cookbook 'audit-cis', '= 0.3.3'
audit-cis (7) Versions 0.3.3 Follow20
Chef audit-mode controls for CIS Benchmarks
cookbook 'audit-cis', '= 0.3.3', :supermarket
knife supermarket install audit-cis
knife supermarket download audit-cis
audit-cis
This cookbook implements recipes that perform a Chef Audit Mode check for the CIS Benchmarks. Each recipe represents an entire benchmark's implementation. They are intended to be run wholesale against the target platform. The check may fail depending on the base OS installation.
This cookbook is intended to be used only with Chef's audit mode and should not make any changes to the system. Implementation of the benchmarks is up to individuals and organizations security policy. This cookbook does not perform any sort of "scoring" according to the CIS Benchmarks.
This cookbook is not supported or endorsed by the Center for Internet Security or its affiliates.
See [FAQ](FAQ) for more information.
Requirements
Chef 12.1.0 or higher.
Platform
- CentOS 6, 7 (64 bit)
Recipe Naming
Recipes are named according to the benchmark that they check. For example, the CIS CentOS Linux 7 Benchmark v1.0.0 recipe is named centos7-100
. If a v1.0.1 is released, a new recipe would be added, centos7-101
.
The CIS publishes separate benchmarks across platform families. These are implemented as separate recipes in this cookbook. For example, there are benchmarks for CentOS 7 and RHEL 7. While these distributions are binary compatible, they are implemented in separate benchmarks, and separate recipes in this cookbook.
Recipes will be updated to the latest benchmark as is deemed reasonable and for newer point releases of individual distributions. For example, the CentOS 7 benchmark may be equally applicable on CentOS 7.1.
Usage
Add the recipe for the desired benchmark to the appropriate nodes and enable audit mode in /etc/chef/client.rb
.
audit_mode :enabled
Failures mean that the node does not comply with the benchmark's validation rules. Depending on site-specific security policies and business requirements, failures can be safe to ignore. In this case it may be desirable to implement Chef Analytics rules to filter and notify only on failures that are in scope.
Roadmap
Other platform benchmarks will be added in the future. We will target the following next:
- Ubuntu 14.04
- Ubuntu 12.04
- Windows Server 2012
It is not yet determined whether other non-platform benchmarks will be implemented (e.g., Apache HTTPD) in this cookbook, or in another one.
License and Author
- Author: Joshua Timberman joshua@chef.io
- Copyright (c) 2015, Chef Software, Inc. legal@chef.io
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Dependent cookbooks
This cookbook has no specified dependencies.
Contingent cookbooks
There are no cookbooks that are contingent upon this one.
v0.3.3
- Fix a typo in 3.9
- Check if postfix is installed, and adjust how to check whether the node listens on localhost:25 or not all all
v0.3.2
- Remove the guards around the metadata URLs
v0.3.1
- Use anchored regexp for gpgcheck
v0.3.0
- Implementation of audit mode control groups for all sections of CIS Benchmark for CentOS 7
Foodcritic Metric
0.3.3 failed this metric
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:126
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:216
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:252
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:277
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:306
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:427
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:456
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:551
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:619
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:644
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:732
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:861
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:932
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:1046
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:1097
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:1120
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:1154
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:116
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:205
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:240
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:284
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:407
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:436
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:531
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:599
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:624
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:696
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:825
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:896
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:1010
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:1061
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:1084
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:1118
FC031: Cookbook without metadata file: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/metadata.rb:1
FC045: Consider setting cookbook name in metadata: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/metadata.rb:1
0.3.3 failed this metric
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:216
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:252
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:277
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:306
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:427
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:456
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:551
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:619
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:644
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:732
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:861
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:932
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:1046
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:1097
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:1120
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos6-110.rb:1154
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:116
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:205
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:240
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:284
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:407
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:436
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:531
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:599
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:624
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:696
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:825
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:896
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:1010
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:1061
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:1084
FC005: Avoid repetition of resource declarations: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/recipes/centos7-100.rb:1118
FC031: Cookbook without metadata file: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/metadata.rb:1
FC045: Consider setting cookbook name in metadata: /tmp/cook/48db2f1200e05ea32d752b15/audit-cis/metadata.rb:1