Menu

Chef Supermarket

Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

View our collection of guides, documentation, and articles

Cookbooks
Advanced Options

Select Badges

Select Supported Platforms

Select Status

RSS

audit-cis (7) Versions 0.4.0

Chef audit-mode controls for CIS Benchmarks

Policyfile
Berkshelf
Knife 
cookbook 'audit-cis', '~> 0.4.0', :supermarket
cookbook 'audit-cis', '~> 0.4.0'
knife supermarket install audit-cis
knife supermarket download audit-cis
README
Dependencies
Changelog
Quality 17%

audit-cis

This cookbook implements recipes that perform a Chef Audit Mode check for the CIS Benchmarks. Each recipe represents an entire benchmark's implementation. They are intended to be run wholesale against the target platform. The check may fail depending on the base OS installation.

This cookbook is intended to be used only with Chef's audit mode and should not make any changes to the system. Implementation of the benchmarks is up to individuals and organizations security policy. This cookbook does not perform any sort of "scoring" according to the CIS Benchmarks.

This cookbook is not supported or endorsed by the Center for Internet Security or its affiliates.

See [FAQ](FAQ) for more information.

Requirements

Chef 12.1.0 or higher.

Platform

  • CentOS 6, 7 (64 bit)

Recipe Naming

Recipes are named according to the benchmark that they check. For example, the CIS CentOS Linux 7 Benchmark v1.0.0 recipe is named centos7-100. If a v1.0.1 is released, a new recipe would be added, centos7-101.

The CIS publishes separate benchmarks across platform families. These are implemented as separate recipes in this cookbook. For example, there are benchmarks for CentOS 7 and RHEL 7. While these distributions are binary compatible, they are implemented in separate benchmarks, and separate recipes in this cookbook.

Recipes will be updated to the latest benchmark as is deemed reasonable and for newer point releases of individual distributions. For example, the CentOS 7 benchmark may be equally applicable on CentOS 7.1.

Usage

Add the recipe for the desired benchmark to the appropriate nodes and enable audit mode in /etc/chef/client.rb.

audit_mode :enabled

Failures mean that the node does not comply with the benchmark's validation rules. Depending on site-specific security policies and business requirements, failures can be safe to ignore. In this case it may be desirable to implement Chef Analytics rules to filter and notify only on failures that are in scope.

Roadmap

Other platform benchmarks will be added in the future. We will target the following next:

  • Ubuntu 14.04
  • Ubuntu 12.04
  • Windows Server 2012

It is not yet determined whether other non-platform benchmarks will be implemented (e.g., Apache HTTPD) in this cookbook, or in another one.

License and Author

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Dependent cookbooks

This cookbook has no specified dependencies.

Contingent cookbooks

There are no cookbooks that are contingent upon this one.

v0.4.0

  • Add a recipe for Ubuntu 14.04
  • Fix level two check to correct block in CentOS 7 recipe

v0.3.3

  • Fix a typo in 3.9
  • Check if postfix is installed, and adjust how to check whether the node listens on localhost:25 or not all all

v0.3.2

  • Remove the guards around the metadata URLs

v0.3.1

  • Use anchored regexp for gpgcheck

v0.3.0

  • Implementation of audit mode control groups for all sections of CIS Benchmark for CentOS 7

Collaborator Number Metric 
            
0.4.0 failed this metric
Failure: Cookbook has 0 collaborators. A cookbook must have at least 2 collaborators to pass this metric.

Contributing File Metric 
            
0.4.0 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a CONTRIBUTING.md file

Cookstyle Metric 
            
0.4.0 failed this metric
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos6-110.rb: 26
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos6-110.rb: 304
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos6-110.rb: 387
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos6-110.rb: 537
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos6-110.rb: 682
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos6-110.rb: 859
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos6-110.rb: 1042
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos6-110.rb: 1091
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos6-110.rb: 1140
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos7-100.rb: 25
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos7-100.rb: 282
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos7-100.rb: 365
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos7-100.rb: 517
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos7-100.rb: 649
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos7-100.rb: 823
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos7-100.rb: 1006
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos7-100.rb: 1055
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/centos7-100.rb: 1104
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 25
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 39
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 223
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 259
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 313
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 458
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 645
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 821
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 1082
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 1316
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 1365
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 1417
Chef/Deprecations/EOLAuditModeUsage: The beta Audit Mode feature in Chef Infra Client was removed in Chef Infra Client 15.0. (https://docs.chef.io/workstation/cookstyle/chef_deprecations_eolauditmodeusage): audit-cis/recipes/ubuntu1404-100.rb: 1492
Chef/Modernize/ShellOutHelper: Use the built-in `shell_out` helper available in Chef Infra Client 12.11+ instead of calling `Mixlib::ShellOut.new('foo').run_command`. (https://docs.chef.io/workstation/cookstyle/chef_modernize_shellouthelper): audit-cis/recipes/centos6-110.rb: 524
Chef/Modernize/ShellOutHelper: Use the built-in `shell_out` helper available in Chef Infra Client 12.11+ instead of calling `Mixlib::ShellOut.new('foo').run_command`. (https://docs.chef.io/workstation/cookstyle/chef_modernize_shellouthelper): audit-cis/recipes/centos7-100.rb: 504
Chef/Modernize/ShellOutHelper: Use the built-in `shell_out` helper available in Chef Infra Client 12.11+ instead of calling `Mixlib::ShellOut.new('foo').run_command`. (https://docs.chef.io/workstation/cookstyle/chef_modernize_shellouthelper): audit-cis/recipes/ubuntu1404-100.rb: 616

Run with Cookstyle Version 7.32.1 with cops Chef/Deprecations,Chef/Correctness,Chef/Sharing,Chef/RedundantCode,Chef/Modernize,Chef/Security,InSpec/Deprecations

No Binaries Metric 
            
0.4.0 passed this metric

Testing File Metric 
            
0.4.0 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must contain a TESTING.md file

Version Tag Metric 
            
0.4.0 failed this metric
Failure: To pass this metric, your cookbook metadata must include a source url, the source url must be in the form of https://github.com/user/repo, and your repo must include a tag that matches this cookbook version number

Chef Software Chef Software

Details

View Source View Issues

Updated May 14, 2015 Created on

Supported Platforms

  • centos >= 0.0.0
  • ubuntu >= 0.0.0

License

Apache 2.0

Download Cookbook