jessereynolds / cis Goto Github PK
View Code? Open in Web Editor NEWThis project forked from beergeek/cis
This project forked from beergeek/cis
Is noop
ing the controls which are to be monitored the best way to go? Seems the most conventional / straightforward.
Anyhow, as an operator of a fleet of systems I want to be able to set which CIS sections / controls are to be enforced, and which are to be monitored.
How might this look?
Profile to apply:
---
os_compliance::profiles:
- CIS-L1-Windows-2012-R2:
mode: enforce
exceptions:
1.1.*: monitor
1.2.*: monitor
2.2.3: monitor
2.2.5: monitor
2.3.1.*: monitor
2.3.1.3: enforce
# or more like:
os_compliance::excluded_sections:
- 'cis::windows::security_options::accounts'
os_compliance::monitored_sections:
- 'cis::windows::security_options::interactive_logon'
Mapping of a profile to a set of controls
---
os_security::profile_definitions::cis-l1-windows-2012r2:
-
class os_compliance {
}
class os_compliance::cis::windows_2012r2_l1::v_2_3_0::rule_1_1_1 (
Enum['enforce','monitor','skip'] $mode = 'monitor',
) {
case $mode {
'monitor' => {
$skip = false
noop()
}
'skip' => { $skip = true }
default => { }
}
if $password_history != false {
local_security_policy { 'Enforce password history':
ensure => present,
policy_value => String($password_history),
tags => ['cis_windows_2012r2_l1', 'cis_rule_1.1.1'],
}
}
}
or perhaps
class os_compliance::rule::password_history (
Enum['enforce','monitor'] $mode = 'monitor',
) {
if $mode == 'monitor' {
noop()
}
local_security_policy { 'Enforce password history':
ensure => present,
policy_value => String($password_history),
}
}
and
class os_compliance::apply (
$rulesets = [],
) {
$rulesets.each |$ruleset| {
lookup("os_compliance::ruleset::${ruleset}").each |$rule, $mode| {
$rule_class = lookup("os_compliance::rule_alias::${rule}")
class { "os_compliance::rule::${rule_class}":
mode => $mode,
}
}
}
}
os_compliance::apply::rulesets:
'cis-l1-ms-windows-2012r2-2.3.0'
os_compliance::ruleset::cis-l1-ms-windows-2012r2-2.3.0:
cis_1.1.1: enforce
cis_1.1.2: monitor
cis_1.1.3: enforce
os_compliance::ruleset::cis-l1-ms-windows-2008r2-3.1.0:
cis_1.1.1: monitor
cis_1.1.2: monitor
cis_1.1.3: monitor
os_compliance::rule_alias::cis_1.1.1: password_history
os_compliance::rule_alias::cis_1.1.2: maximum_password_age
Running against the merge_da branch...
class { 'cis::windows':
is_domain_controller => false,
admin_account_name => 'Albatross',
guest_account_name => 'Seagull',
logon_message => 'No breaking the rules.',
logon_title => 'Logon title goes here',
}
Administrator@pe-201814-agent-win2012 MINGW64 ~/src
$ puppet apply --noop test.pp --modulepath ~/src/
Notice: Compiled catalog for pe-201814-agent-win2012 in environment production in 0.29 seconds
Notice: /Stage[main]/Cis::Windows::Account_policies::Lockout/Local_security_policy[Account lockout duration]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Lockout/Local_security_policy[Account lockout threshold]/policy_value: current_value '0', should be '10' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Lockout/Local_security_policy[Reset account lockout counter after]/ensure: current_value 'absent', should be 'present' (noop)
Notice: Class[Cis::Windows::Account_policies::Lockout]: Would have triggered 'refresh' from 3 events
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Enforce password history]/policy_value: current_value '0', should be '24' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Maximum password age]/policy_value: current_value '42', should be '60' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Minimum password age]/policy_value: current_value '0', should be '1' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Minimum password length]/policy_value: current_value '0', should be '14' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Password must meet complexity requirements]/policy_value: current_value '1', should be '0' (noop)
Notice: /Stage[main]/Cis::Windows::Account_policies::Passwords/Local_security_policy[Store passwords using reversible encryption]/policy_value: current_value '0', should be '1' (noop)
Notice: Class[Cis::Windows::Account_policies::Passwords]: Would have triggered 'refresh' from 6 events
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Add workstations to domain]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Allow log on locally]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-545,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Back up files and directories]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on as a batch job]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on as a service]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on locally]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Deny log on through Remote Desktop Services]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Replace a process level token]/policy_value: current_value '*S-1-5-19,*S-1-5-20,cloudbase-init', should be '*S-1-5-19,*S-1-5-20' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Restore files and directories]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: /Stage[main]/Cis::Windows::Local_policies::User_rights/Local_security_policy[Shut down the system]/policy_value: current_value '*S-1-5-32-544,*S-1-5-32-551', should be '*S-1-5-32-544' (noop)
Notice: Class[Cis::Windows::Local_policies::User_rights]: Would have triggered 'refresh' from 10 events
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Block Microsoft accounts]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Limit local account use of blank passwords to console logon only]/policy_value: current_value '4,1', should be '4,0' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Rename administrator account]/policy_value: current_value '"Administrator"', should be 'Albatross' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Accounts/Local_security_policy[Accounts: Rename guest account]/policy_value: current_value '"Guest"', should be 'Seagull' (noop)
Notice: Class[Cis::Windows::Security_options::Accounts]: Would have triggered 'refresh' from 4 events
Notice: /Stage[main]/Cis::Windows::Security_options::Audit/Local_security_policy[Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Audit/Local_security_policy[Audit: Shut down system immediately if unable to log security audits]/policy_value: current_value '4,0', should be '4,1' (noop)
Notice: Class[Cis::Windows::Security_options::Audit]: Would have triggered 'refresh' from 2 events
Notice: /Stage[main]/Cis::Windows::Security_options::Devices/Local_security_policy[Devices: Allowed to format and eject removable media]/ensure: current_value 'absent', should be 'present' (noop)
Notice: /Stage[main]/Cis::Windows::Security_options::Devices/Local_security_policy[Devices: Prevent users from installing printer drivers]/policy_value: current_value '4,1', should be '4,0' (noop)
Notice: Class[Cis::Windows::Security_options::Devices]: Would have triggered 'refresh' from 2 events
Notice: Stage[main]: Would have triggered 'refresh' from 6 events
Notice: Applied catalog in 25.54 seconds
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.