devsnack/control-repo
1
0
Fork 0
Code Releases Activity
26bf87125d
control-repo/data/nodes/linuxagent1forcmdeployment.platform9.puppet.net.yaml

939 lines
43 KiB
YAML
Raw Normal View History

ststs
2019-10-21 04:14:31 +00:00
---
# Some standard permissions to use
root_0000: { owner: root, group: root, mode: '0000' }
root_0444: { owner: root, group: root, mode: '0444' }
root_0600: { owner: root, group: root, mode: '0600' }
root_0640: { owner: root, group: root, mode: '0640' }
root_0644: { owner: root, group: root, mode: '0644' }
root_0700: { owner: root, group: root, mode: '0700' }
root_4755: { owner: root, group: root, mode: '4755' }
root_2755: { owner: root, group: root, mode: '2755' }
filesystems:
# CIS 1.1.2 L2 Ensure separate partition exists for /tmp
# CIS 1.1.3 L1 Ensure nodev option set on /tmp partition
# CIS 1.1.4 L1 Ensure nosuid option set on /tmp partition
# CIS 1.1.5 L1 Ensure noexec option set on /tmp partition
/tmp:
options: nodev,nosuid,noexec
size: 512M
# CIS 1.1.6 L2 Ensure separate partition exists for /var
/var:
size: 2048M
# CIS 1.1.7 L2 Ensure separate partition exists for /var/tmp
# CIS 1.1.8 L1 Ensure nodev option set on /var/tmp partition
# CIS 1.1.9 L1 Ensure nosuid option set on /var/tmp partition
# CIS 1.1.10 L1 Ensure noexec option set on /var/tmp partition
/var/tmp:
options: nodev,nosuid,noexec
size: 512M
# CIS 1.1.11 L2 Ensure separate partition exists for /var/log
/var/log:
size: 512M
# CIS 1.1.12 L2 Ensure separate partition exists for /var/log/audit
/var/log/audit:
size: 512M
# CIS 1.1.13 L2 Ensure separate partition exists for /home
# CIS 1.1.14 L1 Ensure nodev option set on /home partition
/home:
size: 2048M
options: nodev
# CIS 1.1.15 L1 Ensure nodev option set on /dev/shm partition
# CIS 1.1.16 L1 Ensure nosuid option set on /dev/shm partition
# CIS 1.1.17 L1 Ensure noexec option set on /dev/shm partition
/dev/shm:
options: nodev,nosuid,noexec
fstype: tmpfs
device: tmpfs
# CIS 1.1.18 L1 Ensure nodev option set on removable media partitions
# CIS 1.1.19 L1 Ensure nosuid option set on removable media partitions
# CIS 1.1.20 L1 Ensure noexec option set on removable media partitions
# CIS 1.1.21 L1 Ensure sticky bit is set on all world-writable directories
# CIS 1.2.1 L1 Ensure package manager repositories are configured
# CIS 1.2.2 L1 Ensure gpgcheck is globally activated
# CIS 1.2.3 L1 Ensure GPG keys are configured
# CIS 1.2.4 L1 Ensure Red Hat Subscription Manager connection is configured
# CIS 1.3.1 L1 Ensure AIDE is installed
# CIS 1.7.1.2 L1 Ensure local login warning banner is configured properly - banner text
profile::ssh::banner_content: |2+
Do not logon unless you have read and agree to the following.
By continuing to logon you are representing that you are an authorised user
and you accept and agree that:
1. use of Australia Post (AP) computers, systems, software and facilities
including email and Internet Browsing is subject to policies and guidelines issued
by Australia Post from time to time;
2. the contents of all internal, incoming and outgoing emails are the property of
Australia Post;
3. Australia Post may take disciplinary action under the AP Employee Counselling
and Disciplinary Process, and/or legal action against anyone failing to comply
with relevant policy or misusing IT facilities including email and Internet;
4. misuse includes use, access or transmission of pornographic photos, animations,
cartoons, and images (including screensavers), sexually explicit, sexist, racist
material or material that offends, embarrasses or degrades a person because of
disability, sex, religion or ethnic background, or unacceptable behaviour or
harrassment as outlined in the Code of Ethics or Harrassment Policy;
5. Australia Post may monitor or audit the use of any of its IT facilities and
any information stored or passed through these facilities including email and
Internet browsing details;
It is your responsibility to read and comply with the Group Technology Use Policy.
Should you have any questions about these conditions or the policies detailed here
please contact your line manager. For all information security related issues
contact the Information Security Office at secureatpost@auspost.com.au
I agree to these terms and conditions.
profile::file_ops::files:
# CIS 1.4.1 L1 Ensure permissions on bootloader config are configured - grub.cfg
/boot/grub2/grub.cfg: "%{alias('root_0640')}"
# CIS 1.4.1 L1 Ensure permissions on bootloader config are configured - user.cfg
/boot/grub2/user.cfg: "%{alias('root_0640')}"
# CIS 1.7.1.1 L1 Ensure message of the day is configured properly - banner text
# CIS 1.7.1.4 L1 Ensure permissions on /etc/motd are configured
/etc/motd:
content: ''
mode: '0644'
owner: root
group: root
# CIS 1.7.1.5 L1 Ensure permissions on /etc/issue are configured - already covered by SSH module
#/etc/issue:
#content: "%{hiera('profile::ssh::banner_content')}"
#mode: 644
#owner: root
#group: root
# CIS 1.7.1.3 L1 Ensure remote login warning banner is configured properly - banner text
# CIS 1.7.1.6 L1 Ensure permissions on /etc/issue.net are configured - already covered by SSH module
#/etc/issue.net:
#content: "%{hiera('profile::ssh::banner_content')}"
#mode: 644
#owner: root
#group: root
# CIS 3.4.2 L1 Ensure /etc/hosts.allow is configured
# CIS 3.4.4 L1 Ensure permissions on /etc/hosts.allow are configured
/etc/hosts.allow:
content: |
# File managed by Puppet
'ALL: 10.0.0.0/255.0.0.0'
mode: '0644'
owner: root
group: root
# CIS 3.4.3 L1 Ensure /etc/hosts.deny is configured
# CIS 3.4.5 L1 Ensure permissions on /etc/hosts.deny are configured
/etc/hosts.deny:
content: |
# File managed by Puppet
'ALL: ALL'
mode: '0644'
owner: root
group: root
/etc/modprobe.d/CIS.conf:
content: |
# File managed by Puppet
# CIS 1.1.1.1 L1 Ensure mounting of cramfs filesystems is disabled - modprobe
install cramfs /bin/true
# CIS 1.1.1.2 L1 Ensure mounting of freevxfs filesystems is disabled - lsmod
install freevxfs /bin/true
# CIS 1.1.1.3 L1 Ensure mounting of jffs2 filesystems is disabled - modprobe
install jffs2 /bin/true
# CIS 1.1.1.4 L1 Ensure mounting of hfs filesystems is disabled - modprobe
install hfs /bin/true
# CIS 1.1.1.5 L1 Ensure mounting of hfsplus filesystems is disabled - lsmod
install hfsplus /bin/true
# CIS 1.1.1.6 L1 Ensure mounting of squashfs filesystems is disabled - modprobe
install squashfs /bin/true
# CIS 1.1.1.7 L1 Ensure mounting of udf filesystems is disabled - lsmod
install udf /bin/true
# CIS 1.1.1.8 L2 Ensure mounting of FAT filesystems is disabled
install vfat /bin/true
# CIS 3.5.1 L1 Ensure DCCP is disabled
install dccp /bin/true
# CIS 3.5.2 L1 Ensure SCTP is disabled
install sctp /bin/true
# CIS 3.5.3 L1 Ensure RDS is disabled
install rds /bin/true
# CIS 3.5.4 L1 Ensure TIPC is disabled
install tipc /bin/true
mode: '0644'
owner: root
group: root
# CIS 5.1.2 L1 Ensure permissions on /etc/crontab are configured
/etc/crontab: "%{alias('root_0600')}"
# CIS 5.1.8 L1 Ensure at/cron is restricted to authorized users - cron.allow
/etc/cron.allow: "%{alias('root_0600')}"
# CIS 5.1.8 L1 Ensure at/cron is restricted to authorized users - cron.deny
/etc/cron.deny:
ensure: absent
# CIS 5.1.8 L1 Ensure at/cron is restricted to authorized users - at.allow
/etc/at.allow: "%{alias('root_0600')}"
# CIS 5.1.8 L1 Ensure at/cron is restricted to authorized users - at.deny
/etc/at.deny:
ensure: absent
/etc/security/pwquality.conf:
content: |
# File managed by Puppet
difok = 5
# CIS 5.3.1 L1 Ensure password creation requirements are configured - minlen
minlen = 9
# CIS 5.3.1 L1 Ensure password creation requirements are configured - dcredit
dcredit = -1
# CIS 5.3.1 L1 Ensure password creation requirements are configured - ucredit
ucredit = -1
# CIS 5.3.1 L1 Ensure password creation requirements are configured - lcredit
lcredit = -1
# CIS 5.3.1 L1 Ensure password creation requirements are configured - ocredit
ocredit = -1
# minclass = 0
# maxrepeat = 0
# maxclassrepeat = 0
# gecoscheck = 0
# dictpath =
mode: '0644'
owner: root
group: root
# CIS 5.4.4 L1 Ensure default user umask is 027 or more restrictive - /etc/profile /etc/profile.d/*.sh
/etc/profile.d/umask.sh:
content: "umask 0027\n"
/etc/profile.d/umask.csh:
content: "umask 0027\n"
# CIS 5.4.5 L2 Ensure default user shell timeout is 900 seconds or less - /etc/profile
/etc/profile.d/autologout.sh:
content: "export TMOUT=36000\n"
/etc/profile.d/tmout.csh:
content: "TMOUT=36000\n"
# CIS 6.1.2 L1 Ensure permissions on /etc/passwd are configured
/etc/passwd: "%{alias('root_0644')}"
# CIS 6.1.3 L1 Ensure permissions on /etc/shadow are configured
/etc/shadow: "%{alias('root_0000')}"
# CIS 6.1.4 L1 Ensure permissions on /etc/group are configured
/etc/group: "%{alias('root_0644')}"
# CIS 6.1.5 L1 Ensure permissions on /etc/gshadow are configured
/etc/gshadow: "%{alias('root_0000')}"
# CIS 6.1.6 L1 Ensure permissions on /etc/passwd- are configured
/etc/passwd-: "%{alias('root_0644')}"
# CIS 6.1.7 L1 Ensure permissions on /etc/shadow- are configured
/etc/shadow-: "%{alias('root_0000')}"
# CIS 6.1.8 L1 Ensure permissions on /etc/group- are configured
/etc/group-: "%{alias('root_0644')}"
# CIS 6.1.9 L1 Ensure permissions on /etc/gshadow- are configured
/etc/gshadow-: "%{alias('root_0000')}"
# CIS 2.2.1.2 L1 Ensure ntp is configured - restrict -4 - not using NTP
# CIS 2.2.1.2 L1 Ensure ntp is configured - restrict -6 - not using NTP
# CIS 2.2.1.2 L1 Ensure ntp is configured - server - not using NTP
# CIS 2.2.1.3 L1 Ensure chrony is configured - NTP server - set elsewhere in hiera
# CIS 2.2.1.3 L1 Ensure chrony is configured - OPTIONS
/etc/sysconfig/chronyd:
content: |
# File managed by Puppet
OPTIONS='-u chrony'
# CIS 4.1.1.1 L2 Ensure audit log storage size is configured
# CIS 4.1.1.2 L2 Ensure system is disabled when audit logs are full - 'space_left_action = email'
# CIS 4.1.1.2 L2 Ensure system is disabled when audit logs are full - 'action_mail_acct = root'
# CIS 4.1.1.2 L2 Ensure system is disabled when audit logs are full - 'admin_space_left_action = halt'
# CIS 4.1.1.3 L2 Ensure audit logs are not automatically deleted
# CIS 4.1.2 L2 Ensure auditd service is enabled
# CIS 4.1.3 L2 Ensure auditing for processes that start prior to auditd is enabled
# CIS 4.1.4 L2 Ensure events that modify date and time information are collected - auditctl adjtimex (32-bit)
# CIS 4.1.4 L2 Ensure events that modify date and time information are collected - adjtimex (32-bit)
# CIS 4.1.4 L2 Ensure events that modify date and time information are collected - auditctl clock_settime (32-bit)
# CIS 4.1.4 L2 Ensure events that modify date and time information are collected - clock_settime (32-bit)
# CIS 4.1.4 L2 Ensure events that modify date and time information are collected - auditctl /etc/localtime
# CIS 4.1.4 L2 Ensure events that modify date and time information are collected - /etc/localtime
# CIS 4.1.4 L2 Ensure events that modify date and time information are collected - auditctl adjtimex (64-bit)
# CIS 4.1.4 L2 Ensure events that modify date and time information are collected - auditctl clock_settime (64-bit)
# CIS 4.1.4 L2 Ensure events that modify date and time information are collected - adjtimex (64-bit)
# CIS 4.1.4 L2 Ensure events that modify date and time information are collected - clock_settime (64-bit)
# CIS 4.1.5 L2 Ensure events that modify user/group information are collected - '/etc/group'
# CIS 4.1.5 L2 Ensure events that modify user/group information are collected - auditctl '/etc/group'
# CIS 4.1.5 L2 Ensure events that modify user/group information are collected - '/etc/passwd'
# CIS 4.1.5 L2 Ensure events that modify user/group information are collected - auditctl '/etc/passwd'
# CIS 4.1.5 L2 Ensure events that modify user/group information are collected - '/etc/gshadow'
# CIS 4.1.5 L2 Ensure events that modify user/group information are collected - auditctl '/etc/gshadow'
# CIS 4.1.5 L2 Ensure events that modify user/group information are collected - '/etc/shadow'
# CIS 4.1.5 L2 Ensure events that modify user/group information are collected - auditctl '/etc/shadow'
# CIS 4.1.5 L2 Ensure events that modify user/group information are collected - '/etc/security/opasswd'
# CIS 4.1.5 L2 Ensure events that modify user/group information are collected - auditctl '/etc/security/opasswd'
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - sethostname (32-bit)
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - auditctl sethostname (32-bit)
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - issue
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - auditctl issue
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - issue.net
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - auditctl issue.net
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - /etc/hosts
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - auditctl hosts
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - /etc/sysconfig/network
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - auditctl network
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - /etc/sysconfig/network-scripts
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - auditctl network-scripts
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - sethostname (64-bit)
# CIS 4.1.6 L2 Ensure events that modify the system's network environment are collected - auditctl sethostname (64-bit)
# CIS 4.1.7 L2 Ensure events that modify the system's Mandatory Access Controls are collected - /etc/selinux/
# CIS 4.1.7 L2 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /etc/selinux/
# CIS 4.1.7 L2 Ensure events that modify the system's Mandatory Access Controls are collected - /usr/share/selinux/
# CIS 4.1.7 L2 Ensure events that modify the system's Mandatory Access Controls are collected - auditctl /usr/share/selinux/
# CIS 4.1.8 L2 Ensure login and logout events are collected - /var/log/lastlog
# CIS 4.1.8 L2 Ensure login and logout events are collected - auditctl /var/log/lastlog
# CIS 4.1.8 L2 Ensure login and logout events are collected - /var/run/faillock/
# CIS 4.1.8 L2 Ensure login and logout events are collected - auditctl /var/run/faillock/
# CIS 4.1.9 L2 Ensure session initiation information is collected - utmp
# CIS 4.1.9 L2 Ensure session initiation information is collected - auditctl utmp
# CIS 4.1.9 L2 Ensure session initiation information is collected - wtmp
# CIS 4.1.9 L2 Ensure session initiation information is collected - auditctl wtmp
# CIS 4.1.9 L2 Ensure session initiation information is collected - btmp
# CIS 4.1.9 L2 Ensure session initiation information is collected - auditctl btmp
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - setxattr/lsetxattr/fsetxattr/removexattr
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - auditctl setxattr/lsetxattr/fsetxattr/removexattr
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - chmod/fchmod/fchmodat (64-bit)
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - auditctl chmod/fchmod/fchmodat (64-bit)
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - chown/fchown/fchownat/lchown (64-bit)
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - auditctl chown/fchown/fchownat/lchown (64-bit)
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - xattr (64-bit)
# CIS 4.1.10 L2 Ensure discretionary access control permission modification events are collected - auditctl xattr (64-bit)
# CIS 4.1.11 L2 Ensure unsuccessful unauthorized file access attempts are collected - EACCES
# CIS 4.1.11 L2 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES
# CIS 4.1.11 L2 Ensure unsuccessful unauthorized file access attempts are collected - EPERM
# CIS 4.1.11 L2 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM
# CIS 4.1.11 L2 Ensure unsuccessful unauthorized file access attempts are collected - EACCES (64-bit)
# CIS 4.1.11 L2 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EACCES (64-bit)
# CIS 4.1.11 L2 Ensure unsuccessful unauthorized file access attempts are collected - EPERM (64-bit)
# CIS 4.1.11 L2 Ensure unsuccessful unauthorized file access attempts are collected - auditctl EPERM (64-bit)
# CIS 4.1.12 L2 Ensure use of privileged commands is collected
# CIS 4.1.13 L2 Ensure successful file system mounts are collected
# CIS 4.1.13 L2 Ensure successful file system mounts are collected - auditctl
# CIS 4.1.13 L2 Ensure successful file system mounts are collected - b64
# CIS 4.1.13 L2 Ensure successful file system mounts are collected - auditctl (64-bit)
# CIS 4.1.14 L2 Ensure file deletion events by users are collected
# CIS 4.1.14 L2 Ensure file deletion events by users are collected - auditctl
# CIS 4.1.14 L2 Ensure file deletion events by users are collected - b64
# CIS 4.1.14 L2 Ensure file deletion events by users are collected - auditctl (64-bit)
# CIS 4.1.15 L2 Ensure changes to system administration scope (sudoers) is collected - sudoers
# CIS 4.1.15 L2 Ensure changes to system administration scope (sudoers) is collected - auditctl sudoers
# CIS 4.1.15 L2 Ensure changes to system administration scope (sudoers) is collected - sudoers.d
# CIS 4.1.15 L2 Ensure changes to system administration scope (sudoers) is collected - auditctl sudoers.d
# CIS 4.1.16 L2 Ensure system administrator actions (sudolog) are collected
# CIS 4.1.16 L2 Ensure system administrator actions (sudolog) are collected - auditctl
# CIS 4.1.17 L2 Ensure kernel module loading and unloading is collected - insmod
# CIS 4.1.17 L2 Ensure kernel module loading and unloading is collected - auditctl insmod
# CIS 4.1.17 L2 Ensure kernel module loading and unloading is collected - rmmod
# CIS 4.1.17 L2 Ensure kernel module loading and unloading is collected - auditctl rmmod
# CIS 4.1.17 L2 Ensure kernel module loading and unloading is collected - modprobe
# CIS 4.1.17 L2 Ensure kernel module loading and unloading is collected - auditctl modprobe
# CIS 4.1.17 L2 Ensure kernel module loading and unloading is collected - init_module/delete_module
# CIS 4.1.17 L2 Ensure kernel module loading and unloading is collected - auditctl init_module/delete_module
# CIS 4.1.17 L2 Ensure kernel module loading and unloading is collected - init_module/delete_module
# CIS 4.1.17 L2 Ensure kernel module loading and unloading is collected - auditctl init_module/delete_module
# CIS 4.1.18 L2 Ensure the audit configuration is immutable
/etc/audit/auditd.conf:
content: |
# File managed by Puppet
#
# This file controls the configuration of the audit daemon
#
local_events = yes
write_logs = yes
log_file = /var/log/audit/audit.log
log_group = root
log_format = RAW
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 8
num_logs = 5
priority_boost = 4
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
verify_email = yes
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
use_libwrap = yes
##tcp_listen_port = 60
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key
distribute_network = no
profile::file_ops::directories:
# CIS 5.1.3 L1 Ensure permissions on /etc/cron.hourly are configured
/etc/cron.hourly: "%{alias('root_0700')}"
# CIS 5.1.4 L1 Ensure permissions on /etc/cron.daily are configured
/etc/cron.daily: "%{alias('root_0700')}"
# CIS 5.1.5 L1 Ensure permissions on /etc/cron.weekly are configured
/etc/cron.weekly: "%{alias('root_0700')}"
# CIS 5.1.6 L1 Ensure permissions on /etc/cron.monthly are configured
/etc/cron.monthly: "%{alias('root_0700')}"
# CIS 5.1.7 L1 Ensure permissions on /etc/cron.d are configured
/etc/cron.d: "%{alias('root_0700')}"
# CIS 5.3.1 L1 Ensure password creation requirements are configured - password-auth try_first_pass
# CIS 5.3.1 L1 Ensure password creation requirements are configured - system-auth try_first_pass
# CIS 5.3.1 L1 Ensure password creation requirements are configured - password-auth retry=3
# CIS 5.3.1 L1 Ensure password creation requirements are configured - system-auth retry=3
central_auth::pam::dfok: 5
central_auth::pam::minlen: 9
central_auth::pam::dcredit: -1
central_auth::pam::ucredit: -1
central_auth::pam::ocredit: -1
central_auth::pam::lcredit: -1
# CIS 1.4.2 L1 Ensure bootloader password is set
# CIS 1.4.3 L1 Ensure authentication required for single user mode - rescue.service
# CIS 1.4.3 L1 Ensure authentication required for single user mode - emergency.service
# CIS 1.5.1 L1 Ensure core dumps are restricted - limits.conf limits.d
security::limits::limits_hash:
"*/hard/core":
value: '0'
# CIS 1.5.1 L1 Ensure core dumps are restricted - sysctl
# CIS 1.5.1 L1 Ensure core dumps are restricted - sysctl.conf sysctl.d
profile::kernel::sysctl:
fs.suid_dumpable: 0
# CIS 1.5.3 L1 Ensure address space layout randomization (ASLR) is enabled - sysctl
# CIS 1.5.3 L1 Ensure address space layout randomization (ASLR) is enabled - sysctl.conf sysctl.d
kernel.randomize_va_space: 2
# CIS 3.1.1 L1 Ensure IP forwarding is disabled - sysctl
# CIS 3.1.1 L1 Ensure IP forwarding is disabled - sysctlc.conf sysctl.d
net.ipv4.ip_forward: 0
# CIS 3.1.2 L1 Ensure packet redirect sending is disabled - 'net.ipv4.conf.all.send_redirects = 0'
# CIS 3.1.2 L1 Ensure packet redirect sending is disabled - 'net.ipv4.conf.default.send_redirects = 0'
net.ipv4.conf.all.send_redirects: 0
net.ipv4.conf.default.send_redirects: 0
# CIS 3.2.1 L1 Ensure source routed packets are not accepted - 'net.ipv4.conf.default.accept_source_route = 0'
# CIS 3.2.1 L1 Ensure source routed packets are not accepted - 'net.ipv4.conf.all.accept_source_route = 0'
net.ipv4.conf.all.accept_source_route: 0
net.ipv4.conf.default.accept_source_route: 0
# CIS 3.2.2 L1 Ensure ICMP redirects are not accepted - 'net.ipv4.conf.all.accept_redirects = 0'
# CIS 3.2.2 L1 Ensure ICMP redirects are not accepted - 'net.ipv4.conf.default.accept_redirects = 0'
net.ipv4.conf.all.accept_redirects: 0
net.ipv4.conf.default.accept_redirects: 0
# CIS 3.2.3 L1 Ensure secure ICMP redirects are not accepted - 'net.ipv4.conf.default.secure_redirects = 0'
# CIS 3.2.3 L1 Ensure secure ICMP redirects are not accepted - 'net.ipv4.conf.all.secure_redirects = 0'
net.ipv4.conf.all.secure_redirects: 0
net.ipv4.conf.default.secure_redirects: 0
# CIS 3.2.4 L1 Ensure suspicious packets are logged - 'net.ipv4.conf.all.log_martians = 1'
# CIS 3.2.4 L1 Ensure suspicious packets are logged - 'net.ipv4.conf.default.log_martians = 1'
net.ipv4.conf.all.log_martians: 1
net.ipv4.conf.default.log_martians: 1
# CIS 3.2.5 L1 Ensure broadcast ICMP requests are ignored - sysctl
# CIS 3.2.5 L1 Ensure broadcast ICMP requests are ignored - sysctl.conf sysctl.d
net.ipv4.icmp_echo_ignore_broadcasts: 1
# CIS 3.2.6 L1 Ensure bogus ICMP responses are ignored - sysctl
# CIS 3.2.6 L1 Ensure bogus ICMP responses are ignored - sysctl.conf sysctl.d
net.ipv4.icmp_ignore_bogus_error_responses: 1
# CIS 3.2.7 L1 Ensure Reverse Path Filtering is enabled - 'net.ipv4.conf.default.rp_filter = 1'
# CIS 3.2.7 L1 Ensure Reverse Path Filtering is enabled - 'net.ipv4.conf.all.rp_filter = 1'
net.ipv4.conf.all.rp_filter: 1
net.ipv4.conf.default.rp_filter: 1
# CIS 3.2.8 L1 Ensure TCP SYN Cookies is enabled - sysctl
# CIS 3.2.8 L1 Ensure TCP SYN Cookies is enabled - sysctl.conf sysctl.d
net.ipv4.tcp_syncookies: 1
# CIS 3.3.1 L1 Ensure IPv6 router advertisements are not accepted - 'net.ipv6.conf.all.accept_ra = 0'
# CIS 3.3.1 L1 Ensure IPv6 router advertisements are not accepted - 'net.ipv6.conf.default.accept_ra = 0'
# CIS 3.3.1 L1 Ensure IPv6 router advertisements are not accepted - files 'net.ipv6.conf.all.accept_ra = 0'
# CIS 3.3.1 L1 Ensure IPv6 router advertisements are not accepted - files 'net.ipv6.conf.default.accept_ra = 0'
net.ipv6.conf.all.accept_ra: 0
net.ipv6.conf.default.accept_ra: 0
# CIS 3.3.2 L1 Ensure IPv6 redirects are not accepted - 'net.ipv6.conf.default.accept_redirects = 0'
# CIS 3.3.2 L1 Ensure IPv6 redirects are not accepted - 'net.ipv6.conf.all.accept_redirects = 0'
# CIS 3.3.2 L1 Ensure IPv6 redirects are not accepted - files 'net.ipv6.conf.default.accept_redirects = 0'
# CIS 3.3.2 L1 Ensure IPv6 redirects are not accepted - files 'net.ipv6.conf.all.accept_redirects = 0'
net.ipv6.conf.all.accept_redirects: 0
net.ipv6.conf.default.accept_redirects: 0
# CIS 1.5.2 L1 Ensure XD/NX support is enabled (32 bit only)
# CIS 1.8 L1 Ensure updates, patches, and additional security software are installed
# CIS 2.2.15 L1 Ensure mail transfer agent is configured for local-only mode
networking::mailclient::inet_interfaces: 'localhost'
packages::remove:
RedHat:
# CIS 1.1.22 L1 Disable Automounting
- autofs
# CIS 1.5.4 L1 Ensure prelink is disabled
- prelink
# CIS 1.6.1.4 L2 Ensure SETroubleshoot is not installed
- setroubleshoot
# CIS 1.6.1.5 L2 Ensure the MCS Translation Service (mcstrans) is not installed
- mcstrans
# CIS 1.7.2 L1 Ensure GDM login banner is configured - user-db
# CIS 1.7.2 L1 Ensure GDM login banner is configured - system-db
# CIS 1.7.2 L1 Ensure GDM login banner is configured - file-db
# CIS 1.7.2 L1 Ensure GDM login banner is configured - banner message enabled
# CIS 1.7.2 L1 Ensure GDM login banner is configured - banner message text
- gdm
# CIS 2.1.1 L1 Ensure chargen services are not enabled - dgram
# CIS 2.1.1 L1 Ensure chargen services are not enabled - stream
# CIS 2.1.2 L1 Ensure daytime services are not enabled - dgram
# CIS 2.1.2 L1 Ensure daytime services are not enabled - stream
# CIS 2.1.3 L1 Ensure discard services are not enabled - dgram
# CIS 2.1.3 L1 Ensure discard services are not enabled - stream
# CIS 2.1.4 L1 Ensure echo services are not enabled - dgram
# CIS 2.1.4 L1 Ensure echo services are not enabled - stream
# CIS 2.1.5 L1 Ensure time services are not enabled - dgram
# CIS 2.1.5 L1 Ensure time services are not enabled - stream
# CIS 2.1.7 L1 Ensure xinetd is not enabled
- xinetd
# CIS 2.1.6 L1 Ensure tftp server is not enabled
# CIS 2.2.20 L1 Ensure tftp server is not enabled
- tftp-server
# CIS 2.2.2 L1 Ensure X Window System is not installed
# CIS 2.2.3 L1 Ensure Avahi Server is not enabled
- avahi
# CIS 2.2.4 L1 Ensure CUPS is not enabled
- cups
# CIS 2.2.5 L1 Ensure DHCP Server is not enabled
- dhcp
- dnsmasq
# CIS 2.2.6 L1 Ensure LDAP server is not enabled
- openldap-servers
# CIS 2.2.7 L1 Ensure NFS and RPC are not enabled - nfs
# CIS 2.2.7 L1 Ensure NFS and RPC are not enabled - nfs-server
# CIS 2.2.7 L1 Ensure NFS and RPC are not enabled - rpcbind
# CIS 2.2.8 L1 Ensure DNS Server is not enabled
- bind
- pdns
# CIS 2.2.9 L1 Ensure FTP Server is not enabled
- vsftpd
- pure-ftpd
- perl-ftpd
- proftpd
# CIS 2.2.10 L1 Ensure HTTP server is not enabled
- caddy
- httpd
- lighttpd
- nginx
- nginx14-nginx
- nginx16-nginx
- nodejs-ws
- xbean
- rubygem-thin
# CIS 2.2.11 L1 Ensure IMAP and POP3 server is not enabled
- dovecot
- cyrus-imapd
# CIS 2.2.12 L1 Ensure Samba is not enabled
- samba
- samba-dc
# CIS 2.2.13 L1 Ensure HTTP Proxy Server is not enabled
- squid
# CIS 2.2.14 L1 Ensure SNMP Server is not enabled
- net-snmp
# CIS 2.2.16 L1 Ensure NIS Server is not enabled
# CIS 2.3.1 L1 Ensure NIS Client is not installed
- ypserv
- ypbind
# CIS 2.2.17 L1 Ensure rsh server is not enabled - rexec
# CIS 2.2.17 L1 Ensure rsh server is not enabled - rlogin
# CIS 2.2.17 L1 Ensure rsh server is not enabled - rsh
# CIS 2.3.2 L1 Ensure rsh client is not installed
- rsh-server
- rsh
# CIS 2.2.18 L1 Ensure talk server is not enabled
# CIS 2.3.3 L1 Ensure talk client is not installed
- ntalk
- talk
# CIS 2.2.19 L1 Ensure telnet server is not enabled
- telnet-server
profile::services:
# CIS 1.2.5 L2 Disable the rhnsd Daemon
rhnsd:
ensure: stopped
enable: false
# CIS 2.2.21 L1 Ensure rsync service is not enabled
rsyncd:
ensure: stopped
enable: false
# CIS 5.1.1 L1 Ensure cron daemon is enabled
crond:
ensure: running
enable: true
# CIS 2.3.4 L1 Ensure telnet client is not installed - disputed
# CIS 2.3.5 L1 Ensure LDAP client is not installed - disputed
packages::add:
RedHat:
# CIS 3.4.1 L1 Ensure TCP Wrappers is installed
- tcp_wrappers
# CIS 1.6.2 L2 Ensure SELinux is installed
- libselinux
# CIS 3.6.1 L1 Ensure iptables is installed
profile::firewall::enable: true
profile::firewall::chains:
# CIS 3.6.2 L1 Ensure default deny firewall policy - Chain INPUT
INPUT:filter:IPv4:
policy: drop
INPUT:filter:IPv6:
policy: drop
# CIS 3.6.2 L1 Ensure default deny firewall policy - Chain FORWARD
FORWARD:filter:IPv4:
policy: drop
FORWARD:filter:IPv6:
policy: drop
# CIS 3.6.2 L1 Ensure default deny firewall policy - Chain OUTPUT
OUTPUT:filter:IPv4:
policy: drop
OUTPUT:filter:IPv6:
policy: drop
# CIS 3.6.3 L1 Ensure loopback traffic is configured
# Configured in code
# CIS 3.6.4 L1 Ensure outbound and established connections are configured
# Configured in code
# CIS 3.6.5 L1 Ensure firewall rules exist for all open ports
profile::firewall::inbound:
'101 DHCP Server':
sport: 67
proto: udp
'110 SSH Access':
dport: 22
'161 NetBackup Server':
dport: [ 1556, 13724 ]
profile::firewall::outbound:
'101 DHCP Client':
sport: 68
proto: udp
'120 SSH Access':
sport: 22
'130 Puppet Server Access':
dport: [8140,8142]
destination: 10.5.162.0/24
'102 Network Time Protocol':
dport: 123
proto: udp
'103 Name Resolution TCP':
dport: 53
proto: tcp
'103 Name Resolution UDP':
dport: 53
proto: udp
'104 AD Authentication TCP':
dport: [ 88, 389, 445, 464, 3268 ]
'104 AD Authentication UDP':
dport: [ 88, 137, 389 ]
proto: udp
'140 RightLink Agent':
# From here: https://docs.rightscale.com/faq/Firewall_Configuration_Ruleset.html
dport: 443
destination:
- 54.225.248.128/27
- 54.244.88.96/27
- 54.86.63.128/26
- 54.187.254.128/26
- 54.246.247.16/28
- 54.248.220.128/28
- 54.255.255.208/28
- 52.65.255.224/28
'141 AWS Instance Data':
dport: 80
destination: 169.254.169.254/32
'145 Sumo Logic Monitoring':
# Unfortunately SUMO runs on AWS randomly, so we need to open up access to the whole of AWS EC2 for our region ap-southeast-2
# https://help.sumologic.com/APIs/General-API-Information/Sumo-Logic-Endpoints-and-Firewall-Security
dport: 443
destination:
- 13.210.0.0/15
- 13.236.0.0/14
- 13.54.0.0/15
- 15.193.3.0/24
- 3.104.0.0/14
- 3.24.0.0/14
- 52.62.0.0/15
- 52.64.0.0/17
- 52.64.128.0/17
- 52.65.0.0/16
- 52.94.248.64/28
- 52.95.241.0/24
- 52.95.255.16/28
- 54.153.128.0/17
- 54.206.0.0/16
- 54.252.0.0/16
- 54.253.0.0/16
- 54.66.0.0/16
- 54.79.0.0/16
- 99.77.144.0/24
# Currently some sumo installations are trying to hit the US AWS site us-east-1, hopefully we can delete these after getting the
# sumo agent to just point to AU
- 100.24.0.0/13
- 107.20.0.0/14
- 15.193.6.0/24
- 162.250.236.0/24
- 162.250.237.0/24
- 162.250.238.0/23
- 174.129.0.0/16
- 18.204.0.0/14
- 18.208.0.0/13
- 18.232.0.0/14
- 184.72.128.0/17
- 184.72.64.0/18
- 184.73.0.0/16
- 204.236.192.0/18
- 208.86.88.0/23
- 216.182.224.0/21
- 216.182.232.0/22
- 216.182.238.0/23
- 23.20.0.0/14
- 3.208.0.0/12
- 3.224.0.0/12
- 3.80.0.0/12
- 34.192.0.0/12
- 34.224.0.0/12
- 35.153.0.0/16
- 35.168.0.0/13
- 44.192.0.0/11
- 50.16.0.0/15
- 50.19.0.0/16
- 52.0.0.0/15
- 52.2.0.0/15
- 52.20.0.0/14
- 52.200.0.0/13
- 52.4.0.0/14
- 52.44.0.0/15
- 52.54.0.0/15
- 52.70.0.0/15
- 52.72.0.0/15
- 52.86.0.0/15
- 52.90.0.0/15
- 52.94.201.0/26
- 52.94.248.0/28
- 52.95.245.0/24
- 52.95.255.80/28
- 54.144.0.0/14
- 54.152.0.0/16
- 54.156.0.0/14
- 54.160.0.0/13
- 54.172.0.0/15
- 54.174.0.0/15
- 54.196.0.0/15
- 54.198.0.0/16
- 54.204.0.0/15
- 54.208.0.0/15
- 54.210.0.0/15
- 54.221.0.0/16
- 54.224.0.0/15
- 54.226.0.0/15
- 54.234.0.0/15
- 54.236.0.0/15
- 54.242.0.0/15
- 54.80.0.0/13
- 54.88.0.0/14
- 54.92.128.0/17
- 67.202.0.0/18
- 72.44.32.0/19
- 75.101.128.0/17
- 99.77.128.0/24
- 99.77.129.0/24
- 99.77.191.0/24
- 99.77.254.0/24
'150 Telegraf Monitoring':
dport: 80
destination: [ 10.212.82.107/32, 10.212.85.6/32 ]
'160 YUM Server':
dport: [ 80, 443 ]
destination: "%{::yum_server}"
'161 NetBackup Server':
dport: [ 1556, 13724 ]
'162 Mail Server':
dport: 25
destination: "%{hiera('networking::mailclient::relayhost')}"
'163 Log Server':
dport: [ 5514, 6514 ]
destination:
- "%{hiera('profile::nxlog_client::logserver1')}"
- "%{hiera('profile::nxlog_client::logserver2')}"
# CIS 3.7 L1 Ensure wireless interfaces are disabled
# CIS 4.2.1.1 L1 Ensure rsyslog Service is enabled
# CIS 4.2.1.3 L1 Ensure rsyslog default file permissions configured
# CIS 4.2.1.4 L1 Ensure rsyslog is configured to send logs to a remote log host
# CIS 4.2.1.5 L1 Ensure remote rsyslog messages are only accepted on designated log hosts. - imtcp.so
# CIS 4.2.1.5 L1 Ensure remote rsyslog messages are only accepted on designated log hosts. - InputTCPServerRun 514
# CIS 4.2.2.1 L1 Ensure syslog-ng service is enabled
# CIS 4.2.2.3 L1 Ensure syslog-ng default file permissions configured
# CIS 4.2.2.4 L1 Ensure syslog-ng is configured to send logs to a remote log host - destination logserver
# CIS 4.2.2.4 L1 Ensure syslog-ng is configured to send logs to a remote log host - log src
# CIS 4.2.2.5 L1 Ensure remote syslog-ng messages are only accepted on designated log hosts
# CIS 4.2.4 L1 Ensure permissions on all logfiles are configured
# CIS 5.2.1 L1 Ensure permissions on /etc/ssh/sshd_config are configured
# Set to 600 by SSH server module
profile::ssh::options_hash:
# CIS 5.2.2 L1 Ensure SSH Protocol is set to 2
Protocol: '2'
# CIS 5.2.3 L1 Ensure SSH LogLevel is set to INFO
LogLevel: INFO
# CIS 5.2.4 L1 Ensure SSH X11 forwarding is disabled
X11Forwarding: no
# CIS 5.2.5 L1 Ensure SSH MaxAuthTries is set to 4 or less
MaxAuthTries: '4'
# CIS 5.2.6 L1 Ensure SSH IgnoreRhosts is enabled
IgnoreRhosts: yes
# CIS 5.2.7 L1 Ensure SSH HostbasedAuthentication is disabled
HostbasedAuthentication: no
# CIS 5.2.8 L1 Ensure SSH root login is disabled
PermitRootLogin: no
# CIS 5.2.9 L1 Ensure SSH PermitEmptyPasswords is disabled
PermitEmptyPasswords: no
# CIS 5.2.10 L1 Ensure SSH PermitUserEnvironment is disabled
PermitUserEnvironment: no
# CIS 5.2.11 L1 Ensure only approved MAC algorithms are used
MACs: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
# CIS 5.2.12 L1 Ensure SSH Idle Timeout Interval is configured - ClientAliveInterval - setting to an hour to balance productivity
ClientAliveInterval: '3600'
# CIS 5.2.12 L1 Ensure SSH Idle Timeout Interval is configured - ClientAliveCountMax
ClientAliveCountMax: '0'
# CIS 5.2.13 L1 Ensure SSH LoginGraceTime is set to one minute or less
LoginGraceTime: 60
# CIS 5.2.15 L1 Ensure SSH warning banner is configured
Banner: /etc/issue
# CIS 5.2.14 L1 Ensure SSH access is limited
profile::ssh::allowed_groups:
- gg_linux_admins
# CIS 5.3.2 L1 Ensure lockout for failed password attempts is configured - system-auth 'auth required pam_faillock.so'
# CIS 5.3.2 L1 Ensure lockout for failed password attempts is configured - system-auth 'auth [success=1 default=bad] pam_unix.so'
# CIS 5.3.2 L1 Ensure lockout for failed password attempts is configured - system-auth 'auth [default=die] pam_faillock.so'
# CIS 5.3.2 L1 Ensure lockout for failed password attempts is configured - system-auth 'auth sufficient pam_faillock.so'
# CIS 5.3.2 L1 Ensure lockout for failed password attempts is configured - password-auth 'auth required pam_faillock.so'
# CIS 5.3.2 L1 Ensure lockout for failed password attempts is configured - password-auth 'auth [success=1 default=bad] pam_unix.so'
# CIS 5.3.2 L1 Ensure lockout for failed password attempts is configured - password-auth 'auth [default=die] pam_faillock.so'
# CIS 5.3.2 L1 Ensure lockout for failed password attempts is configured - password-auth 'auth sufficient pam_faillock.so'
# CIS 5.3.3 L1 Ensure password reuse is limited - system-auth
# CIS 5.3.3 L1 Ensure password reuse is limited - password-auth
# CIS 5.3.4 L1 Ensure password hashing algorithm is SHA-512 - system-auth
# CIS 5.3.4 L1 Ensure password hashing algorithm is SHA-512 - password-auth
# Set via the central_auth module
# CIS 5.4.1.1 L1 Ensure password expiration is 365 days or less
# CIS 5.4.1.2 L1 Ensure minimum days between password changes is 7 or more
# CIS 5.4.1.3 L1 Ensure password expiration warning days is 7 or more
# CIS 5.4.1.4 L1 Ensure inactive password lock is 30 days or less
# CIS 5.4.1.5 L1 Ensure all users last password change date is in the past
# CIS 5.4.2 L1 Ensure system accounts are non-login
local_users::add::users:
root:
uid: 0
# CIS 5.4.3 L1 Ensure default group for the root account is GID 0
gid: 0
# CIS 5.6 L1 Ensure access to the su command is restricted - wheel group contains root
groups: [ wheel ]
profile::file_ops::file_lines:
/etc/bashrc:
# CIS 5.4.5 L2 Ensure default user shell timeout is 900 seconds or less - /etc/bashrc - setting to an hour to balance productivity
- line : 'TMOUT=3600'
match : 'TMOUT='
# CIS 5.4.4 L1 Ensure default user umask is 027 or more restrictive - /etc/bashrc
- line : ' umask 027'
match : ' umask 0\d\d'
multiple : true
# CIS 5.6 L1 Ensure access to the su command is restricted - pam_wheel.so
/etc/pam.d/su:
line : 'auth required pam_wheel.so use_uid'
match : '#auth required pam_wheel.so use_uid'
# CIS 3.3.3 L1 Ensure IPv6 is disabled
/etc/default/grub:
line: GRUB_CMDLINE_LINUX='ipv6.disable=1'
match: GRUB_CMDLINE_LINUX
# CIS 6.2.2 L1 Ensure no legacy '+' entries exist in /etc/passwd
/etc/passwd:
ensure: absent
line: '+'
# CIS 6.2.3 L1 Ensure no legacy '+' entries exist in /etc/shadow
/etc/shadow:
ensure: absent
line: '+'
# CIS 6.2.4 L1 Ensure no legacy '+' entries exist in /etc/group
/etc/group:
ensure: absent
line: '+'
# CIS 5.5 L1 Ensure root login is restricted to system console - TBD
# CIS 6.1.10 L1 Ensure no world writable files exist
# CIS 6.1.11 L1 Ensure no unowned files or directories exist
# CIS 6.1.12 L1 Ensure no ungrouped files or directories exist
# CIS 6.1.13 L1 Audit SUID executables
# CIS 6.1.14 L1 Audit SGID executables
# CIS 6.2.1 L1 Ensure password fields are not empty
# CIS 6.2.5 L1 Ensure root is the only UID 0 account
# CIS 6.2.6 L1 Ensure root PATH Integrity
# CIS 6.2.7 L1 Ensure all users' home directories exist
# CIS 6.2.8 L1 Ensure users' home directories permissions are 750 or more restrictive
# CIS 6.2.9 L1 Ensure users own their home directories
# CIS 6.2.10 L1 Ensure users' dot files are not group or world writable
# CIS 6.2.11 L1 Ensure no users have .forward files
# CIS 6.2.12 L1 Ensure no users have .netrc files
# CIS 6.2.13 L1 Ensure users' .netrc Files are not group or world accessible
# CIS 6.2.14 L1 Ensure no users have .rhosts files
# CIS 6.2.15 L1 Ensure all groups in /etc/passwd exist in /etc/group
# CIS 6.2.16 L1 Ensure no duplicate UIDs exist
# CIS 6.2.17 L1 Ensure no duplicate GIDs exist
# CIS 6.2.18 L1 Ensure no duplicate user names exist
# CIS 6.2.19 L1 Ensure no duplicate group names exist
# CIS 1.6.1.1 L2 Ensure SELinux is not disabled in bootloader configuration - selinux = 0
# CIS 1.6.1.1 L2 Ensure SELinux is not disabled in bootloader configuration - enforcing = 0
profile::file_ops::templates:
# CIS 1.6.1.2 L2 Ensure the SELinux state is enforcing
# CIS 1.6.1.3 L2 Ensure SELinux policy is configured
/etc/selinux/config:
data:
setting: permissive
type: targeted
owner: root
group: root
mode: '0644'
content: |
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=<%= $setting %>
# SELINUXTYPE= can take one of these two values:
# targeted - Targeted processes are protected,
# mls - Multi Level Security protection.
SELINUXTYPE=<%= $type %>
# CIS 1.6.1.6 L2 Ensure no unconfined daemons exist
# CIS 6.1.1 L2 Audit system file permissions
Copy Permalink