Home

Awesome

os-hardening (Chef cookbook)

Supermarket Tests

Description

This cookbook provides numerous security-related configurations, providing all-round base protection.

It configures:

It will not:

Requirements

Platform

Attributes

Controlling the included components

default.rb includes other components based on the ohai autodetection attributes of your system. E.g. do not execute selinux on non-RHEL systems. You can override this behavior and force components to be executed or not via setting attributes in node['os-hardening']['components'] on the override level. Example

# some attribute file
# do not include sysctl and auditd
override['os-hardening']['components']['sysctl'] = false
override['os-hardening']['components']['auditd'] = false

# force selinux to be included
override['os-hardening']['components']['selinux'] = true

In the current implementation different components are located in the different recipes. See the available recipes or default.rb for possible component names.

Usage

Add the recipes to the run_list, it should be last:

"recipe[os-hardening]"

Configure attributes:

"security" : {
  "kernel" : {
    "enable_module_loading" : true
  }
},

Local Testing

Local testing

Please install chef-dk, VirtualBox or VMware Workstation and Vagrant.

Linting is checked with rubocop and foodcritic:

$ chef exec rake lint
.....

Unit/spec tests are done with chefspec:

$ chef exec rake spec
.....

Integration tests are done with test-kitchen and inspec:

$ chef exec rake kitchen
.....
# or you can use the kitchen directly
$ kitchen test

CI testing of forks

You can enable testing of your fork in Travis CI. By default you will get linting, spec tests and integration tests with kitchen-dokken.

Integration tests with kitchen-dokken do not cover everything as they run in the container environment. Full integration tests can be executed using DigitalOcean.

If you want to have full integration tests for your fork, you will have to add following environment variables in the settings of your fork:

Contributors + Kudos

This cookbook is mostly based on guides by:

Thanks to all of you!!

Contributing

See contributor guideline.

License and Author

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.