chore(CIS): grub configuration changes to accommodate CIS

[jackfrancis]

Reason for Change:

Enables auditing via grub, see https://secscan.acron.pl/centos7/4/1/3

Issue Fixed:

Fixes #1009

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• tested upgrade from previous version

Notes:

[acs-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jackfrancis

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jackfrancis]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jackfrancis]

Validated w/ "ubuntu" distro:

  should validate all cloud-init-paved files
  /Users/jackfrancis/work/src/github.com/Azure/aks-engine/test/e2e/kubernetes/kubernetes_test.go:237

$ k config view -o json

$ k get nodes -o json

$ scp -i /Users/jackfrancis/work/src/github.com/Azure/aks-engine/_output/kubernetes-westus2-28812-ssh -o StrictHostKeyChecking=no scripts/cloud-init-files-validate.sh azureuser@kubernetes-westus2-28812.westus2.cloudapp.azure.com:/tmp/cloud-init-files-validate.sh
2019/04/22 10:06:42 Authorized uses only. All activity may be monitored and reported.


$ ssh -A -i /Users/jackfrancis/work/src/github.com/Azure/aks-engine/_output/kubernetes-westus2-28812-ssh -o ConnectTimeout=30 -o StrictHostKeyChecking=no azureuser@kubernetes-westus2-28812.westus2.cloudapp.azure.com -p 22 scp -o StrictHostKeyChecking=no /tmp/cloud-init-files-validate.sh k8s-agentpool1-12763148-vmss000000:/tmp/cloud-init-files-validate.sh

$ ssh -A -i /Users/jackfrancis/work/src/github.com/Azure/aks-engine/_output/kubernetes-westus2-28812-ssh -p 22 -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR azureuser@kubernetes-westus2-28812.westus2.cloudapp.azure.com ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR k8s-agentpool1-12763148-vmss000000 "/tmp/cloud-init-files-validate.sh"

$ ssh -A -i /Users/jackfrancis/work/src/github.com/Azure/aks-engine/_output/kubernetes-westus2-28812-ssh -o ConnectTimeout=30 -o StrictHostKeyChecking=no azureuser@kubernetes-westus2-28812.westus2.cloudapp.azure.com -p 22 scp -o StrictHostKeyChecking=no /tmp/cloud-init-files-validate.sh k8s-agentpool1-12763148-vmss000001:/tmp/cloud-init-files-validate.sh

$ ssh -A -i /Users/jackfrancis/work/src/github.com/Azure/aks-engine/_output/kubernetes-westus2-28812-ssh -p 22 -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR azureuser@kubernetes-westus2-28812.westus2.cloudapp.azure.com ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR k8s-agentpool1-12763148-vmss000001 "/tmp/cloud-init-files-validate.sh"

$ ssh -A -i /Users/jackfrancis/work/src/github.com/Azure/aks-engine/_output/kubernetes-westus2-28812-ssh -o ConnectTimeout=30 -o StrictHostKeyChecking=no azureuser@kubernetes-westus2-28812.westus2.cloudapp.azure.com -p 22 scp -o StrictHostKeyChecking=no /tmp/cloud-init-files-validate.sh k8s-master-12763148-0:/tmp/cloud-init-files-validate.sh

$ ssh -A -i /Users/jackfrancis/work/src/github.com/Azure/aks-engine/_output/kubernetes-westus2-28812-ssh -p 22 -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR azureuser@kubernetes-westus2-28812.westus2.cloudapp.azure.com ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR k8s-master-12763148-0 "/tmp/cloud-init-files-validate.sh"
•

[codecov]

Codecov Report

Merging #1111 into master will increase coverage by <.01%.
The diff coverage is 100%.

@@            Coverage Diff            @@
##           master   #1111      +/-   ##
=========================================
+ Coverage    74.4%   74.4%   +<.01%     
=========================================
  Files         131     131              
  Lines       18283   18284       +1     
=========================================
+ Hits        13603   13604       +1     
  Misses       3901    3901              
  Partials      779     779

[CecileRobertMichon]

Can we make this file "lighter" by removing a lot of the commented out lines?

[mboersma]

lgtm

[mboersma]

Should we also grep for ipv6.disable=1 or is that not part of the CIS recommendation?

[jackfrancis]

Yeah, in fact this grep is carried over specifically from here:

https://secscan.acron.pl/centos7/4/1/3