Code Monkey home page Code Monkey logo

canonical-ubuntu-18.04-lts-stig-baseline's Introduction

(WIP) canonical-ubuntu-18.04-lts-stig-baseline

InSpec Profile to validate the secure configuration of Canonical Ubuntu 18.04 LTS, against the DISA's STIGs.

Getting Started

It is intended and recommended that InSpec run this profile from a "runner" host (such as a DevOps orchestration server, an administrative management system, or a developer's workstation/laptop) against the target remotely over ssh.

For the best security of the runner, always install on the runner the latest version of InSpec and supporting Ruby language components.

Latest versions and installation options are available at the InSpec site.

Git is required to download the latest InSpec profiles using the instructions below. Git can be downloaded from the Git site.

The following attributes must be configured in an attributes file for the profile to run correctly. More information about InSpec attributes can be found in the InSpec Profile Documentation.

# Input description
input_name: 'value'

For more info on inspec inputs see https://docs.chef.io/inspec/inputs/

Running This Profile.

When the "runner" host uses this profile overlay for the first time, follow these steps:

inspec exec https://github.com/mitre/canonical-ubuntu-18.04-lts-stig-baseline.git --input-files=<path_to_your_input_file/name_of_your_input.yml> [-t <transport_protocol>://<hostname>:<port> --user=<username> --password=<password>] --reporter=cli json:<path_to_your_output_file/name_of_your_output_file.json>

This will run the latest version of the profile from your runner.

Viewing the JSON Results

The JSON results output file can be loaded into heimdall-lite for a user-interactive, graphical view of the InSpec results.

The JSON InSpec results file may also be loaded into a full heimdall server, allowing for additional functionality such as to store and compare multiple profile runs.

Contributing and Getting Help

To report a bug or feature request, please open an issue.

Authors

Reviewers

Special Thanks

License

This project is licensed under the terms of the Apache 2.0 license excepted as noted in LICENSE.

NOTICE

© 2019-2021 The MITRE Corporation.

Approved for Public Release; Distribution Unlimited. Case Number 18-3678.

NOTICE

MITRE hereby grants express written permission to use, reproduce, distribute, modify, and otherwise leverage this software to the extent permitted by the licensed terms provided in the LICENSE.md file included with this project.

NOTICE

This software was produced for the U. S. Government under Contract Number HHSM-500-2012-00008I, and is subject to Federal Acquisition Regulation Clause 52.227-14, Rights in Data-General.

No other use other than that granted to the U. S. Government, or to those acting on behalf of the U. S. Government under that Clause is authorized without the express written permission of The MITRE Corporation.

For further information, please contact The MITRE Corporation, Contracts Management Office, 7515 Colshire Drive, McLean, VA 22102-7539, (703) 983-6000.

NOTICE

DISA STIGs are published by DISA IASE , see: https://iase.disa.mil/Pages/privacy_policy.aspx .

canonical-ubuntu-18.04-lts-stig-baseline's People

Contributors

aaronlippold avatar ghexp avatar ranguli avatar yarick avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

yarick expeditiontechnology valancej gr8sk8s

canonical-ubuntu-18.04-lts-stig-baseline's Issues

add docs on how we want folks to submit PRs

For example:

Development

Submitting a PR

  1. A complete PR should include 7 core elements:
  2. A signed PR ( aka git commit -a -s )
  3. Code for the new functionality
  4. Updates to the CLI
  5. New unit tests for the functionality
  6. Updates to the docs and examples in README.md and ./docs/*
  7. (if needed) Example / Template files ( metadata.yml,example.yml, etc )
  8. Scripts / Scaffolding code for the Example / Template files ( generate_map is an example )
  9. Example Output of the new functionality if it produces an artifact

Overview of our PR process.

  1. open an issue on the main inspec_tools website noting the issues your PR will address
  2. fork the repo
  3. checkout your fork
  4. cd to the repo
  5. git co -b <your_branch>
  6. bundle install
  7. hack as you will
  8. test via rake
  9. ensure unit tests still function and add unit tests for your new feature
  10. add new docs to the README.md and to ./docs/examples
  11. update the CLI as needed and add in usage example
  12. (if needed) create and document any example or templates
  13. (if needed) create any supporing scripts
  14. (opt) gem build inspec_tools.gemspec
  15. (opt) gem install inspec_tools
  16. (opt) test via the installed gem
  17. git commit -a -s <your_branch>
  18. Open a PRs aginst the MITRE inspec_tools repo

Ansible Hardening Content WARNINGs

Duplicate variable errors. Variables should be defined only once as only one value will be used.

[WARNING]: While constructing a mapping from /tmp/kitchen/roles/ansible-role-
       ubuntu-stig-hardening/vars/main.yml, line 2, column 1, found a duplicate dict
       key (security_audit_tools). Using last defined value only.
       [WARNING]: While constructing a mapping from /tmp/kitchen/roles/ansible-role-
       ubuntu-stig-hardening/vars/main.yml, line 2, column 1, found a duplicate dict
       key (security_audisp_remote_server). Using last defined value only.
       [WARNING]: While constructing a mapping from /tmp/kitchen/roles/ansible-role-
       ubuntu-stig-hardening/vars/main.yml, line 2, column 1, found a duplicate dict
       key (security_audit_log). Using last defined value only.
       [WARNING]: While constructing a mapping from /tmp/kitchen/roles/ansible-role-
       ubuntu-stig-hardening/vars/main.yml, line 2, column 1, found a duplicate dict
       key (security_audit_log_directory). Using last defined value only.
       [WARNING]: While constructing a mapping from /tmp/kitchen/roles/ansible-role-
       ubuntu-stig-hardening/vars/main.yml, line 2, column 1, found a duplicate dict
       key (security_audit_directory). Using last defined value only.
       [WARNING]: Found variable using reserved name: roles

Ansible Hardening Content WARNINGs

Duplicate variable errors. Variables should be defined only once as only one value will be used.

[WARNING]: While constructing a mapping from /tmp/kitchen/roles/ansible-role-
       ubuntu-stig-hardening/vars/main.yml, line 2, column 1, found a duplicate dict
       key (security_audit_tools). Using last defined value only.
       [WARNING]: While constructing a mapping from /tmp/kitchen/roles/ansible-role-
       ubuntu-stig-hardening/vars/main.yml, line 2, column 1, found a duplicate dict
       key (security_audisp_remote_server). Using last defined value only.
       [WARNING]: While constructing a mapping from /tmp/kitchen/roles/ansible-role-
       ubuntu-stig-hardening/vars/main.yml, line 2, column 1, found a duplicate dict
       key (security_audit_log). Using last defined value only.
       [WARNING]: While constructing a mapping from /tmp/kitchen/roles/ansible-role-
       ubuntu-stig-hardening/vars/main.yml, line 2, column 1, found a duplicate dict
       key (security_audit_log_directory). Using last defined value only.
       [WARNING]: While constructing a mapping from /tmp/kitchen/roles/ansible-role-
       ubuntu-stig-hardening/vars/main.yml, line 2, column 1, found a duplicate dict
       key (security_audit_directory). Using last defined value only.
       [WARNING]: Found variable using reserved name: roles

Fix URL type in README.md

Line 33 of README.md references Heimdall-Lite, but the URL in the link is mistyped.

__[heimdall-lite](https://heimdll-lite.mitre.org)__ should be __[heimdall-lite](https://heimdall-lite.mitre.org)__

V-219303 fails 

     ×  The TMOUT setting is configured properly is expected to be <= 600. 
     expected: <= "600"  
          got:    600

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.