Merge Development into Master (#27)

* Adding initial auto-generated controls

* Update inspec.yml - Fixed formatting on file

* Updated all controls to have "check" as secondary description instead of as a tag

* Added tests for some controls

* Added tests for a few more controls. Added a vagrant box to test this profile against. Updated readme with instructions to test/run this inspec profile against.

* update git ignore to add vagrant specific items

* update V-80969 to check for audit.rules string match

* update V-80965 to check for remote_server offloading of audit logs (IPv4 only)

* updated V-80965 to disregard check for IP address only

* Updated all fix tags to description. Added a few controls related to aide package and it's configuration.

* update V-75901 thru V-75909

* template repo docs-mitre-inspec

* Added additional control tests

* update gitignore to NOT account for .vscode folder

* started work on kitchen and travis support (#1)

* started work on kitchen and travis support

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* added bundle install

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* fixing bundler

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* added a specific rvm version

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* Removed Gemfile.lock

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* bundle issues

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* bundler issues

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* further fixing of bundler

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* bundler fix 3

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* kitchen didn't seem to run

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* added inspec_tools

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* hacking the build

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* adding inspec_tools step to build process

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* fixing inspec_tools

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* updated min compliance to 1%

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* updated to ignore kitchen error code

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* develop 9 additional controls in 755** series

* fixed small error in control (#4)

* fixed small error in control

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* Removed Gemfile.lock from the repo
Added branch selection so that we didn't run the build multiple times

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* Update README.md

* Update README.md

* update controls, kitchen files and gitignore

* add .kitchen.vagrant.yml changes

* change symlink for kitchen.yml; 11 new controls

* remove Gemfile.lock

* update controls and kitchen files, add attributes

* 13 new and modified controls (#7)

* update controls, kitchen files and gitignore

* add .kitchen.vagrant.yml changes

* change symlink for kitchen.yml; 11 new controls

* remove Gemfile.lock

* update controls and kitchen files, add attributes

* attribute to input in all controls; move attributes to inspec.yml

change attribute to input in all controls
move attributes to inputs.yml (needs further refinement to address issue #10)
remove attributes.yml
update kitchen.yml files to use inspec.yml for attrs

* develop new controls and update some old controls

* remove results.json, develop new controls

* developed 13 new controls

* fix auditd controls

* develop two new audit controls

* new controls; updates to inspec and kitchen ymls

* adding new control implementations

* specify input_files tag to test travis build

* edit input_files; test travis build

* use chef-workstation, inputs tag, add inputs.yml

* test travis by updating inspec-bin

* verbose logging debug

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* debug

Signed-off-by: Aaron Lippold <lippold@gmail.com>

* add debug to test travis

* remove control to test travis

* move inputs inside controls

* move inputs inside control

* move inputs inside control

* remove kitchen debug from travis.yml

* update travis links in README

* chef gem update inspec and inspec-bin in travis

* test travis by moving input out of control block

* 'chef gem update inspec' to 'gem update inspec'

* accept chef license before running chef commands

* accept chef license inline

* update inspec using embedded gem binary

* debug kitchen verify

* developed 4 more controls

* develop 22 new controls

* Update README.md

* some minor fixes

some minor fixes

* update controls based on review for PR #11

* Some cleanup of workinprogress notice

* completing 80961

* 3 additional controls developed

* debug travis

* disable V-78005 to test travis

* fix dokken nil to string and other minor issues

* fix 80963 log_file check

* remove extra lines

* hard code audit conf & dir paths until inspec fix

* remove only_if from audit controls

* adding apt-get chef workstation to before_script

* use wget and dpkg instead of apt

* remove debug

* Update README.md

* 80957 and 75437 updated with temporary measures

* update controls to account for skips and N/As

* update controls to use native InSpec reosurces

* use InSpec resources instead of command

* minor fixes

* update gnome checks

* update 2 controls

* parameterize some controls

* Adding Review.md to repo

* initial review checks performed

* updating review

* Added more issues from review

* Updating review

* removed completion date from checks with open issues

* Adding last check for review

* Add additional inputs (#15)

* minor edits to account for organization name

* add emergency_accounts input

* add TRAVIS_BUILD_ID to kitchen.*.yml

* add required inputs

* bug fix for if, else

* fix for issue #19

* fixes issue #21

* fixes some issues from rubocop listed in issue #18

* move impact above describe

* more fixes for issue #19

* fixes for issue #23

* minor fixes

* fixes/edits for issue #23

* update completion of InSpec syntax checker

* Amol's issuefixes  (#24)

* Fixing the status of issues to match current reality in Review.md

Signed-off-by: Amol Shah <amolshah@gmail.com>

* Initial fixes for issue #20

Signed-off-by: Amol Shah <amolshah@gmail.com>

* Initial fixes for issue #20

Signed-off-by: Amol Shah <amolshah@gmail.com>

* Initial fixes for issue #20

Signed-off-by: Amol Shah <amolshah@gmail.com>

* Fixes for issue #18

Signed-off-by: Amol Shah <amolshah@gmail.com>

* Fixes for issue #18

Signed-off-by: Amol Shah <amolshah@gmail.com>

* Fixes for issue #13 and #13

Signed-off-by: Amol Shah <amolshah@gmail.com>

* Fixes for issue #16

Signed-off-by: Amol Shah <amolshah@gmail.com>

* Fixing a profile error and recreated sample data

Signed-off-by: Amol Shah <amolshah@gmail.com>

* remove sudo from control checks

* Peer review complete

Recommend merging development branch into master and removing WIP label

* Update README.md

* added getting started preamble

## Getting Started  
It is intended and recommended that InSpec run this profile from a __"runner"__ host (such as a DevOps orchestration server, an administrative management system, or a developer's workstation/laptop) against the target remotely over __winrm__.

__For the best security of the runner, always install on the runner the _latest version_ of InSpec and supporting Ruby language components.__ 

Latest versions and installation options are available at the [InSpec](http://inspec.io/) site.

* updated STIG reference

An InSpec profile of the DISA Canonical Ubuntu 16.04 LTS STIG baseline
to:
InSpec profile to validate the secure configuration of Canonical Ubuntu 16.04 LTS against DISA's Canonical Ubuntu 16.04 LTS Security Technical Implementation Guide (STIG) Version 1 Release 1.

.gitignore

@@ -1,50 +1,154 @@
+*.lock
 *.gem
 *.rbc
+
+Gemfile.lock
+.attribute.yml
+Berksfile.lock
+results.json
+
 /.config
 /coverage/
 /InstalledFiles
 /pkg/
 /spec/reports/
 /spec/examples.txt
-/test/tmp/
-/test/version_tmp/
-/tmp/
+inspec-azure.plan
+inspec-aws-*.plan
 
-# Used by dotenv library to load environment variables.
-# .env
 
-## Specific to RubyMotion:
-.dat*
-.repl_history
-build/
-*.bridgesupport
-build-iPhoneOS/
-build-iPhoneSimulator/
+*.tfstate
+*.tfstate.*
+.terraform/
+terraform.tfvars
+
+.kitchen/
+.kitchen.local.yml
+kitchen.local.yml
+
+.vagrant
+
+inspec-deprecations-in-cfg.txt
+inspec-deprecations-in-lib.txt
+
+# Docker
+*.retry
+.backup
+
+
+# OSX
+# General
+.DS_Store
+.AppleDouble
+.LSOverride
+
+# Icon must end with two \r
+Icon
+
+# Thumbnails
+._*
+
+# Files that might appear in the root of a volume
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+
+# Directories potentially created on remote AFP share
+.AppleDB
+.AppleDesktop
+Network Trash Folder
+Temporary Items
+.apdisk
+
+# Logs
+*.log
 
-## Specific to RubyMotion (use of CocoaPods):
-#
-# We recommend against adding the Pods directory to your .gitignore. However
-# you should judge for yourself, the pros and cons are mentioned at:
-# https://guides.cocoapods.org/using/using-cocoapods.html#should-i-check-the-pods-directory-into-source-control
-#
-# vendor/Pods/
 
 ## Documentation cache and generated files:
 /.yardoc/
 /_yardoc/
 /doc/
 /rdoc/
 
-## Environment normalization:
+# Ignore bundler config
 /.bundle/
+/vendor/
 /vendor/bundle
-/lib/bundler/man/
+vendor/cookbooks
+
+# unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
+.rvmrc
+.packer
 
 # for a library or gem, you might want to ignore these files since the code is
 # intended to run in multiple environments; otherwise, check them in:
-# Gemfile.lock
-# .ruby-version
-# .ruby-gemset
+.ruby-version
+.ruby-gemset
+
+
+## JetBrain
+# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and WebStorm
+# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
+.idea/
+
+# Visual Studio Code
+.vscode
+
+## Specific to RubyMotion:
+.dat*
+.repl_history
+*.bridgesupport
+
+# File-based project format
+*.iws
+
+# IntelliJ
+out/
+
+# mpeltonen/sbt-idea plugin
+.idea_modules/
+
+# Crashlytics plugin (for Android Studio and IntelliJ)
+com_crashlytics_export_strings.xml
+crashlytics.properties
+crashlytics-build.properties
+fabric.properties
+
+# JIRA plugin
+atlassian-ide-plugin.xml
+
+
+# Build Folder
+/build/
+/build-iPhoneOS/
+/build-iPhoneSimulator/
+
+
+# Ignore rendered files from docs/
+source/docs/reference/
+examples/meta-profile/vendor/
+habitat/VERSION
+habitat/results
+/lib/bundler/man/
+
+
+# USER
+/.gitignoredir/
+/tmp/
+/test/tmp/
+/test/version_tmp/
+/.emacs.desktop
+.gitter
+*.elc
+nbproject
+auto-save-list
+tramp
+/.direnv
+/.envrc
+results/
+contrib/*
 
-# unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
-.rvmrc

.kitchen.dokken.yml

@@ -0,0 +1,35 @@
+driver:
+  name: dokken
+  privileged: true # because Docker and SystemD/Upstart
+  #chef_version: <%= ENV['CHEF_VERSION'] || 'stable' %>
+
+transport:
+  name: dokken
+
+provisioner:
+  name: dokken
+  deprecations_as_errors: true
+  chef_license: accept
+
+verifier:
+  name: inspec
+  sudo: true
+  reporter:
+    - cli
+    - json:./results/<%= Time.now.utc.strftime('%Y%m%d%H%M%S') %>-%{platform}_%{suite}_<%= ENV['TRAVIS_BUILD_ID'] %>.json
+  inspec_tests:
+    - path: ./
+  inputs:
+    disable_slow_controls: true
+
+platforms:
+- name: ubuntu-16.04
+  driver:
+    image: dokken/ubuntu-16.04
+    pid_one_command: /bin/systemd
+    intermediate_instructions:
+      - RUN /usr/bin/apt-get update
+suites:
+- name: default
+  run_list:
+  - recipe[os-hardening::default]

.kitchen.vagrant.yml

@@ -0,0 +1,25 @@
+driver:
+  name: vagrant
+
+provisioner:
+  name: chef_zero
+  chef_license: accept
+
+verifier:
+  name: inspec
+  sudo: true
+  reporter:
+    - cli
+    - json:./results/<%= Time.now.utc.strftime('%Y%m%d%H%M%S') %>-%{platform}_%{suite}_<%= ENV['TRAVIS_BUILD_ID'] %>.json
+  inspec_tests:
+    - path: ./
+  inputs:
+    disable_slow_controls: true
+
+platforms:
+- name: ubuntu-16.04
+
+suites:
+- name: default
+  run_list:
+  - recipe[os-hardening::default]

.kitchen.yml

@@ -0,0 +1 @@
+.kitchen.dokken.yml

.rubocop.yml

@@ -0,0 +1,30 @@
+
+Metrics/BlockLength:
+  Max: 200
+
+Metrics/LineLength:
+  Enabled: false
+
+Naming/FileName:
+  Enabled: false
+
+Style/NumericPredicate:
+  Enabled: false
+
+Style/ConditionalAssignment:
+  Enabled: false
+
+Lint/AmbiguousRegexpLiteral:
+  Enabled: false
+
+Lint/ParenthesesAsGroupedExpression:
+  Enabled: false
+
+Style/IfUnlessModifier:
+  Enabled: false
+
+Lint/AmbiguousBlockAssociation:
+  Enabled: false
+
+Lint/ImplicitStringConcatenation:
+  Enabled: false

.travis.yml

@@ -0,0 +1,60 @@
+sudo: required
+
+# blocklist
+#branches:
+#  except:
+#  - development
+
+# safelist
+#branches:
+#  only:
+#  - master
+#  - stable
+
+language: ruby
+rvm:
+  - 2.6.1
+
+cache: bundler
+
+addons:
+  apt:
+    sources:
+      - chef-current-xenial
+    # packages:
+    #   - chef-workstation
+  #artifacts: true
+
+# Don't `bundle install` which takes about 1.5 mins
+install:
+
+services: docker
+
+env:
+  matrix:
+  - INSTANCE=default-ubuntu-1604
+
+before_script:
+  - wget https://packages.chef.io/files/stable/chef-workstation/0.5.1/ubuntu/16.04/chef-workstation_0.5.1-1_amd64.deb
+  - sudo dpkg -i chef-workstation_*.deb
+  - rm chef-workstation_*.deb
+  - sudo iptables -L DOCKER || ( echo "DOCKER iptables chain missing" ; sudo iptables -N DOCKER )
+  - eval "$(chef shell-init bash)"
+  - gem install bundler:2.0.1
+  - gem install inspec_tools
+  - inspec --version
+  - CHEF_LICENSE=accept chef gem update inspec
+  - CHEF_LICENSE=accept chef gem update inspec-bin
+  - /opt/chef-workstation/embedded/bin/gem update inspec
+  - /opt/chef-workstation/embedded/bin/gem update inspec-bin
+  - inspec --version
+  - bundle update --bundler
+  - bundle install
+  - chef --version
+  - cookstyle --version
+  - foodcritic --version
+
+script: 
+  - CHEF_LICENSE=accept-no-persist KITCHEN_LOCAL_YAML=kitchen.dokken.yml CHEF_VERSION=${CHEF_VERSION} kitchen verify ${INSTANCE} || true
+  - export RESULTS=$(ls results/*.json)
+  - inspec_tools compliance -j $RESULTS -f threshold.yml

Berksfile

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+source 'https://supermarket.getchef.com'
+
+metadata
+cookbook 'os-hardening', github: 'dev-sec/chef-os-hardening'

Gemfile

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+gem 'berkshelf'
+gem 'github_changelog_generator'
+gem 'kitchen-dokken'
+gem 'kitchen-inspec'
+gem 'kitchen-vagrant'
+gem 'test-kitchen'