Skip to content

Commit c85aaf6

Browse files
atomic111atomic111
committed
implement until cis 2.3.2.2
Signed-off-by: Patrick Münch <[email protected]>
1 parent 1d38142 commit c85aaf6

File tree

10 files changed

+434
-17
lines changed

10 files changed

+434
-17
lines changed

‎.kitchen.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@ suites:
2626
run_list:
2727
- recipe[windows-hardening::default]
2828
attributes:
29+
account_status:
30+
names:
31+
- 'Guest'
32+
rename_account:
33+
admin_account: false
2934
security_policy:
3035
rights:
3136
SeNetworkLogonRight: '*S-1-1-0, *S-1-5-32-544, *S-1-5-32-545, *S-1-5-32-551'

‎attributes/account.rb‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# encoding: utf-8
2+
3+
# Cookbook Name:: windows-hardening
4+
# Attributes:: account
5+
6+
# define which accounts should be disabled
7+
default['account_status']['names'] = ['Administrator', 'Guest']
8+
default['account_status']['active_yes_no'] = 'no'
9+
10+
# define the new account names for Administrator and Guest
11+
default['rename_account']['admin_account'] = true
12+
default['rename_account']['guest_account'] = true
13+
default['rename_account']['new_admin_name'] = 'CustomAdminName'
14+
default['rename_account']['new_guest_name'] = 'CustomGuestName'

‎attributes/default.rb‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,9 @@
66
# set this value if you want to harden terminal services
77
default['windows_hardening']['rdp']['harden'] = true
88
default['windows_hardening']['smbv1']['disable'] = true
9+
10+
# apply MS or DC configuration, possible values MS or DC
11+
default['default']['ms_or_dc'] = 'MS'
12+
13+
# apply Level 1 or 2 configuration, possible values 1 or 2
14+
default['default']['level_1_or_2'] = 1

‎attributes/sec_policy.rb‎

Lines changed: 258 additions & 17 deletions
Large diffs are not rendered by default.

‎recipes/accounts.rb‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
#
2+
# Cookbook Name:: windows-hardening
3+
# Recipe:: account_status
4+
#
5+
# Copyright (c) 2019 The Authors, All Rights Reserved.
6+
7+
return unless node['platform_family'] == 'windows'
8+
9+
# Ensure \'Accounts: Administrator account status\' is set to \'Disabled\'
10+
# tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '2.3.1.1'
11+
# tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '2.3.1.1'
12+
# Ensure \'Accounts: Guest account status\' is set to \'Disabled\'
13+
# tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '2.3.1.3'
14+
# tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '2.3.1.3'
15+
node['account_status']['names'].each do |name|
16+
account_status "disable #{name} account" do
17+
account_name name
18+
value node['account_status']['active_yes_no']
19+
action :set
20+
end
21+
end
22+
23+
# Ensure \'Accounts: Block Microsoft accounts\' is set to \'Users can\'t add or log on with Microsoft accounts\'
24+
# tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '2.3.1.2'
25+
# tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '2.3.1.2'
26+
registry_key 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System' do
27+
values [{
28+
name: 'NoConnectedUser',
29+
type: :dword,
30+
data: 3
31+
}]
32+
action :create
33+
recursive true
34+
end
35+
36+
# Ensure \'Accounts: Limit local account use of blank passwords to console logon only\' is set to \'Enabled\'
37+
# tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '2.3.1.4'
38+
# tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '2.3.1.4'
39+
registry_key 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa' do
40+
values [{
41+
name: 'LimitBlankPasswordUse',
42+
type: :dword,
43+
data: 1
44+
}]
45+
action :create
46+
recursive true
47+
end
48+
49+
# Configure \'Accounts: Rename administrator account\'
50+
# tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '2.3.1.5'
51+
# tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '2.3.1.5'
52+
if node['rename_account']['admin_account'] == true
53+
rename_account "rename Administrator name to #{node['rename_account']['new_admin_name']} account" do
54+
original_name 'Administrator'
55+
new_name node['rename_account']['new_admin_name']
56+
action :set
57+
end
58+
end
59+
60+
# Configure \'Accounts: Rename guest account\'
61+
# tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '2.3.1.6'
62+
# tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '2.3.1.6'
63+
if node['rename_account']['guest_account'] == true
64+
rename_account "rename Guest name to #{node['rename_account']['new_guest_name']} account" do
65+
original_name 'Guest'
66+
new_name node['rename_account']['new_guest_name']
67+
action :set
68+
end
69+
end
70+
71+
# Ensure \'Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings\' is set to \'Enabled\'
72+
# tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '2.3.2.1'
73+
# tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '2.3.2.1'
74+
registry_key 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa' do
75+
values [{
76+
name: 'SCENoApplyLegacyAuditPolicy',
77+
type: :dword,
78+
data: 1
79+
}]
80+
action :create
81+
recursive true
82+
end
83+
84+
# Ensure \'Audit: Shut down system immediately if unable to log security audits\' is set to \'Disabled\'
85+
# tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '2.3.2.2'
86+
# tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '2.3.2.2'
87+
registry_key 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa' do
88+
values [{
89+
name: 'CrashOnAuditFail',
90+
type: :dword,
91+
data: 0
92+
}]
93+
action :create
94+
recursive true
95+
end

‎recipes/default.rb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,10 @@
77
return unless node['platform_family'] == 'windows'
88

99
#include_recipe 'windows-hardening::password_policy'
10+
include_recipe 'windows-hardening::accounts'
1011
include_recipe 'windows-hardening::security_policy'
12+
include_recipe 'windows-hardening::devices'
13+
1114
include_recipe 'windows-hardening::user_rights'
1215
include_recipe 'windows-hardening::audit'
1316
include_recipe 'windows-hardening::ie'

‎recipes/devices.rb‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Ensure \'Devices: Allowed to format and eject removable media\' is set to \'Administrators\'
2+
# tag 'CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018': '2.3.4.1'
3+
# tag 'CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018': '2.3.4.1'
4+
registry_key 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon' do
5+
values [{
6+
name: 'AllocateDASD',
7+
type: :dword,
8+
data: 0
9+
}]
10+
action :create
11+
recursive true
12+
end
13+
14+
#

‎resources/account_status.rb‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
resource_name :account_status
2+
3+
property :account_status_name, String, name_property: true
4+
property :account_name, String, required: true
5+
property :value, String, required: true
6+
7+
action :set do
8+
execute new_resource.account_status_name do
9+
command "net user #{new_resource.account_name} /active:#{new_resource.value}"
10+
action :run
11+
not_if { ::File.exist?("C:\\#{new_resource.account_name}_active_#{node['account_status']['active_yes_no']}.lock") }
12+
notifies :create, "file[C:\\#{new_resource.account_name}_active_#{node['account_status']['active_yes_no']}.lock]", :immediately
13+
end
14+
15+
file "C:\\#{new_resource.account_name}_active_#{node['account_status']['active_yes_no']}.lock" do
16+
action :create
17+
end
18+
end

‎resources/rename_account.rb‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
resource_name :rename_account
2+
3+
property :rename_account_name, String, name_property: true
4+
property :original_name, String, required: true
5+
property :new_name, String, required: true
6+
7+
action :set do
8+
execute new_resource.rename_account_name do
9+
command "wmic useraccount where name=\'#{new_resource.original_name}\' call rename name=\'#{new_resource.new_name}\'"
10+
action :run
11+
not_if { ::File.exist?("C:\\rename_#{new_resource.original_name}.lock") }
12+
notifies :create, "file[C:\\rename_#{new_resource.original_name}.lock]", :immediately
13+
end
14+
15+
file "C:\\rename_#{new_resource.original_name}.lock" do
16+
action :create
17+
end
18+
end

‎test/integration/default/inspec/controls/tests.rb‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,7 @@
22
# we need to skip the test to ensure we can connect with non-administrator
33
# winrm user for our tests
44
attribute('se_network_logon_right', default: ['S-1-1-0', 'S-1-5-32-544', 'S-1-5-32-545', 'S-1-5-32-551'])
5+
attribute('se_interactive_logon_right', default: ['S-1-5-32-544', 'S-1-5-9'])
6+
attribute('se_remote_interactive_logon_right', default: ['S-1-1-0', 'S-1-5-32-544', 'S-1-5-32-545', 'S-1-5-32-551'])
7+
58
end

0 commit comments

Comments
 (0)