tomrgio

all_web_nodes = search('node', 'role:web')

members = []

all_web_nodes.each do |web_node|
  member = {
    'address' => web_node['cloud']['public_hostname'],
    'weight' => 100,
    'port' => 80,
    'ssl_port' => 80

tomrgio

# encoding: utf-8 
include_controls 'ssh-baseline' do 
  skip_control 'sshd-27'
  skip_control 'sshd-29' 
  skip_control 'sshd-46' 
end

control 'mycorp-sshd-27' do 
  impact 1.0 
  title 'Server: Enable password based authentication'

tomrgio

---
 driver:
   name: vagrant

 provisioner:
   name: chef_zero
   # You may wish to disable always updating cookbooks in CI or other testing environments.
   # For example:
   #   always_update_cookbooks: <%= !ENV['CI'] %>
   always_update_cookbooks: true

tomrgio

# encoding: utf-8 
describe sshd_config do 
	its('Banner') { should eq '/etc/issue.net' }   
	its('ChallengeResponseAuthentication') { should eq 'yes' }
	its('PasswordAuthentication') { should eq 'yes' } 
end 

describe file('/etc/issue.net') do 
	its('content') { should match /SUPER SECURE BANNER/ } 
end

tomrgio

node.default['ssh-hardening']['ssh']['server']['banner'] = '/etc/issue.net'
node.default['ssh-hardening']['ssh']['server']['challenge_response_authentication'] = true
node.default['ssh-hardening']['ssh']['server']['password_authentication'] = true 

include_recipe 'ssh-hardening'

tomrgio

depends: 
 - name: ssh-baseline 
   url: https://github.com/dev-sec/ssh-baseline/archive/master.tar.gz

tomrgio

# encoding: utf-8 
describe sshd_config do 
  its('Banner') { should eq '/etc/issue.net' }   
  its('ChallengeResponseAuthentication') { should eq 'yes' }
  its('PasswordAuthentication') { should eq 'yes' } 
end 

describe file('/etc/issue.net') do 
  its('content') { should match /SUPER SECURE BANNER/ } 
end

tomrgio

file '/etc/issue.net' do 
  content 'SUPER SECURE BANNER' 
end

node.default['ssh-hardening']['ssh']['server']['banner'] = '/etc/issue.net'
node.default['ssh-hardening']['ssh']['server']['challenge_response_authentication'] = true
node.default['ssh-hardening']['ssh']['server']['password_authentication'] = true 

include_recipe 'ssh-hardening'

tomrgio

Slides

https://bit.ly/2J16pHc

Workstations

	IP Address			IP Address			IP Address			IP Address
02 ❤️	18.236.71.103	-	02 ♠️	34.209.73.145	-	02 ♦️	54.213.232.141	-	02 ♣️	54.202.47.95
03 ❤️	34.220.106.60	-	03 ♠️	18.236.156.6	-	03 ♦️	34.222.134.56	-	03 ♣️	34.213.176.56

tomrgio

pkg_deps=(core/tomcat8 core/jre8)
pkg_build_deps=(core/jdk8/8u131 core/maven)
pkg_svc_user="root"
do_prepare(){ export JAVA_HOME=$(hab pkg path core/jdk8) ; }