jessereynolds / cis Goto Github PK

View Code? Open in Web Editor NEW

This project forked from beergeek/cis

0.0 0.0 0.0 55 KB

Ruby 45.13% Puppet 54.17% Pascal 0.70%

cis's People

Contributors

cis's Issues

Be able to use hiera to specify which controls are enforced and which are monitored on

Is nooping the controls which are to be monitored the best way to go? Seems the most conventional / straightforward.

Anyhow, as an operator of a fleet of systems I want to be able to set which CIS sections / controls are to be enforced, and which are to be monitored.

How might this look?

Profile to apply:

---
os_compliance::profiles: 
  - CIS-L1-Windows-2012-R2:
    mode: enforce
    exceptions:
      1.1.*: monitor
      1.2.*: monitor
      2.2.3: monitor
      2.2.5: monitor
      2.3.1.*: monitor
      2.3.1.3: enforce

# or more like:

os_compliance::excluded_sections:
  - 'cis::windows::security_options::accounts'

os_compliance::monitored_sections:
  - 'cis::windows::security_options::interactive_logon'

Mapping of a profile to a set of controls

---
os_security::profile_definitions::cis-l1-windows-2012r2:
  -

class os_compliance {
}

class os_compliance::cis::windows_2012r2_l1::v_2_3_0::rule_1_1_1 (
  Enum['enforce','monitor','skip'] $mode = 'monitor',
) {
  case $mode {
    'monitor' => { 
      $skip = false
      noop()
    }
    'skip' => { $skip = true }
    default => { }
  }
  if $password_history != false {
    local_security_policy { 'Enforce password history':
      ensure       => present,
      policy_value => String($password_history),
      tags => ['cis_windows_2012r2_l1', 'cis_rule_1.1.1'],
    }
  }
}

or perhaps

class os_compliance::rule::password_history (
  Enum['enforce','monitor'] $mode = 'monitor',
) {
  if $mode == 'monitor' {
    noop()
  }

  local_security_policy { 'Enforce password history':
    ensure       => present,
    policy_value => String($password_history),
  }

}

and

class os_compliance::apply (
  $rulesets = [],
) {
  $rulesets.each |$ruleset| {
    lookup("os_compliance::ruleset::${ruleset}").each |$rule, $mode| {
      $rule_class = lookup("os_compliance::rule_alias::${rule}")
      class { "os_compliance::rule::${rule_class}":
        mode => $mode,
      }
    }
  }
}

os_compliance::apply::rulesets:
  'cis-l1-ms-windows-2012r2-2.3.0'

os_compliance::ruleset::cis-l1-ms-windows-2012r2-2.3.0:
  cis_1.1.1: enforce
  cis_1.1.2: monitor
  cis_1.1.3: enforce

os_compliance::ruleset::cis-l1-ms-windows-2008r2-3.1.0:
  cis_1.1.1: monitor
  cis_1.1.2: monitor
  cis_1.1.3: monitor

os_compliance::rule_alias::cis_1.1.1: password_history
os_compliance::rule_alias::cis_1.1.2: maximum_password_age

analyse windows 2012r2 noop output

Running against the merge_da branch...

class { 'cis::windows':
  is_domain_controller => false,
  admin_account_name   => 'Albatross',
  guest_account_name   => 'Seagull',
  logon_message        => 'No breaking the rules.',
  logon_title          => 'Logon title goes here',
}

Administrator@pe-201814-agent-win2012 MINGW64 ~/src
$ puppet apply --noop test.pp --modulepath ~/src/
Notice: Compiled catalog for pe-201814-agent-win2012 in environment production in 0.29 seconds
Notice: /Stage[main]/Cis::Windows::Account_policies::Lockout/Local_security_policy[Account lockout duration]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Lockout/Local_security_policy[Account lockout threshold]/policy_value: current_value '0', should be '10' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Lockout/Local_security_policy[Reset account lockout counter after]/ensure: current_value 'absent', should be 'present' (noop)
Notice: Class[Cis::Windows::Account_policies::Lockout]: Would have triggered 'refresh' from 3 events
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Enforce password history]/policy_value: current_value '0', should be '24' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Maximum password age]/policy_value: current_value '42', should be '60' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Minimum password age]/policy_value: current_value '0', should be '1' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Minimum password length]/policy_value: current_value '0', should be '14' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Password must meet complexity requirements]/policy_value: current_value '1', should be '0' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Store passwords using reversible encryption]/policy_value: current_value '0', should be '1' (noop)
Notice: Class[Cis::Windows::Account_policies::Passwords]: Would have triggered 'refresh' from 6 events
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Add workstations to domain]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Allow log on locally]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-545,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Back up files and directories]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on as a batch job]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on as a service]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on locally]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on through Remote Desktop Services]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Replace a process level token]/policy_value: current_value '*S-1-5-19,*S-1-5-20,cloudbase-init', should be '*S-1-5-19,*S-1-5-20' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Restore files and directories]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Shut down the system]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: Class[Cis::Windows::Local_policies::User_rights]: Would have triggered 'refresh' from 10 events
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Block Microsoft accounts]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Limit local account use of blank passwords to console logon only]/policy_value: current_value '4,1', should be '4,0' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Rename administrator account]/policy_value: current_value '"Administrator"', should be 'Albatross' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Rename guest account]/policy_value: current_value '"Guest"', should be 'Seagull' (noop)
Notice: Class[Cis::Windows::Security_options::Accounts]: Would have triggered 'refresh' from 4 events
Notice: /Stage[main]/Cis::Windows::Security_options::Audit/Local_security_policy[Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Audit/Local_security_policy[Audit: Shut down system immediately if unable to log security audits]/policy_value: current_value '4,0', should be '4,1' (noop)
Notice: Class[Cis::Windows::Security_options::Audit]: Would have triggered 'refresh' from 2 events
Notice: /Stage[main]/Cis::Windows::Security_options::Devices/Local_security_policy[Devices: Allowed to format and eject removable media]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Devices/Local_security_policy[Devices: Prevent users from installing printer drivers]/policy_value: current_value '4,1', should be '4,0' (noop)
Notice: Class[Cis::Windows::Security_options::Devices]: Would have triggered 'refresh' from 2 events
Notice: Stage[main]: Would have triggered 'refresh' from 6 events
Notice: Applied catalog in 25.54 seconds

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.

Jobs

Jooble