Skip to content
This repository has been archived by the owner. It is now read-only.

Commit 5ffb7a2

Browse files
basepibasepi
authored
Merge pull request #277 from HubbleStack/develop
Merge to master (prep for v2016.10.2)
2 parents cee2c75 + 957ba22 commit 5ffb7a2

12 files changed

+1488
-577
lines changed

‎FORMULA

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
1-
top_level_dir: hubblestack_nova
21
name: hubblestack_nova
32
os: RedHat, CentOS, Debian, Ubuntu
43
os_family: RedHat, Debian
5-
version: 2016.9.2
4+
version: 2016.10.1
65
release: 1
76
summary: HubbleStack Nova
87
description: HubbleStack Nova

‎README.rst

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -243,20 +243,15 @@ the purposes of compliance percentage.
243243
Schedule
244244
--------
245245

246-
In order to run the audits once daily, you can use the following schedule:
246+
In order to run the audits once daily, you can use the following cron job:
247+
248+
**/etc/cron.d/hubble**
247249

248250
.. code-block:: yaml
249251
250-
schedule:
251-
nova_day:
252-
function: hubble.top
253-
seconds: 86400
254-
kwargs:
255-
verbose: True
256-
show_profile: True
257-
returner: splunk_nova_return
258-
return_job: False
259-
run_on_start: False
252+
MAILTO=""
253+
SHELL=/bin/bash
254+
@daily root /usr/bin/salt '*' hubble.top verbose=True,show_profile=True --return splunk_nova_return
260255
261256
.. _nova_configuration:
262257

‎hubblestack_nova/win_secedit.py

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -264,11 +264,13 @@ def _secedit_import(inf_file):
264264
def _get_account_sid():
265265
'''This helper function will get all the users and groups on the computer
266266
and return a dictionary'''
267-
win32 = __salt__['cmd.run']('Get-WmiObject win32_useraccount | Format-List -Property '
268-
'Name, SID', shell='powershell', python_shell=True)
267+
win32 = __salt__['cmd.run']('Get-WmiObject win32_useraccount -Filter "localaccount=\'True\'"'
268+
' | Format-List -Property Name, SID', shell='powershell',
269+
python_shell=True)
269270
win32 += '\n'
270-
win32 += __salt__['cmd.run']('Get-WmiObject win32_group | Format-List -Property Name, '
271-
'SID', shell='powershell', python_shell=True)
271+
win32 += __salt__['cmd.run']('Get-WmiObject win32_group -Filter "localaccount=\'True\'" | '
272+
'Format-List -Property Name, SID', shell='powershell',
273+
python_shell=True)
272274
if win32:
273275

274276
dict_return = {}
@@ -278,7 +280,7 @@ def _get_account_sid():
278280
lines.remove('local:')
279281
for line in lines:
280282
line = line.strip()
281-
if line != '':
283+
if line != '' and ' : ' in line:
282284
k, v = line.split(' : ')
283285
if k.lower() == 'name':
284286
key = v

‎hubblestack_nova_profiles/cis/centos-7-level-1-scored-v2-1-0.yaml

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ grep:
4646
pattern: password
4747
tag: CIS-1.4.2
4848
description: Ensure bootloader password is set
49-
chargen_diabled:
49+
chargen_disabled:
5050
data:
5151
Red Hat Enterprise Server-7:
5252
- /etc/xinetd.d/chargen-dgram:
@@ -70,7 +70,7 @@ grep:
7070
match_output: yes
7171
tag: CIS-2.1.2
7272
description: Ensure daytime services are not enabled
73-
discard_diabled:
73+
discard_disabled:
7474
data:
7575
Red Hat Enterprise Server-7:
7676
- /etc/xinetd.d/discard-dgram:
@@ -82,7 +82,7 @@ grep:
8282
match_output: yes
8383
tag: CIS-2.1.3
8484
description: Ensure discard services are not enabled
85-
echo_diabled:
85+
echo_disabled:
8686
data:
8787
Red Hat Enterprise Server-7:
8888
- /etc/xinetd.d/echo-dgram:
@@ -94,7 +94,7 @@ grep:
9494
match_output: yes
9595
tag: CIS-2.1.4
9696
description: Ensure echo services are not enabled
97-
time_diabled:
97+
time_disabled:
9898
data:
9999
Red Hat Enterprise Server-7:
100100
- /etc/xinetd.d/time-dgram:
@@ -155,7 +155,7 @@ grep:
155155
- '-r'
156156
tag: CIS-5.4.4
157157
description: Ensure default user umask is 027 or more restrictive
158-
disble_mount_cramfs:
158+
disable_mount_cramfs:
159159
data:
160160
CentOS Linux-7:
161161
- /etc/modprobe.d:
@@ -165,7 +165,7 @@ grep:
165165
- '-r'
166166
tag: CIS-1.1.1.1
167167
description: Ensure mounting of cramfs filesystems is disabled
168-
disble_mount_freevxfs:
168+
disable_mount_freevxfs:
169169
data:
170170
CentOS Linux-7:
171171
- /etc/modprobe.d:
@@ -175,7 +175,7 @@ grep:
175175
- '-r'
176176
tag: CIS-1.1.1.2
177177
description: Ensure mounting of freevxfs filesystems is disabled
178-
disble_mount_jffs2:
178+
disable_mount_jffs2:
179179
data:
180180
CentOS Linux-7:
181181
- /etc/modprobe.d:
@@ -185,7 +185,7 @@ grep:
185185
- '-r'
186186
tag: CIS-1.1.1.3
187187
description: Ensure mounting of jffs2 filesystems is disabled
188-
disble_mount_hfs:
188+
disable_mount_hfs:
189189
data:
190190
CentOS Linux-7:
191191
- /etc/modprobe.d:
@@ -195,7 +195,7 @@ grep:
195195
- '-r'
196196
tag: CIS-1.1.1.4
197197
description: Ensure mounting of hfs filesystems is disabled
198-
disble_mount_hfsplus:
198+
disable_mount_hfsplus:
199199
data:
200200
CentOS Linux-7:
201201
- /etc/modprobe.d:
@@ -205,7 +205,7 @@ grep:
205205
- '-r'
206206
tag: CIS-1.1.1.5
207207
description: Ensure mounting of hfsplus filesystems is disabled
208-
disble_mount_squashfs:
208+
disable_mount_squashfs:
209209
data:
210210
CentOS Linux-7:
211211
- /etc/modprobe.d:
@@ -215,7 +215,7 @@ grep:
215215
- '-r'
216216
tag: CIS-1.1.1.6
217217
description: Ensure mounting of squashfs filesystems is disabled
218-
disble_mount_udf:
218+
disable_mount_udf:
219219
data:
220220
CentOS Linux-7:
221221
- /etc/modprobe.d:
@@ -225,7 +225,7 @@ grep:
225225
- '-r'
226226
tag: CIS-1.1.1.7
227227
description: Ensure mounting of udf filesystems is disabled
228-
disble_mount_far:
228+
disable_mount_fat:
229229
data:
230230
CentOS Linux-7:
231231
- /etc/modprobe.d:

‎hubblestack_nova_profiles/cis/centos-7-level-1-scored-v2.yaml

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ grep:
4646
pattern: password
4747
tag: CIS-1.4.2
4848
description: Set Boot Loader Password (Scored)
49-
chargen_diabled:
49+
chargen_disabled:
5050
data:
5151
Red Hat Enterprise Server-7:
5252
- /etc/xinetd.d/chargen-dgram:
@@ -70,7 +70,7 @@ grep:
7070
match_output: yes
7171
tag: CIS-2.1.2
7272
description: Ensure that daytime service in not enabled (Scored)
73-
discard_diabled:
73+
discard_disabled:
7474
data:
7575
Red Hat Enterprise Server-7:
7676
- /etc/xinetd.d/discard-dgram:
@@ -82,7 +82,7 @@ grep:
8282
match_output: yes
8383
tag: CIS-2.1.3
8484
description: Ensure that discard service in not enabled (Scored)
85-
echo_diabled:
85+
echo_disabled:
8686
data:
8787
Red Hat Enterprise Server-7:
8888
- /etc/xinetd.d/echo-dgram:
@@ -94,7 +94,7 @@ grep:
9494
match_output: yes
9595
tag: CIS-2.1.4
9696
description: Ensure that echo service in not enabled (Scored)
97-
time_diabled:
97+
time_disabled:
9898
data:
9999
Red Hat Enterprise Server-7:
100100
- /etc/xinetd.d/time-dgram:
@@ -155,7 +155,7 @@ grep:
155155
- '-r'
156156
tag: CIS-5.4.4
157157
description: Set Default umask for Users (Scored)
158-
disble_mount_cramfs:
158+
disable_mount_cramfs:
159159
data:
160160
CentOS Linux-7:
161161
- /etc/modprobe.d:
@@ -165,7 +165,7 @@ grep:
165165
- '-r'
166166
tag: CIS-1.1.1.1
167167
description: Disable mounting cramfs filesystems (Scored).
168-
disble_mount_freevxfs:
168+
disable_mount_freevxfs:
169169
data:
170170
CentOS Linux-7:
171171
- /etc/modprobe.d:
@@ -175,7 +175,7 @@ grep:
175175
- '-r'
176176
tag: CIS-1.1.1.2
177177
description: Disable mounting freevxfs filesystems (Scored).
178-
disble_mount_jffs2:
178+
disable_mount_jffs2:
179179
data:
180180
CentOS Linux-7:
181181
- /etc/modprobe.d:
@@ -185,7 +185,7 @@ grep:
185185
- '-r'
186186
tag: CIS-1.1.1.3
187187
description: Disable mounting jffs2 filesystems (Scored).
188-
disble_mount_hfs:
188+
disable_mount_hfs:
189189
data:
190190
CentOS Linux-7:
191191
- /etc/modprobe.d:
@@ -195,7 +195,7 @@ grep:
195195
- '-r'
196196
tag: CIS-1.1.1.4
197197
description: Disable mounting hfs filesystems (Scored).
198-
disble_mount_hfsplus:
198+
disable_mount_hfsplus:
199199
data:
200200
CentOS Linux-7:
201201
- /etc/modprobe.d:
@@ -205,7 +205,7 @@ grep:
205205
- '-r'
206206
tag: CIS-1.1.1.5
207207
description: Disable mounting hfsplus filesystems (Scored).
208-
disble_mount_squashfs:
208+
disable_mount_squashfs:
209209
data:
210210
CentOS Linux-7:
211211
- /etc/modprobe.d:
@@ -215,7 +215,7 @@ grep:
215215
- '-r'
216216
tag: CIS-1.1.1.6
217217
description: Disable mounting squashfs filesystems (Scored).
218-
disble_mount_udf:
218+
disable_mount_udf:
219219
data:
220220
CentOS Linux-7:
221221
- /etc/modprobe.d:
@@ -225,7 +225,7 @@ grep:
225225
- '-r'
226226
tag: CIS-1.1.1.7
227227
description: Disable mounting udf filesystems (Scored).
228-
disble_mount_far:
228+
disable_mount_fat:
229229
data:
230230
CentOS Linux-7:
231231
- /etc/modprobe.d:
@@ -905,7 +905,9 @@ stat:
905905
data:
906906
CentOS Linux-7:
907907
- /etc/passwd:
908+
gid: 0
908909
group: root
910+
mode: 644
909911
tag: CIS-6.1.2
910912
uid: 0
911913
user: root
@@ -947,7 +949,9 @@ stat:
947949
data:
948950
CentOS Linux-7:
949951
- /etc/passwd-:
952+
gid: 0
950953
group: root
954+
mode: 644
951955
tag: CIS-6.1.6
952956
uid: 0
953957
user: root

0 commit comments

Comments
 (0)