Currently /etc/ssh/sshd_config is being used as source of truth for checking if ssh server is configured correctly according to the CIS benchmarks.

Issue with using /etc/ssh/sshd_config as source of truth:
When we use default config options for some keywords, they are not required to be explicitly added in the /etc/ssh/sshd_config file. This is where wazuh rulesets fails to check if that configuration option set correctly corresponding to that keyword or not.

Example.
If the below configuration options are not added to the /etc/ssh/sshd_config, the CIS benchmark checks corresponding to them start failing. Although these are the default values (valid with CIS benchmarks) and are not required to be explicitly mentioned in the /etc/ssh/sshd_config.

PermitEmptyPasswords no
HostbasedAuthentication no
IgnoreRhosts yes

Default values reference:

PermitEmptyPasswords
             When password authentication is allowed, it specifies
             whether the server allows login to accounts with empty
             password strings.  The default is no.

HostbasedAuthentication
             Specifies whether rhosts or /etc/hosts.equiv authentication
             together with successful public key client host
             authentication is allowed (host-based authentication).  The
             default is no.

IgnoreRhosts
             Specifies whether to ignore per-user .rhosts and .shosts
             files during HostbasedAuthentication.  The system-wide
             /etc/hosts.equiv and /etc/shosts.equiv are still used
             regardless of this setting.

             Accepted values are yes (the default) to ignore all per-
             user files, shosts-only to allow the use of .shosts but to
             ignore .rhosts or no to allow both .shosts and rhosts.

ref: https://man7.org/linux/man-pages/man5/sshd_config.5.html

Reliable way of checking sshd_config CIS benchmarks: Regex based checks on command output of sshd -T can be used as reliable source of truth as it provides all configuration option set for the sshd_config even if they are the default values.