custom path and user added

Signed-off-by: Michée Lengronne <michee.lengronne@coppint.com>

Author: micheelengronne

controls/sshd_spec.rb

@@ -28,6 +28,8 @@
 sshd_x11forwarding = attribute('sshd_x11forwarding', value: 'no', description: 'Expected value for sshd_config X11Forwarding')
 sshd_banner = attribute('sshd_banner', value: 'none', description: 'Expected value for sshd_config Banner')
 sshd_max_auth_tries = attribute('sshd_max_auth_tries', value: 2, description: 'Expected value for max_auth_retries')
+sshd_custom_user = attribute('custom_user', value: 'root', description: 'The SSH user is not always root. It must be an unprivileged user in a container')
+sshd_custom_path = attribute('custom_path', value: '/etc/ssh', description: 'Sometimes ssh configuration files are present in another location and ssh use them with the -f flag')
 
 only_if do
   command('sshd').exist?
@@ -63,12 +65,12 @@
 control 'sshd-04' do
   impact 1.0
   title 'Server: Check SSH folder owner, group and permissions.'
-  desc 'The SSH folder should owned by root, only be writable by owner and readable by others.'
-  describe file('/etc/ssh') do
+  desc 'The SSH folder should owned by root or a defined user, only be writable by owner and readable by others.'
+  describe file(sshd_custom_path) do
     it { should exist }
     it { should be_directory }
     it { should be_owned_by 'root' }
-    it { should be_grouped_into os.darwin? ? 'wheel' : 'root' }
+    it { should be_grouped_into os.darwin? ? 'wheel' : sshd_custom_user }
     it { should be_executable }
     it { should be_readable.by('owner') }
     it { should be_readable.by('group') }
@@ -84,7 +86,7 @@
   title 'Server: Check sshd_config owner, group and permissions.'
   desc 'The sshd_config should owned by root, only be writable/readable by owner and not be executable.'
 
-  describe file('/etc/ssh/sshd_config') do
+  describe file(sshd_custom_path + '/sshd_config') do
     it { should exist }
     it { should be_file }
     it { should be_owned_by 'root' }
@@ -481,7 +483,7 @@
   impact 1.0
   title 'Server: DH primes'
   desc 'Verifies if strong DH primes are used in /etc/ssh/moduli'
-  describe bash("test $(awk '$5 < 2047 && $5 ~ /^[0-9]+$/ { print $5 }' /etc/ssh/moduli | uniq | wc -c) -eq 0") do
+  describe bash("test $(awk '$5 < 2047 && $5 ~ /^[0-9]+$/ { print $5 }' " + sshd_custom_path + "/moduli | uniq | wc -c) -eq 0") do
     its('exit_status') { should eq 0 }
     its('stdout') { should eq '' }
     its('stderr') { should eq '' }