Summary

• Enable sshd_distributed_config for the OCP4 product to match the underlying RHCOS4 behavior
• OCP4 runs on RHCOS4, which already has this set to true in its product definition
• The OCP4 product had it set to false, causing SSHD compliance checks to only scan /etc/ssh/sshd_config and miss settings placed in /etc/ssh/sshd_config.d/*.conf drop-in files

Problem

RHCOS 9 uses the drop-in config model — sshd_config contains an Include /etc/ssh/sshd_config.d/*.conf directive that loads drop-in files. When SSHD hardening remediations write settings to drop-in files (which is the standard approach for RHCOS), the settings are functionally correct (sshd -T confirms the effective config) but the scanner only checks the main sshd_config and reports false FAILs.

Affected checks include:

• sshd_set_idle_timeout
• sshd_set_keepalive
• sshd_disable_gssapi_auth
• sshd_set_loglevel_info
• sshd_disable_root_login
• sshd_enable_strictmodes
• And all other sshd_lineinfile template checks

Fix

The sshd_lineinfile template and OVAL macros already fully support distributed config checking — when sshd_distributed_config is true, the generated OVAL automatically scans both /etc/ssh/sshd_config AND /etc/ssh/sshd_config.d/*.conf. This is already enabled for rhcos4, rhel9, rhel10, fedora, and others.

This PR simply enables the same behavior for ocp4.

Changes

• products/ocp4/product.yml: Add sshd_distributed_config: "true"
• tests/data/product_stability/ocp4.yml: Change sshd_distributed_config from false to true

Testing

Verified on OCP 4.22 (cnfdt16 cluster) and OCP 4.21 (CRC):

• SSHD settings in drop-in files are functionally effective (confirmed via sshd -T)
• Scanner reports FAIL when sshd_distributed_config is false (current behavior)
• The rhcos4 product with sshd_distributed_config: "true" correctly detects drop-in settings