Puppet Class: security_baseline

Defined in:
manifests/init.pp

Summary

Security baseline enforcement and monitoring

Overview

Define a complete security baseline and monitor the rules. The definition of the baseline can be done in Hiera. The purpose of the module is to give the ability to setup complete security baseline which not necessarily have to stick to an industry security guide like the CIS benchmarks. One main purpose is to ensure the module can be extended by further security settings and monitorings without changing the code of this module.

The easiest way to use the module is to put all rule data into a hiera file. For more information please coinsult the README file.

Examples:

include security_baseline

Parameters:

  • baseline_version (String) —

    Version of the security ruleset

  • rules (Hash) —

    Hash containing the whole ruleset

  • debug (Boolean) (defaults to: false) —

    Switch debug output on

  • log_info (Boolean) (defaults to: false) —

    Switch logging with level info on

  • logfile (String) (defaults to: '/opt/puppetlabs/facter/facts.d/security_baseline_findings.yaml') —

    Logfile to write messages to

  • summary_report (String) (defaults to: '/opt/puppetlabs/facter/facts.d/security_baseline_summary.yaml') —

    File to write a summary report yaml report

  • auditd_suid_include (Array) (defaults to: []) —

    Directories to search for suid and sgid programs. Can not be set together with auditd_suid_exclude

  • auditd_suid_exclude (Array) (defaults to: []) —

    Directories to exclude from search for suid and sgid programs. Can not be set together with auditd_suid_include

  • auditd_rules_file (String) (defaults to: '/etc/audit/rules.d/sec_baseline_auditd.rules') —

    Files to write the auditd rules facts into.

  • reporting_type (Enum['fact', 'csv_file']) (defaults to: 'fact') —

    Select to type of reporting. ca currently be set to csv or fact.

  • reports (Enum['summary', 'details', 'both']) (defaults to: 'both') —

    Select which reports to produce.

  • auditd_rules_fact_file (String) (defaults to: '/opt/puppetlabs/facter/facts.d/security_baseline_auditd.yaml') —

    The file where to store the facts for auditd rules

  • suid_fact_file (String) (defaults to: '/opt/puppetlabs/facter/facts.d/security_baseline_suid_programs.yaml') —

    The file where to store the suid programms

  • sgid_fact_file (String) (defaults to: '/opt/puppetlabs/facter/facts.d/security_baseline_sgid_programs.yaml') —

    The file where to store the sgid programs

  • update_postrun_command (Boolean) (defaults to: true) —

    Update Puppet agent post run command

  • fact_upload_command (String) (defaults to: '/usr/share/security_baseline/bin/fact_upload.sh') —

    Command to use to upload facts to Puppet master

  • reboot (Boolean) (defaults to: false) —

    If set to true and there are classes with the reboot flag set to true a reboot will be performef if these classed fire

  • reboot_timeout (Integer) (defaults to: 60) —

    Timeout until reboot will take place

  • ruby_binary (String) (defaults to: '/opt/puppetlabs/puppet/bin/ruby') —

    Ruby binary to run the summary Ruby script



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
 
# File 'manifests/init.pp', line 73

class security_baseline (
  String $baseline_version,
  Hash $rules,
  Boolean $debug                              = false,
  Boolean $log_info                           = false,
  String $logfile                             = '/opt/puppetlabs/facter/facts.d/security_baseline_findings.yaml',
  String $summary_report                      = '/opt/puppetlabs/facter/facts.d/security_baseline_summary.yaml',
  Array $auditd_suid_include                  = [],
  Array $auditd_suid_exclude                  = [],
  String $auditd_rules_file                   = '/etc/audit/rules.d/sec_baseline_auditd.rules',
  Enum['fact', 'csv_file'] $reporting_type    = 'fact',
  Enum['summary', 'details', 'both'] $reports = 'both',
  String $auditd_rules_fact_file              = '/opt/puppetlabs/facter/facts.d/security_baseline_auditd.yaml',
  String $suid_fact_file                      = '/opt/puppetlabs/facter/facts.d/security_baseline_suid_programs.yaml',
  String $sgid_fact_file                      = '/opt/puppetlabs/facter/facts.d/security_baseline_sgid_programs.yaml',
  Boolean $update_postrun_command             = true,
  String $fact_upload_command                 = '/usr/share/security_baseline/bin/fact_upload.sh',
  Boolean $reboot                             = false,
  Integer $reboot_timeout                     = 60,
  String $ruby_binary                         = '/opt/puppetlabs/puppet/bin/ruby',
) {
  include ::security_baseline::services
  include ::security_baseline::system_file_permissions_cron
  include ::security_baseline::world_writeable_files_cron
  include ::security_baseline::unowned_files_cron

  if($debug) {
    echo { "Applying security baseline version: ${baseline_version}":
      loglevel => 'debug',
      withpath => false,
    }
  }

  class { '::security_baseline::config':
    update_postrun_command => $update_postrun_command,
    fact_upload_command    => $fact_upload_command,
    reporting_type         => $reporting_type,
    logfile                => $logfile,
    summary                => $summary_report,
    ruby_binary            => $ruby_binary,
  }

  class {'security_baseline::auditd_suid_rules_cron':
    include                => $auditd_suid_include,
    exclude                => $auditd_suid_exclude,
    auditd_rules_fact_file => $auditd_rules_fact_file,
    suid_fact_file         => $suid_fact_file,
    sgid_fact_file         => $sgid_fact_file,
  }

  if ($reports == 'both' or $reports == 'details') {
    if ($reporting_type == 'fact') {
      concat { $logfile:
        ensure => present,
        owner  => 'root',
        group  => 'root',
        mode   => '0644',
      }

      concat::fragment { 'start':
        content => epp('security_baseline/logfile_start.epp', {'version' => $baseline_version}),
        target  => $logfile,
        order   => 1,
      }
    } elsif ($reporting_type == 'csv_file') {
      concat { $logfile:
        ensure => present,
        owner  => 'root',
        group  => 'root',
        mode   => '0644',
      }
      concat::fragment { 'start':
        content => epp('security_baseline/csv_file_start.epp', {}),
        target  => $logfile,
        order   => 1,
      }
    }
  } elsif ($reports == 'summary') {
    file { $logfile:
      ensure => absent,
    }
  }

  create_resources('::security_baseline::sec_check', $rules)

  $reboot_classes = $rules.filter |$name, $data| {has_key($data, 'reboot') and ($data['reboot'] == true) }

  $classes = $reboot_classes.map |$key, $value| {
    if(defined(Class[$value['class']])) {
      capitalize($value['class'].split('::')).join('::')
    }
  }

  if($reports == 'both' or $reports == 'details') {
    if ($reporting_type == 'fact') {
      concat::fragment { 'finish':
        content => epp('security_baseline/logfile_end.epp', {}),
        target  => $logfile,
        order   => 9999,
      }
    } elsif ($reporting_type == 'csv_file') {
      concat::fragment { 'finish':
        content => epp('security_baseline/csv_file_end.epp', {}),
        target  => $logfile,
        order   => 9999,
      }
    }
  }

  if($reboot) {
    reboot { 'after_run':
      timeout   => $reboot_timeout,
      message   => 'forced reboot by Puppet',
      subscribe => Class[$classes],
      apply     => 'finished',
    }
  }
}