complete CIS 2012r2 level 1 standard by MattTunny · Pull Request #11 · dev-sec/chef-windows-hardening

MattTunny · 2017-03-06T10:57:15Z

Not sure if you guys want to add this as a complete cis standard? I think it might be easier to group them via versions since a lot of settings are different e.g 2008/2012/2016. I also added all the testing for each setting with InSpec, I haven't added them to the other repo since this might not be the direction you want to go?

If so happy to start working on more versions

grdnrio · 2017-03-07T11:03:28Z

+SeCreateSymbolicLinkPrivilege = *S-1-5-32-544
+[Version]
+signature="$CHICAGO$"
+Revision=1


This is awesome. We spent some time building some tooling around managing local security policy with Chef using secedit. The objective was to make it as modular / flexible as possible and separate tooling to a hardening cookbook. It's rough and ready but there is- https://github.com/grdnrio/windows-security-policy

You'll see that we're building the inf file dynamically. Would appreciate your feedback on it. Also would be great to collaborate.

chris-rock

@MattTunny This is awesome work and I appreciate all the hard work you put into that PR. I see some parts that we need to improve before the merge:

add additional documentation (via InSpec tests and possible attributes)
split the big recipe into multiple smaller components

Could you also please sign-off your commits?

chris-rock · 2017-03-07T10:27:50Z

@@ -1,8 +1,7 @@
-name 'base-win2012-hardening'


I think there is no need to update that file. We updated the name of the cookbook. We should bump the version to 1.x though since this is adding a lot of new features

chris-rock · 2017-03-07T10:29:37Z

@@ -0,0 +1,571 @@
+#
+# Cookbook Name:: base-win2012-hardening
+# Recipe:: CIS_2012r2_L1


Be aware that all code is licensed under Apache 2

chris-rock · 2017-03-07T10:32:16Z

+# unless ENV['TEST_KITCHEN']
+
+# NTLM Hardening -- This settings breaks WinRM
+if node['NTLM_Harden'] == true


We need to update the parameters in our README.

yeah i'll remove it for now and add it as a seperate recipe

chris-rock · 2017-03-07T10:33:03Z

+  end
+end
+
+# Winlogon Settings


I am thinking about different recipes for each component, like winlogon.rb, lsa.rb what do you think?

yeah thats a better way, i'll split them all out

chris-rock · 2017-03-07T10:34:35Z

+  action :create
+end
+
+# Setting this on breaks test-kitchen - Federal Information Processing Standards.


This highlights that we need to reference that to the specific standard. I propose to do that in a approved InSpec benchmark https://github.com/dev-sec/windows-baseline

chris-rock · 2017-03-07T10:36:36Z

+# found at http://inspec.io/docs/reference/resources/
+
+# WinLogon Tests
+describe registry_key('HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon') do


It is okay to have integration tests here. For improved user experience, we should move most tests to https://github.com/dev-sec/windows-baseline. This allows users to run the same tests easily against production environments

yeah, i'll start a pull request on breaking apart the tests in line with new ones added in here

chris-rock · 2017-03-07T10:57:29Z

-        - https://github.com/dev-sec/windows-hardening-benchmark
+        - https://github.com/dev-sec/windows-hardening-benchmark
+
+  - name: CIS_2012r2_L1


I feel like we should merge this and add the tests to https://github.com/dev-sec/windows-baseline

chris-rock · 2017-03-07T11:03:42Z

+end
+
+# LSA tests
+describe registry_key('HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa') do


I think we may want to use controls and add references to the specific cis benchmarks. Like

control 'lsa-1' do impact 1.0 title 'LSA Network access' desc 'Do not allow anonymous enumeration of SAM accounts and shares' to `Enabled`' tag cis: '2.3.11.3' ... tag remediation: 'https://github.com/dev-sec/chef-windows-hardening' ref 'CIS Windows 2012 R2', url: 'https://benchmarks.cisecurity.org/tools2/windows/CIS_Microsoft_Windows_Server_2012_R2_Benchmark_v1.1.0.pdf' describe registry_key() ... end end

Further examples are available here: https://github.com/chef/inspec/blob/master/examples/profile/controls/meta.rb

chris-rock · 2017-03-13T12:04:44Z

@MattTunny anything we can help you with?

MattTunny · 2017-03-13T20:17:34Z

nah all good, been really busy at work, will be able to do all these changes on the weekend hopefully

chris-rock · 2017-03-16T10:35:52Z

@MattTunny have a look at #16, this uses the flexible security policy generation

matthew.tunny added 3 commits February 21, 2017 21:01

added cis standard to merge

e2dac83

added CIS 2012r2 L1 standard without firewall

4ae65f4

removed reg keys already applied with chef

55e0177

chris-rock requested a review from grdnrio March 7, 2017 10:26

grdnrio reviewed Mar 7, 2017

View reviewed changes

chris-rock reviewed Mar 7, 2017

View reviewed changes

chris-rock added the enhancement label Mar 7, 2017

Conversation

MattTunny commented Mar 6, 2017

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chris-rock left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chris-rock commented Mar 13, 2017

Uh oh!

MattTunny commented Mar 13, 2017

Uh oh!

chris-rock commented Mar 16, 2017

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants