
      # Numeric comparison. The regex needs a capture group; spaces around "compare" are mandatory.
      - 'f:$sshd_file -> n:^\s*MaxAuthTries\s*\t*(\d+) compare <= 4'

  - id: 90003
    title: "Ensure no SSH host key is world readable"
    description: "Private host keys under /etc/ssh must not be readable by unprivileged users."
    rationale: "A readable host key lets an attacker impersonate the server."
    remediation: "Run chmod 600 on each /etc/ssh/ssh_host_*_key file."
    condition: none
    rules:
      # "none" passes only when no rule matches. Any world-readable private key fails the check.
      - 'c:find /etc/ssh -name ssh_host_*_key -perm /o=r -> r:ssh_host'