sshd_use_approved_ciphers fails for all CIS profiles in all test cases

[mildas]

Description of problem:

sshd_use_approved_ciphers fails to remediate (error during remediation) resulting to fail during final test scan.

The problem is in CIS Server L1, CIS Server L2, CIS Workstation L1, and CIS Workstation L2.

Fails for Anaconda installation, Ansible playbook, host-os remediation, Image builder, and also oscap remediation of a VM.

SCAP Security Guide Version:

latest master

Operating System Version:

RHEL 9

Steps to Reproduce:

1. oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis --progress --report /var/tmp/contest-hardening-host-os-oscap-cis/remediation.html --remediate /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Actual Results:

sshd_use_approved_ciphers fails

Expected Results:

sshd_use_approved_ciphers pass

Additional Information/Debugging Steps:

The problem is RHEL9 only
I suspect #12067
However, HTML report says that ciphers setting is true (copied from HTML report):

tests the value of Ciphers setting in the /etc/ssh/sshd_config file  oval:ssg-test_sshd_use_approved_ciphers:tst:1  true

Following items have been found on the system:

Result of item-state comparison | Var ref | Value | Value | Value | Value | Value -- | -- | -- | -- | -- | -- | -- true | oval:ssg-var_sshd_config_ciphers:var:1 | -3des-cbc | aes128-cbc | aes192-cbc | aes256-cbc | rijndael-cbc@lysator.liu.se

[mildas]

Also caught by Automatus:

• fail: sshd_use_approved_ciphers/correct_reduced_list.pass
• fail: sshd_use_approved_ciphers/correct_scrambled.pass
• fail: sshd_use_approved_ciphers/correct_value.pass
• fail: sshd_use_approved_ciphers/correct_value_full.pass
• fail: sshd_use_approved_ciphers/correct_variable.pass

[jan-cerny]

With the new productization model, these items also started to appear for a "Per Rule" test /per-rule/13/oscap/sshd_use_approved_ciphers/ which runs Automatus test.

[Mab879]

Part of of the pain is that rule requires the OS be to FIPS certified.

However, there still is something wrong with the Ansible remediation when that extend_definition is removed from the rule.