Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Easy add and remove packages, disable services #138

Merged
merged 6 commits into from
Aug 16, 2018
Merged

Easy add and remove packages, disable services #138

merged 6 commits into from
Aug 16, 2018

Conversation

timstoop
Copy link
Contributor

Sometimes it is needed to simply remove some packages everywhere or add them everywhere. Or to disable a service. This especially in relation with CIS DIL Benchmark 2.2.1 (Time Synchronization), 2.2.16 (Ensure rsync service is not enabled) and 2.3.4 (Ensure telnet client is not installed), where it may be too much to add a specific module for each application.

Let me know if something like this is acceptable or if you'd like to see this solved another way.

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <github@timstoop.nl> (github: timstoop)
HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <github@timstoop.nl> (github: timstoop)
HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <github@timstoop.nl> (github: timstoop)
@mcgege
Copy link
Member

mcgege commented Jul 6, 2018

I think this is a good idea, especially on then unwanted_packages ... for wanted_packages vim might be a better example, because if you take ntp it would be logical for me to also configure this service and keep it running. For disables_services: What if this service is not installed?
In general I fear that this will only be useful in small and/or homogeneous environments - the packages / services have different names per distribution, so you cannot define this globally here.
@artem-sidorenko What's your opinion?

@timstoop
Copy link
Contributor Author

timstoop commented Jul 7, 2018

I'm happy to change it to empty arrays and give an example for Debian Stretch in the documentation, if you feel that's better.

@artem-sidorenko
Copy link
Member

@mcgege I have the same view

@timstoop
Copy link
Contributor Author

(I'm on holiday still this week, will fix the commit next week.)

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <github@timstoop.nl> (github: timstoop)
HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <github@timstoop.nl> (github: timstoop)
@timstoop
Copy link
Contributor Author

Would this be acceptable?

Copy link
Member

@mcgege mcgege left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good otherwise, thanks a lot!

README.md Outdated

As the CIS Distribution Independent Linux Benchmark is a good starting point
regarding hardening of systems, it was deemed appropriate to implement an easy
way to deal with one-offs for which one doesn't write to write an entire module.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good description, just remove the double to write

HardeningFramework-DCO-1.1-Signed-off-by: Tim Stoop <github@timstoop.nl> (github: timstoop)
@mcgege
Copy link
Member

mcgege commented Aug 16, 2018

Many thanks for your contribution!

@mcgege mcgege merged commit f0a4732 into dev-sec:master Aug 16, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants