Skip to content

Commit 8d26c11

Browse files
author
CI (Automated)
committed
Merge remote-tracking branch 'local-from/develop' into HEAD
2 parents c2886af + 26a8fc1 commit 8d26c11

File tree

11 files changed

+209
-3
lines changed

11 files changed

+209
-3
lines changed

‎bosh-psmodules/modules/BOSH.Utils/BOSH.Utils.Tests.ps1‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,58 @@
11
Remove-Module -Name BOSH.Utils -ErrorAction Ignore
22
Import-Module ./BOSH.Utils.psm1
33

4+
#As of now, this function only supports DWords and Strings.
5+
function Restore-RegistryState {
6+
param(
7+
[bool]$KeyExists,
8+
[String]$KeyPath,
9+
[String]$ValueName,
10+
[PSObject]$ValueData
11+
)
12+
if ($KeyExists) {
13+
if ($ValueData -eq $null) {
14+
Remove-ItemProperty -path $KeyPath -Name $ValueName
15+
} else {
16+
Set-ItemProperty -path $KeyPath -Name $ValueName -Value $ValueData
17+
}
18+
} else {
19+
Remove-Item -Path $KeyPath -ErrorAction SilentlyContinue
20+
}
21+
}
22+
23+
Describe "Restore-RegistryState" {
24+
BeforeEach {
25+
Mock Remove-ItemProperty {}
26+
Mock Set-ItemProperty {}
27+
Mock Remove-Item {}
28+
}
29+
It "restores the registry by deleting a registry key created by the test" {
30+
Restore-RegistryState -KeyExists $false -KeyPath "HKLM:\Some registry key"
31+
32+
Assert-MockCalled Remove-Item -Times 1 -Scope It -ParameterFilter { $Path -eq "HKLM:\Some registry key" }
33+
Assert-MockCalled Remove-ItemProperty -Times 0 -Scope It
34+
Assert-MockCalled Set-ItemProperty -Times 0 -Scope It
35+
}
36+
37+
It "restores the registry by deleting a registry value created by the test" {
38+
Restore-RegistryState -KeyExist $true -KeyPath "HKLM:\Some registry key" -ValueName "SomeValue"
39+
40+
Assert-MockCalled Remove-Item -Times 0 -Scope It
41+
Assert-MockCalled Remove-ItemProperty -Times 1 -Scope It -ParameterFilter { $Path -eq "HKLM:\Some registry key" -and $Name -eq "SomeValue"}
42+
Assert-MockCalled Set-ItemProperty -Times 0 -Scope It
43+
}
44+
45+
It "restores the registry by restoring a registry data modified by the test" {
46+
Restore-RegistryState -KeyExist $true -KeyPath "HKLM:\Some registry key" -ValueName "SomeValue" -ValueData "Some Data"
47+
Restore-RegistryState -KeyExist $true -KeyPath "HKLM:\Some dword reg key" -ValueName "SomeDwordValye" -ValueData 85432
48+
49+
Assert-MockCalled Remove-Item -Times 0 -Scope It
50+
Assert-MockCalled Remove-ItemProperty -Times 0 -Scope It
51+
Assert-MockCalled Set-ItemProperty -Times 1 -Scope It -ParameterFilter { $Path -eq "HKLM:\Some registry key" -and $Name -eq "SomeValue" -and $Value -eq "Some Data" }
52+
Assert-MockCalled Set-ItemProperty -Times 1 -Scope It -ParameterFilter { $Path -eq "HKLM:\Some dword reg key" -and $Name -eq "SomeDwordValye" -and $Value -eq 85432 }
53+
}
54+
}
55+
456
function New-TempDir {
557
$parent = [System.IO.Path]::GetTempPath()
658
[string] $name = [System.Guid]::NewGuid()
@@ -92,4 +144,89 @@ Describe "Protect-Dir" {
92144
}
93145
}
94146

147+
Describe "Disable-RC4" {
148+
It "Disables the use of RC4 Cipher" {
149+
$rc4_128Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128"
150+
$rc4_128PathExists = Test-Path -Path $rc4_128Path
151+
$oldRC4_128Value = (Get-ItemProperty -path $rc4_128Path -ErrorAction SilentlyContinue).'Enabled'
152+
153+
$rc4_40Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128"
154+
$rc4_40PathExists = Test-Path -Path $rc4_40Path
155+
$oldRC4_40Value = (Get-ItemProperty -path $rc4_40Path -ErrorAction SilentlyContinue).'Enabled'
156+
157+
$rc4_56Path = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128"
158+
$rc4_56PathExists = Test-Path -Path $rc4_56Path
159+
$oldRC4_56Value = (Get-ItemProperty -path $rc4_56Path -ErrorAction SilentlyContinue).'Enabled'
160+
161+
{ Disable-RC4 } | Should Not Throw
162+
163+
(Get-ItemProperty -Path $rc4_128Path).'Enabled' | Should Be "0"
164+
(Get-ItemProperty -Path $rc4_40Path).'Enabled' | Should Be "0"
165+
(Get-ItemProperty -Path $rc4_56Path).'Enabled' | Should Be "0"
166+
167+
Restore-RegistryState -KeyExists $rc4_128PathExists -KeyPath $rc4_128Path -ValueName 'Enabled' -ValueData $oldRC4_128Value
168+
Restore-RegistryState -KeyExists $rc4_40PathExists -KeyPath $rc4_40Path -ValueName 'Enabled' -ValueData $oldRC4_40Value
169+
Restore-RegistryState -KeyExists $rc4_56PathExists -KeyPath $rc4_56Path -ValueName 'Enabled' -ValueData $oldRC4_56Value
170+
}
171+
}
172+
173+
Describe "Disable-TLS1" {
174+
It "Disables the use of TLS 1.0" {
175+
$serverPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server'
176+
$serverPathExists = Test-Path -Path $serverPath
177+
178+
$oldServerEnabledValue = (Get-ItemProperty -path $serverPath -ErrorAction SilentlyContinue).'Enabled'
179+
$oldServerDisabledValue = (Get-ItemProperty -path $serverPath -ErrorAction SilentlyContinue).'DisabledByDefault'
180+
$oldServerValue = (Get-ItemProperty -path $serverPath -ErrorAction SilentlyContinue).'Enabled'
181+
182+
$clientPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client'
183+
$clientPathExists = Test-Path -Path $clientPath
184+
185+
$oldClientEnabledValue = (Get-ItemProperty -path $clientPath -ErrorAction SilentlyContinue).'Enabled'
186+
$oldClientDisabledValue = (Get-ItemProperty -path $clientPath -ErrorAction SilentlyContinue).'DisabledByDefault'
187+
188+
{ Disable-TLS1 } | Should Not Throw
189+
190+
(Get-ItemProperty -Path $serverPath).'Enabled' | Should Be "0"
191+
(Get-ItemProperty -Path $serverPath).'DisabledByDefault' | Should Be "1"
192+
193+
(Get-ItemProperty -Path $clientPath).'Enabled' | Should Be "0"
194+
(Get-ItemProperty -Path $clientPath).'DisabledByDefault' | Should Be "1"
195+
196+
Restore-RegistryState -KeyExists $serverPathExists -KeyPath $serverPath -ValueName 'Enabled' -ValueData $oldServerValue
197+
Restore-RegistryState -KeyExists $serverPathExists -KeyPath $serverPath -ValueName 'DisabledByDefault' -ValueData $oldServerDisabledValue
198+
199+
Restore-RegistryState -KeyExists $clientPathExists -KeyPath $clientPath -ValueName 'Enabled' -ValueData $oldClientValue
200+
Restore-RegistryState -KeyExists $clientPathExists -KeyPath $clientPath -ValueName 'DisabledByDefault' -ValueData $oldClientDisabledValue
201+
}
202+
}
203+
204+
Describe "Disable-3DES" {
205+
It "Disables birthday attacks against 64 bit block TLS ciphers" {
206+
$registryPath = 'hklm:\system\currentcontrolset\control\securityproviders\schannel\ciphers\triple des 168'
207+
$tripleDESPathExists = Test-Path $registryPath
208+
$oldDESValue = (Get-ItemProperty -path $registryPath -ErrorAction SilentlyContinue).'Enabled'
209+
210+
{ Disable-3DES } | Should Not Throw
211+
212+
(Get-ItemProperty -path $registryPath).'Enabled' | Should Be "0"
213+
214+
Restore-RegistryState -KeyExists $tripleDESPathExists -KeyPath $registryPath -ValueName 'Enabled' -ValueData $oldDESValue
215+
}
216+
}
217+
218+
Describe "Disable-DCOM" -Tag 'Focused' {
219+
It "Disables the use of DCOM" {
220+
$DCOMPath = 'HKLM:\Software\Microsoft\OLE'
221+
$oldDCOMValue = (Get-ItemProperty -Path $DCOMPath).'EnableDCOM'
222+
223+
{ Disable-DCOM } | Should Not Throw
224+
225+
(Get-ItemProperty -Path $DCOMPath).'EnableDCOM' | Should Be "N"
226+
Set-ItemProperty -Path $DCOMPath -Name 'EnableDCOM' -Value $oldDCOMValue
227+
228+
Restore-RegistryState -KeyExists $true -KeyPath $DCOMPath -ValueName 'EnableDCOM' -ValueData $oldDCOMValue
229+
}
230+
}
231+
95232
Remove-Module -Name BOSH.Utils -ErrorAction Ignore

‎bosh-psmodules/modules/BOSH.Utils/BOSH.Utils.psd1‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,20 @@ Author = 'BOSH'
66
Copyright = '(c) 2017 BOSH'
77
Description = 'Common Utils on a BOSH deployed vm'
88
PowerShellVersion = '4.0'
9-
FunctionsToExport = @('Write-Log','Get-Log','Open-Zip','New-Provisioner','Clear-Provisioner','Protect-Dir','Protect-MountedDir', 'Set-ProxySettings', 'Clear-ProxySettings')
9+
FunctionsToExport = @(
10+
'Write-Log',
11+
'Get-Log',
12+
'Open-Zip',
13+
'New-Provisioner',
14+
'Clear-Provisioner',
15+
'Protect-Dir',
16+
'Protect-MountedDir',
17+
'Set-ProxySettings',
18+
'Clear-ProxySettings',
19+
'Disable-RC4',
20+
'Disable-TLS1',
21+
'Disable-3DES',
22+
'Disable-DCOM')
1023
CmdletsToExport = @()
1124
VariablesToExport = '*'
1225
AliasesToExport = @()

‎bosh-psmodules/modules/BOSH.Utils/BOSH.Utils.psm1‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,3 +175,35 @@ function Clear-ProxySettings {
175175
exit(1)
176176
}
177177
}
178+
179+
function Disable-RC4() {
180+
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers' -Name 'RC4 128/128' -Force
181+
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers' -Name 'RC4 40/128' -Force
182+
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers' -Name 'RC4 56/128' -Force
183+
184+
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128' -Value 0 -Name 'Enabled' -Type DWORD
185+
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128' -Value 0 -Name 'Enabled' -Type DWORD
186+
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128' -Value 0 -Name 'Enabled' -Type DWORD
187+
}
188+
189+
function Disable-TLS1() {
190+
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\' -Name 'TLS 1.0' -Force
191+
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0' -Name 'Server' -Force
192+
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0' -Name 'Client' -Force
193+
194+
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Value 0 -Name 'Enabled' -Type DWORD
195+
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" -Value 1 -Name 'DisabledByDefault' -Type DWORD
196+
197+
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" -Value 0 -Name 'Enabled' -Type DWORD
198+
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client" -Value 1 -Name 'DisabledByDefault' -Type DWORD
199+
}
200+
201+
function Disable-3DES() {
202+
New-Item -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\' -Name 'Triple DES 168' -Force
203+
204+
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168" -Value 0 -Name 'Enabled' -Type DWORD
205+
}
206+
207+
function Disable-DCOM() {
208+
Set-ItemProperty -Path "HKLM:\Software\Microsoft\OLE" -Value 'N' -Name 'EnableDCOM'
209+
}

‎bosh-psmodules/modules/BOSH.WindowsUpdates/BOSH.WindowsUpdates.Tests.ps1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,5 +185,6 @@ Describe "Enable-SecurityPatches" {
185185
}
186186
}
187187

188+
188189
Remove-Module -Name BOSH.WindowsUpdates -ErrorAction Ignore
189190
Remove-Module -Name BOSH.Utils -ErrorAction Ignore

‎bosh-psmodules/modules/BOSH.WindowsUpdates/BOSH.WindowsUpdates.psm1‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -393,4 +393,3 @@ function Enable-CredSSP() {
393393
#Policy set to "mitigated"
394394
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /t REG_DWORD /d 1 /f
395395
}
396-

‎lib/packer/config/base.rb‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,11 @@ def self.enable_security_patches(os)
5959
provisioners = [
6060
Provisioners::ENABLE_CVE_2015_6161,
6161
Provisioners::ENABLE_CVE_2017_8529,
62-
Provisioners::ENABLE_CREDSSP
62+
Provisioners::ENABLE_CREDSSP,
63+
Provisioners::Disable_RC4,
64+
Provisioners::Disable_TLS1,
65+
Provisioners::Disable_3DES,
66+
Provisioners::Disable_DCOM
6367
]
6468
end
6569

‎lib/packer/config/provisioners.rb‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,10 @@ def self.powershell_provisioner(command)
5555
CLEAR_PROXY_SETTINGS = powershell_provisioner('Clear-ProxySettings')
5656
ENABLE_CVE_2015_6161 = powershell_provisioner('Enable-CVE-2015-6161')
5757
ENABLE_CVE_2017_8529 = powershell_provisioner('Enable-CVE-2017-8529')
58+
Disable_RC4 = powershell_provisioner('Disable-RC4')
59+
Disable_TLS1 = powershell_provisioner('Disable-TLS1')
60+
Disable_3DES = powershell_provisioner('Disable-3DES')
61+
Disable_DCOM = powershell_provisioner('Disable-DCOM')
5862
ENABLE_CREDSSP = powershell_provisioner('Enable-CredSSP')
5963

6064
def self.setup_proxy_settings(http_proxy, https_proxy, bypass_list)

‎spec/packer/config/aws_spec.rb‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,10 @@
157157
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-CVE-2015-6161"]},
158158
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-CVE-2017-8529"]},
159159
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-CredSSP"]},
160+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-RC4"]},
161+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-TLS1"]},
162+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-3DES"]},
163+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-DCOM"]},
160164
{'type'=>'powershell', 'inline'=> ['$ErrorActionPreference = "Stop";',
161165
'trap { $host.SetShouldExit(1) }',
162166
'Clear-ProxySettings']},

‎spec/packer/config/azure_spec.rb‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,10 @@
130130
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-CVE-2015-6161"]},
131131
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-CVE-2017-8529"]},
132132
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-CredSSP"]},
133+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-RC4"]},
134+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-TLS1"]},
135+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-3DES"]},
136+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-DCOM"]},
133137
{'type'=>'powershell', 'inline'=> ['$ErrorActionPreference = "Stop";',
134138
'trap { $host.SetShouldExit(1) }',
135139
'Clear-ProxySettings']},

‎spec/packer/config/gcp_spec.rb‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,10 @@
109109
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-CVE-2015-6161"]},
110110
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-CVE-2017-8529"]},
111111
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Enable-CredSSP"]},
112+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-RC4"]},
113+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-TLS1"]},
114+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-3DES"]},
115+
{"type"=>"powershell", "inline"=>["$ErrorActionPreference = \"Stop\";", "trap { $host.SetShouldExit(1) }", "Disable-DCOM"]},
112116
{'type'=>'powershell', 'inline'=> ['$ErrorActionPreference = "Stop";',
113117
'trap { $host.SetShouldExit(1) }',
114118
'Clear-ProxySettings']},

0 commit comments

Comments
 (0)