jessereynolds / cis

cis

Welcome to your new module. A short overview of the generated parts can be found in the PDK documentation at https://puppet.com/pdk/latest/pdk_generating_modules.html .

The README template below provides a starting point with details about what information to include in your README.

Table of Contents

1. Description
2. Setup - The basics of getting started with cis
   • What cis affects
   • Setup requirements
   • Beginning with cis
3. Usage - Configuration options and additional functionality
4. Reference - An under-the-hood peek at what the module is doing and how
5. Limitations - OS compatibility, etc.
6. Development - Guide for contributing to the module

Description

Start with a one- or two-sentence summary of what the module does and/or what problem it solves. This is your 30-second elevator pitch for your module. Consider including OS/Puppet version it works with.

You can give more descriptive information in a second paragraph. This paragraph should answer the questions: "What does this module do?" and "Why would I use it?" If your module has a range of functionality (installation, configuration, management, etc.), this is the time to mention it.

Setup

What cis affects OPTIONAL

If it's obvious what your module touches, you can skip this section. For example, folks can probably figure out that your mysql_instance module affects their MySQL instances.

If there's more that they should know about, though, this is the place to mention:

• Files, packages, services, or operations that the module will alter, impact, or execute.
• Dependencies that your module automatically installs.
• Warnings or other important notices.

Setup Requirements OPTIONAL

If your module requires anything extra before setting up (pluginsync enabled, another module, etc.), mention it here.

If your most recent release breaks compatibility or requires particular steps for upgrading, you might want to include an additional "Upgrading" section here.

Beginning with cis

The very basic steps needed for a user to get the module up and running. This can include setup steps, if necessary, or it can be an example of the most basic use of the module.

Usage

This section is where you describe how to customize, configure, and do the fancy stuff with your module here. It's especially helpful if you include usage examples and code samples for doing things with your module.

Reference

Users need a complete list of your module's classes, types, defined types providers, facts, and functions, along with the parameters for each. You can provide this list either via Puppet Strings code comments or as a complete list in the README Reference section.

• If you are using Puppet Strings code comments, this Reference section should include Strings information so that your users know how to access your documentation.

• If you are not using Puppet Strings, include a list of all of your classes, defined types, and so on, along with their parameters. Each element in this listing should include:

  • The data type, if applicable.
  • A description of what the element does.
  • Valid values, if the data type doesn't make it obvious.
  • Default value, if any.

Limitations

This is where you list OS compatibility, version compatibility, etc. If there are Known Issues, you might want to include them under their own heading here.

Development

Since your module is awesome, other users will want to play with it. Let them know what the ground rules for contributing are.

Release Notes/Contributors/Etc. Optional

If you aren't using changelog, put your release notes here (though you should consider using changelog). You can also add any additional sections you feel are necessary or important to include here. Please use the ## header.

cis's Issues

Be able to use hiera to specify which controls are enforced and which are monitored on

Is nooping the controls which are to be monitored the best way to go? Seems the most conventional / straightforward.

Anyhow, as an operator of a fleet of systems I want to be able to set which CIS sections / controls are to be enforced, and which are to be monitored.

How might this look?

Profile to apply:

---
os_compliance::profiles: 
  - CIS-L1-Windows-2012-R2:
    mode: enforce
    exceptions:
      1.1.*: monitor
      1.2.*: monitor
      2.2.3: monitor
      2.2.5: monitor
      2.3.1.*: monitor
      2.3.1.3: enforce

# or more like:

os_compliance::excluded_sections:
  - 'cis::windows::security_options::accounts'

os_compliance::monitored_sections:
  - 'cis::windows::security_options::interactive_logon'

Mapping of a profile to a set of controls

---
os_security::profile_definitions::cis-l1-windows-2012r2:
  - 

class os_compliance {
}

class os_compliance::cis::windows_2012r2_l1::v_2_3_0::rule_1_1_1 (
  Enum['enforce','monitor','skip'] $mode = 'monitor',
) {
  case $mode {
    'monitor' => { 
      $skip = false
      noop()
    }
    'skip' => { $skip = true }
    default => { }
  }
  if $password_history != false {
    local_security_policy { 'Enforce password history':
      ensure       => present,
      policy_value => String($password_history),
      tags => ['cis_windows_2012r2_l1', 'cis_rule_1.1.1'],
    }
  }
}

or perhaps

class os_compliance::rule::password_history (
  Enum['enforce','monitor'] $mode = 'monitor',
) {
  if $mode == 'monitor' {
    noop()
  }

  local_security_policy { 'Enforce password history':
    ensure       => present,
    policy_value => String($password_history),
  }

}

and

class os_compliance::apply (
  $rulesets = [],
) {
  $rulesets.each |$ruleset| {
    lookup("os_compliance::ruleset::${ruleset}").each |$rule, $mode| {
      $rule_class = lookup("os_compliance::rule_alias::${rule}")
      class { "os_compliance::rule::${rule_class}":
        mode => $mode,
      }
    }
  }
}

os_compliance::apply::rulesets:
  'cis-l1-ms-windows-2012r2-2.3.0'

os_compliance::ruleset::cis-l1-ms-windows-2012r2-2.3.0:
  cis_1.1.1: enforce
  cis_1.1.2: monitor
  cis_1.1.3: enforce

os_compliance::ruleset::cis-l1-ms-windows-2008r2-3.1.0:
  cis_1.1.1: monitor
  cis_1.1.2: monitor
  cis_1.1.3: monitor

os_compliance::rule_alias::cis_1.1.1: password_history
os_compliance::rule_alias::cis_1.1.2: maximum_password_age
 

analyse windows 2012r2 noop output

Running against the merge_da branch...

class { 'cis::windows':
  is_domain_controller => false,
  admin_account_name   => 'Albatross',
  guest_account_name   => 'Seagull',
  logon_message        => 'No breaking the rules.',
  logon_title          => 'Logon title goes here',
}

Administrator@pe-201814-agent-win2012 MINGW64 ~/src
$ puppet apply --noop test.pp --modulepath ~/src/
Notice: Compiled catalog for pe-201814-agent-win2012 in environment production in 0.29 seconds
Notice: /Stage[main]/Cis::Windows::Account_policies::Lockout/Local_security_policy[Account lockout duration]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Lockout/Local_security_policy[Account lockout threshold]/policy_value: current_value '0', should be '10' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Lockout/Local_security_policy[Reset account lockout counter after]/ensure: current_value 'absent', should be 'present' (noop)
Notice: Class[Cis::Windows::Account_policies::Lockout]: Would have triggered 'refresh' from 3 events
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Enforce password history]/policy_value: current_value '0', should be '24' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Maximum password age]/policy_value: current_value '42', should be '60' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Minimum password age]/policy_value: current_value '0', should be '1' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Minimum password length]/policy_value: current_value '0', should be '14' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Password must meet complexity requirements]/policy_value: current_value '1', should be '0' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Store passwords using reversible encryption]/policy_value: current_value '0', should be '1' (noop)
Notice: Class[Cis::Windows::Account_policies::Passwords]: Would have triggered 'refresh' from 6 events
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Add workstations to domain]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Allow log on locally]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-545,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Back up files and directories]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on as a batch job]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on as a service]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on locally]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on through Remote Desktop Services]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Replace a process level token]/policy_value: current_value '*S-1-5-19,*S-1-5-20,cloudbase-init', should be '*S-1-5-19,*S-1-5-20' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Restore files and directories]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Shut down the system]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: Class[Cis::Windows::Local_policies::User_rights]: Would have triggered 'refresh' from 10 events
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Block Microsoft accounts]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Limit local account use of blank passwords to console logon only]/policy_value: current_value '4,1', should be '4,0' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Rename administrator account]/policy_value: current_value '"Administrator"', should be 'Albatross' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Rename guest account]/policy_value: current_value '"Guest"', should be 'Seagull' (noop)
Notice: Class[Cis::Windows::Security_options::Accounts]: Would have triggered 'refresh' from 4 events
Notice: /Stage[main]/Cis::Windows::Security_options::Audit/Local_security_policy[Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Audit/Local_security_policy[Audit: Shut down system immediately if unable to log security audits]/policy_value: current_value '4,0', should be '4,1' (noop)
Notice: Class[Cis::Windows::Security_options::Audit]: Would have triggered 'refresh' from 2 events
Notice: /Stage[main]/Cis::Windows::Security_options::Devices/Local_security_policy[Devices: Allowed to format and eject removable media]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Devices/Local_security_policy[Devices: Prevent users from installing printer drivers]/policy_value: current_value '4,1', should be '4,0' (noop)
Notice: Class[Cis::Windows::Security_options::Devices]: Would have triggered 'refresh' from 2 events
Notice: Stage[main]: Would have triggered 'refresh' from 6 events
Notice: Applied catalog in 25.54 seconds