Replace OpenSSH package ban with FIPS SSH configuration checks

[xnox]

Summary

OpenSSH uses FIPS-validated cryptography, so treating it as a banned remote-access package was incorrect. This PR drops the OpenSSH ban and instead verifies OpenSSH is configured for FIPS.

• Un-ban OpenSSH: remove openssh, openssh-server, openssh-client, openssh-sftp-server from the RemoteAccessServices banned-package pattern. dropbear, tigervnc, xrdp, samba, telnet, etc. remain banned.
• Verify FIPS SSH config by extending the existing OpenSSL FIPS OVAL definition (oval:org.OpenSsl:def:1, which already backs the 5 Open_Ssl STIG rules) with checks that:
  • the client drop-in /etc/ssh/ssh_config.d/10-ssh-fips.conf and server drop-in /etc/ssh/sshd_config.d/10-sshd-fips.conf exist and pin the FIPS-approved Ciphers / KexAlgorithms / MACs / RequiredRSASize (plus the server HostKey/CASignature/HostBasedAccepted/PubkeyAccepted algorithm lists);
  • the top-level ssh_config / sshd_config Include their respective *_config.d/*.conf drop-in directories, so the policy is actually sourced.

Package-gated

The SSH checks use OVAL implication (nested criteria operator="OR" with a negated package-presence test), so:

• client checks apply only when openssh-client is installed;
• server checks apply only when openssh-server is installed.

A client-only image such as cgr.dev/chainguard-private/go-fips (has openssh-client, no sshd_config) therefore passes — its server policy is not asserted.

All OVAL changes are mirrored in both the standalone DetectOpenSslTest.xml and the embedded copy in ssg-chainguard-gpos-ds.xml; rule and manual-verification descriptions were updated to match.

Testing

• Offline matrix (tests/oscap-offline): RemoteAccessServices fixtures switched off openssh onto still-banned dropbear, plus a new openssh-now-allowed pass case; new DetectOpenSsl cases cover drop-in presence/content, the Include wiring, and the client-only / server-only / no-openssh gating. All verified against the real oscap scanner (OSCAP_OFFLINE_REQUIRE=1).
• e2e: remote-access-violation now installs dropbear instead of openssh-server.
• Datastream validates with no new schematron errors vs. base.
• Scanning the real go-fips image now reports all 5 Open_Ssl rules pass (client policy enforced + correct; server policy gated off).

🤖 Generated with Claude Code