reglet/docs/examples/02-ssh-hardening.yaml at main · reglet-dev/reglet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
# SSH Hardening (SOC2 CC6.1)
# Run: reglet check examples/02-ssh-hardening.yaml --trust-plugins
#
# This profile implements SOC2 control CC6.1 - Logical and Physical Access Controls
# Specifically focused on SSH configuration hardening
#
# NOTE: This requires /etc/ssh/sshd_config to exist on the system
# NOTE: Advanced content checks require file plugin enhancements (planned)

profile:
  name: SSH Configuration Hardening
  description: SOC2 control CC6.1 - SSH security baseline
  version: 1.0.0

plugins:
  - file

controls:
  items:
    - id: soc2-cc6.1-ssh-config-exists
      name: SSH configuration file exists
      description: Verify sshd_config is present
      severity: critical
      tags: [soc2, ssh, config]
      observations:
        - plugin: file
          config:
            path: /etc/ssh/sshd_config
          expect:
            - data.exists

    - id: soc2-cc6.1-ssh-config-readable
      name: SSH config is readable
      description: sshd_config should be readable for validation
      severity: high
      tags: [soc2, ssh, permissions]
      observations:
        - plugin: file
          config:
            path: /etc/ssh/sshd_config
          expect:
            - data.readable

    - id: soc2-cc6.1-ssh-config-not-empty
      name: SSH config has content
      description: sshd_config should not be an empty file
      severity: high
      tags: [soc2, ssh, config]
      observations:
        - plugin: file
          config:
            path: /etc/ssh/sshd_config
          expect:
            - data.size > 0