Merge pull request #1 from rheijkoop/master

Initial release of kpn-advanced_security_policy

.fixtures.yml

@@ -0,0 +1,3 @@
+fixtures:
+  symlinks:
+    advanced_security_policy: '#{source_dir}'

.gitignore

@@ -0,0 +1,22 @@
+.*.sw[op]
+.metadata
+.yardoc
+.yardwarns
+*.iml
+/.bundle/
+/.idea/
+/.vagrant/
+/coverage/
+/bin/
+/doc/
+/Gemfile.local
+/Gemfile.lock
+/junit/
+/log/
+/pkg/
+/spec/fixtures/manifests/
+/spec/fixtures/modules/
+/tmp/
+/vendor/
+/convert_report.txt
+.DS_Store

.gitlab-ci.yml

@@ -0,0 +1,69 @@
+---
+stages:
+  - test_2.4.1
+  - test_2.1.9
+
+before_script:
+  - bundle -v
+  - rm Gemfile.lock || true
+  - gem update --system
+  - gem update bundler
+  - gem --version
+  - bundle -v
+  - bundle install --without system_tests
+
+rubocop-2.4.1:
+  stage: test_2.4.1
+  image: ruby:2.4.1
+  script:
+    - bundle exec rake rubocop
+
+syntax-2.4.1:
+  stage: test_2.4.1
+  image: ruby:2.4.1
+  script:
+    - bundle exec rake syntax lint
+
+metadata-2.4.1:
+  stage: test_2.4.1
+  image: ruby:2.4.1
+  script:
+    - bundle exec rake metadata_lint
+
+rspec-puppet-2.4.1:
+  stage: test_2.4.1
+  image: ruby:2.4.1
+  variables:
+    PUPPET_GEM_VERSION: ~> 4.0
+    CHECK: spec
+  script:
+    - bundle update
+    - bundle exec rake $CHECK
+
+rubocop-2.1.9:
+  stage: test_2.1.9
+  image: ruby:2.1.9
+  script:
+    - bundle exec rake rubocop
+
+syntax-2.1.9:
+  stage: test_2.1.9
+  image: ruby:2.1.9
+  script:
+    - bundle exec rake syntax lint
+
+metadata-2.1.9:
+  stage: test_2.1.9
+  image: ruby:2.1.9
+  script:
+    - bundle exec rake metadata_lint
+
+rspec-puppet-2.1.9:
+  stage: test_2.1.9
+  image: ruby:2.1.9
+  variables:
+    PUPPET_GEM_VERSION: ~> 4.0
+    CHECK: spec
+  script:
+    - bundle update
+    - bundle exec rake $CHECK

.pdkignore

@@ -0,0 +1,22 @@
+.*.sw[op]
+.metadata
+.yardoc
+.yardwarns
+*.iml
+/.bundle/
+/.idea/
+/.vagrant/
+/coverage/
+/bin/
+/doc/
+/Gemfile.local
+/Gemfile.lock
+/junit/
+/log/
+/pkg/
+/spec/fixtures/manifests/
+/spec/fixtures/modules/
+/tmp/
+/vendor/
+/convert_report.txt
+.DS_Store

.pmtignore

@@ -0,0 +1,21 @@
+docs/
+pkg/
+Gemfile.lock
+Gemfile.local
+vendor/
+.vendor/
+spec/fixtures/manifests/
+spec/fixtures/modules/
+.vagrant/
+.bundle/
+.ruby-version
+coverage/
+log/
+.idea/
+.dependencies/
+.librarian/
+Puppetfile.lock
+*.iml
+.*.sw?
+.yardoc/
+junit/

.rspec

@@ -0,0 +1,2 @@
+--color
+--format documentation

.rubocop.yml

@@ -0,0 +1,4 @@
+---
+inherit_gem:
+  kpn-style:
+    - ruby-2.4.yml

.travis.yml

@@ -0,0 +1,50 @@
+---
+sudo: false
+dist: trusty
+language: ruby
+cache: bundler
+before_install:
+  - bundle -v
+  - rm Gemfile.lock || true
+  - gem update --system
+  - gem update bundler
+  - gem --version
+  - bundle -v
+script:
+  - 'bundle exec rake $CHECK'
+bundler_args: --without system_tests
+rvm:
+  - 2.4.1
+  - 2.1.9
+env:
+  - PUPPET_GEM_VERSION="~> 4.0" CHECK=spec
+  - PUPPET_GEM_VERSION="~> 5.0" CHECK=spec
+matrix:
+  fast_finish: true
+  include:
+    -
+      env: CHECK=rubocop
+    -
+      env: CHECK="syntax lint"
+    -
+      env: CHECK=metadata_lint
+    -
+      env: CHECK=spec
+    -
+      env: PUPPET_GEM_VERSION="~> 4.0" CHECK=spec DEPLOY_TO_FORGE=yes
+      rvm: 2.1.9
+branches:
+  only:
+    - master
+    - /^v\d/
+notifications:
+  email: false
+deploy:
+  provider: puppetforge
+  user: kpn
+  password:
+    secure: "g76nk0Uv500X4HeM3P7r8Medeu6hW7F8hCLdpydb9iAX1/nKNTvVvwnwVXYUcEdBxKAVLPZPCn5C47cJQszhKJpIa9q5KXkNIuDAxnooPdn2d8Hstr34c/qDWLGa/GJ6qMxEfAaCPgO86ZcKksxvywy/a7/ixM3aCd3gbEIA/y9ajJ+Emh4zd/IU37JtfiZBq8gaaAUEbm2D4ZoiZSyFkq7wHSJQLZRHfLjEYrlRUOgIagxt8qEoi4LWK+x+RZxcIzepxMwA171OtviJX6DhCBli1bcq7vyGJ+Pc475O9jt3bsefe20515bdv0WkE4d+jLzrmq24hlEiLbrnJu3l+n9aNJNab5V/TJQ7TTEd3nR0uMpQRMacNFvp3pfo1eCnN+9U/M8NIPMIBocJkf1i7XJwhQE6pxgA8z2E42bfY6EUAun41ZYsvDu4rTfiPZii3pZIRR/mEcFHB9EIbfLYbsg4JLgUPXfk3acOwN7qXygWMV7ME++bzUeNYEqcqakPIw1PKv9sSQ7d/r7sId+7dQ5fs7Iy+YEFFeZDGV02TC9VbFMoie5mBRb7DT1Rh9BmQ82cqW1QOspjCrzzBUi4O5EDYiqxRaLMdUejnSYgwoZHR5prj+ijA2/ja1p/2pRhQxsweSULmk82SL0ctv4xuRgEzi+ezCNAFTLLpGIz8fY="
+  on:
+    tags: true
+    all_branches: true
+    condition: "$DEPLOY_TO_FORGE = yes"

.yardopts

@@ -0,0 +1,2 @@
+--markup markdown
+--output-dir docs/

CHANGELOG

@@ -0,0 +1,29 @@
+2018-04-04 Release 2.1.1
+- release to puppet forge
+
+2018-01-23 Release 2.1.0
+- allows configurable result for enabled and disabled
+- policy_setting has changed to policy_value (same as local_security_policy)
+
+2017-12-19 Release 2.0.1
+- unknown (domain) policies already set on the system are ignored
+- trying to set an unknown/invalid policy using puppet will still result in an error
+
+2017-12-04 Release 2.0.0
+- makes advanced security policy settings ensurable
+- policy names are looked up in a list
+
+2017-11-28 Release 1.0.4
+- makes the provider case-insensitive
+
+2017-10-11 Release 1.0.3
+- change permission on lgpo.exe
+
+2017-07-06 Release 1.0.2
+- changed file persmissions because of missing administrator user
+
+2017-07-06 Release 1.0.1
+- add file lgpo.exe creation
+
+2017-07-06 Release 1.0.0
+- initial commit

Gemfile

@@ -0,0 +1,19 @@
+source ENV['GEM_SOURCE'] || 'https://rubygems.org'
+
+puppetversion = ENV.key?('PUPPET_VERSION') ? ENV['PUPPET_VERSION'] : ['>= 3.3']
+gem 'facter', '>= 1.7.0'
+gem 'kpn-style'
+gem 'metadata-json-lint'
+gem 'puppet', puppetversion
+gem 'puppet-lint', '>= 1.0.0'
+gem 'puppetlabs_spec_helper', '>= 1.0.0'
+gem 'rspec-puppet'
+
+# rspec must be v2 for ruby 1.8.7
+if RUBY_VERSION >= '1.8.7' && RUBY_VERSION < '1.9'
+  gem 'rake', '~> 10.0'
+  gem 'rspec', '~> 2.0'
+else
+  # rubocop requires ruby >= 1.9
+  gem 'rubocop'
+end

Jenkinsfile

@@ -0,0 +1,3 @@
+@Library('puppetpipeline@master') _
+
+module( peVersions: ['pe4','pe5'], rspec: ['Windows'], platforms: ['windows-2008r2-x64-pe4','windows-2012r2-x64-pe4','windows-2016-x64-pe4'])

README.md

@@ -0,0 +1,119 @@
+# advanced_security_policy
+
+#### Table of Contents
+
+1. [Module Description](#module-description)
+1. [Setup - The basics of getting started with advanced_security](#setup)
+    * [Setup Requirements](#setup-requirements)
+    * [What advanced_security_policy affects](#what-advanced_security_policy-affects)
+    * [Beginning with advanced_security_policy](#beginning-with-advanced_security_policy)
+1. [Usage - Configuration options and additional functionality](#usage)
+1. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
+1. [Limitations - OS compatibility, etc.](#limitations)
+1. [Development - Guide for contributing to the module](#development)
+
+## Overview
+This module sets and enforces the advanced security policies for windows.
+We used Paul Cannons Local Security Policy as a 'blueprint' to read the policies from a template.
+
+## Module Description
+This module uses LGPO.exe (v2.2) to configure the advanced security policies on Windows. 
+LGPO.exe is a command-line utility that is designed to help automate management of
+Local Group Policy. It can import and apply settings from Registry Policy (Registry.pol)
+files, security templates, Advanced Auditing backup files, as well as from formatted
+“LGPO text” files.
+
+## Setup
+
+### Setup Requirements
+
+This module requires:
+- ADMX and ADML files with the policy settings to be set (in `C:\Windows\PolicyDefinitions`)
+- LGPO.exe needs to be installed in `C:\Windows\System32` (Add the following code)
+  ```puppet
+    include advanced_security_policy
+  ```
+
+### What advanced_security_policy affects
+- Advanced security policies.
+- `C:\Windows\System32\GroupPolicy\Machine\Registry.pol`
+
+### Beginning with advanced_security_policy
+To start using advanced_security_policy, 
+simply include the module and add the defined type statements in your profile.
+Then configure the policies you want to set. (for example in hiera)
+
+## Usage
+
+### Parameters
+
+#### policy(resource) name (required)
+Type: 'String'  
+Default: '$title'  
+Values: Any valid advanced security subcategory  
+Description: The policy name matches the name in the policy editor
+
+#### ensure
+Type: 'String'  
+Default: 'present'  
+Values: 'present' or 'absent'  
+Description: When a policy is set, ensure will be 'present'. If a policy is to be set as 'not configured' then ensure must be set to 'absent'.  
+#### policy_value
+Type: 'String'  
+Values: 'enabled', 'disabled' or a value
+Description: This is the value to be set for the policy. This can be 'enabled', 'disabled' or a value to be set.
+
+### Examples
+
+#### Example: Setting multiple security policies
+```puppet
+  advanced_security_policy {'Turn off Autoplay':
+    policy_value => '255',
+  }
+
+  advanced_security_policy {Configuration of wireless settings using Windows Connect Now':
+    policy_value => 'disabled'
+  }
+
+  advanced_security_policy {'MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)':
+    policy_value => 'enabled',
+  }
+
+  advanced_security_policy {'Security: Specify the maximum log file size (KB)':
+    ensure         => 'absent',
+  }
+```
+
+## Reference
+
+### Defined Types
+
+- advanced_security_policy
+
+### Provider
+- securitypolicy
+
+
+## Limitations
+This is where you list OS compatibility, version compatibility, etc.
+
+This module works on:
+
+- Windows 2008 R2
+- Windows 2012 R2
+- Windows 2016
+
+## Development
+
+You can contribute by submitting issues, providing feedback and joining the discussions.
+
+Go to: `https://github.com/kpn-puppet/puppet-kpn-advanced_security_policy`
+
+If you want to fix bugs, add new features etc:
+- Fork it
+- Create a feature branch ( git checkout -b my-new-feature )
+- Apply your changes and update rspec tests
+- Run rspec tests ( bundle exec rake spec )
+- Commit your changes ( git commit -am 'Added some feature' )
+- Push to the branch ( git push origin my-new-feature )
+- Create new Pull Request