dev-sec / chef-windows-hardening

This chef cookbook provides windows hardening configurations for the DevSec Windows baseline profile.

windows-hardening (Chef Cookbook)

This cookbook provides recipes for ensuring that a Windows 2012 R2 system is compliant with the DevSec Windows Baseline.

Platforms

• Windows Server 2012
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2016 Nano Server

Roadmap

This cookbook aims to be the go-to-resource to implement hardening for Windows environments. In order to achieve that plan to cover the requirements of

• CIS Windows 2012R2
• CIS Windows 2016
• STIG Windows 2012R2

Any contributions to achieve that are welcome!

Coding guidelines

Use Chef resources wherever possible. Some Chef resources we use to manage Windows:

• registry_key
• powershell_script
• security_policy

If no Chef resource is available, we prefer to use Powershell or Powershell DSC.

Testing the cookbook

Test-Kitchen

This cookbooks ships with a test-kitchen setup to verify that the implementation follows the DevSec Windows Baseline:

kitchen test

Chef Server and Chef Compliance

If you use Chef Server, you can bootstrap a node and run a Chef Compliance against them it. It is recommended to use an EC2 instance in a Chef environment, made up of a Chef Server and a Compliance Server. The following command can be used for bootstrapping a node.

knife ec2 server create --node-name windows-test --flavor t2.medium --image ami-29eb7e5a --security-group-ids sg-238e5744 --user-data win-userdata.ps1 --winrm-user Administrator --winrm-password Ch4ng3m3 --ssh-key emea-sa-shared -r 'recipe[base-win2012-hardening::enable_winrm_access]'

Please note the following:

• To bootstrap a Windows node using Knife you need a predictable password. The win-userdata.ps1 file, in this repo, provides this.
• You need a security group that allows winrm access and RDP access.
• We set a run-list. The enable_winrm_access recipe prepares the node for a manual Compliance scan.

Applying at scale

This cookbook is currently in development. It does not cover all requirements to provide a fully hardened Windows environment yet. Any contributions are welcome to improve the cookbook. If you wish to apply this at scale, use a role and add the cookbook to its runlist, there is no need to apply a specific recipe.

Contributors + Kudos

• Dominik Richter arlimus
• Christoph Hartmann chris-rock
• Simon Fisher simfish85
• Alex Pop alexpop
• Yvo Van Doorn yvovandoorn
• Matthew Tunny MattTunny

Contributing

See contributor guideline.

License and Author

• Author:: Joe Gardiner [email protected] [email protected]
• Author:: Christoph Hartmann [email protected] [email protected]
• Author:: Chef Software Inc.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

chef-windows-hardening's Issues

appveyor tests for windows nano

• spin up a new windows nano container
• run hardening cookbook on it
• run inspec baseline for verification

Make Readme better

Make the readme better

Add Windows 2016 support

• kitchen support
• appveyor tests

Powershell logging doesn't designate output

Not sure if this is required for CIS benchmarks, but the registry keys for enabling Powershell logging are missing output logging. Is this meant to be left out on purpose?

Does it support Windows 2019?

Is your feature request related to a problem? Please describe.

Platforms

• Windows Server 2012
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2016 Nano Server

Does it support Windows 2019 now?

Describe the solution you'd like

Need support Windows 2019.

Describe alternatives you've considered

Need support Windows 2019.

Additional context

Need support Windows 2019.

add inspec tests to appveyor test

In #13 we introduced appveyor tests. This ensures the cookbook is executable. We should also enable the inspec tests in appveyor

Question about adding CIS Benchmark

My team is needing to use the one of the latest Windows Server CIS benchmarks. We are using Windows Server 1803 but there's no benchmark for that yet, so we might target 1607.

I like the structure you have but also have a few questions about adding this to your cookbook.

1. First, is this something that would be acceptable to eventually merge?
2. How do you run the cookbook (or for that matter, InSpec) for a specific benchmark, e.g. release 1607 vs 2012R2?

Thanks,
Jason

Chef Infra Client 16+ NoMethodError: undefined method `password_policy'

Cookbook version version '0.9.1'

It looks like this issue was fixed but the fix is not visible in the supermarket.
We still receive the following errors:
NoMethodError: undefined method `password_policy'
NoMethodError: undefined method `security_policy'

Please see the comments in the issue (#50):
"Looks like version '0.9.1' from supermarket.chef.io does not contain this fix since the version in #49 wasn`t bumped."

Related link: https://github.com/dev-sec/chef-windows-hardening/pull/49/files

Could you please take a look and fix this?

A fix windows-audit-205 looks missing

While working on an Ansible role corresponding to the windows-baseline InSpec profile, I noticed the fix for windows-audit-205 is missing from this Chef recipe.

It doesn't look like it was intended...

clean recipes after the CIS implementation is done

clean the following recipes, if the issue #46 is done

include_recipe 'windows-hardening::audit'
include_recipe 'windows-hardening::ie'
include_recipe 'windows-hardening::rdp'
include_recipe 'windows-hardening::access'
include_recipe 'windows-hardening::privacy'
include_recipe 'windows-hardening::powershell'

custom resource declaration compatibility with Chef infra client v 16.2.44+

custom resource declaration for 'password_policy' need to be updated to sync with Chef infra client v16.2.44+
Pre-16 code:
resource_name :foo

Chef Infra Client 16+ code
provides :foo

Chef Infra Client < 16 backwards compatible code
resource_name :foo
provides :foo

Getting undefined local variable error when running cookbook

I'm running the cookbook using chef-solo as part of a packer deployment and I'm getting an error that I'm sure is my stupidity but I can't figure out what's wrong:

vmware-iso: Compiling Cookbooks...
vmware-iso: Converging 32 resources
vmware-iso: Recipe: windows-hardening::enable_winrm_access
vmware-iso:   * powershell_script[Remote Management] action run
vmware-iso:     - execute "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -InputFormat None -File "C:/Users/ADMINI~1/AppData/Local/Temp/chef-script20180503-2024-1siyebd.ps1"
vmware-iso: Recipe: windows-hardening::password_policy
vmware-iso:   * password_policy[password_history] action set
vmware-iso:
vmware-iso:     ================================================================================
vmware-iso:     Error executing action `set` on resource 'password_policy[password_history]'
vmware-iso:     ================================================================================
vmware-iso:
vmware-iso:     NameError
vmware-iso:     ---------
vmware-iso:     undefined local variable or method `policy_name' for #<#<Class:0x028c9f08>:0x04e6b898>
vmware-iso:
vmware-iso:     Resource Declaration:
vmware-iso:     ---------------------
vmware-iso:     # In c:/windows/temp/packer-chef-solo/local-mode-cache/cache/cookbooks/windows-hardening/recipes/password_policy.rb
vmware-iso:
vmware-iso:      11: password_policy 'password_history' do
vmware-iso:      12:   policy_command 'uniquepw'
vmware-iso:      13:   value 24
vmware-iso:      14:   action :set
vmware-iso:      15: end
vmware-iso:      16:
vmware-iso:
vmware-iso:     Compiled Resource:
vmware-iso:     ------------------
vmware-iso:     # Declared in c:/windows/temp/packer-chef-solo/local-mode-cache/cache/cookbooks/windows-hardening/recipes/password_policy.rb:11:in `from_file'
vmware-iso:
vmware-iso:     password_policy("password_history") do
vmware-iso:       action [:set]
vmware-iso:       default_guard_interpreter :default
vmware-iso:       declared_type :password_policy
vmware-iso:       cookbook_name "windows-hardening"
vmware-iso:       recipe_name "password_policy"
vmware-iso:       policy_command "uniquepw"
vmware-iso:       value 24
vmware-iso:       policy_name "password_history"
vmware-iso:     end
vmware-iso:
vmware-iso:     System Info:
vmware-iso:     ------------
vmware-iso:     chef_version=14.0.202
vmware-iso:     platform=windows
vmware-iso:     platform_version=6.3.9600
vmware-iso:     ruby=ruby 2.5.1p57 (2018-03-29 revision 63029) [i386-mingw32]
vmware-iso:     program_name=c:/opscode/chef/bin/chef-solo
vmware-iso:     executable=c:/opscode/chef/bin/chef-solo
vmware-iso:

Cookbook supports only English versions of Windows

Describe the bug
When running on non-English version of Windows (for example, Russian version), cookbook fails with Expected process to exit with [0], but received '87'

Expected behavior
Cookbook should support not only English version of Windows.

Actual behavior

* execute[Account Logon Audit Log] action run
       
           ================================================================================
           Error executing action `run` on resource 'execute[Account Logon Audit Log]'
           ================================================================================
       
           Mixlib::ShellOut::ShellCommandFailed
           ------------------------------------
           Expected process to exit with [0], but received '87'
           ---- Begin output of AuditPol /Set /Category:"Account Logon" /Failure:Enable /Success:Enable ----
           STDOUT: €бЇ®«м§®ў ­ЁҐ: AuditPol Є®¬ ­¤  [<Ї®¤Є®¬ ­¤ ><Ї а ¬Ґвал>]

This happens because all categories are hardcoded to english naming.

https://github.com/dev-sec/chef-windows-hardening/blob/master/recipes/audit.rb#L60

execute 'Account Logon Audit Log' do
  command 'AuditPol /Set /Category:"Account Logon" /Failure:Enable /Success:Enable'
  action :run
  not_if { ::File.exist?('C:\accountLogonAudit.lock') }
  notifies :create, 'file[C:\accountLogonAudit.lock]', :immediately
end

Example code

include_recipe 'windows-hardening::default'

OS / Environment

Windows Server 2016 Datacenter Evaluation (Russian)

PS C:\Users\vagrant> Get-WinSystemLocale

LCID             Name             DisplayName
----             ----             -----------
1049             ru-RU            Русский (Россия)

Chef Version

14.13.11

Cookbook Version

0.9.1

Additional context

PS C:\Users\vagrant> auditpol /list /category
Категория или подкатегория
Вход учетной записи
Вход/выход
Доступ к объектам
Доступ к службе каталогов (DS)
Изменение политики
Использование прав
Подробное отслеживание
Система
Учетные записи
PS C:\Users\vagrant> AuditPol /Set /Category:"Вход учетной записи" /Failure:Enable /Success:Enable
Команда выполнена успешно.

As a workaround we can move Categories names to attributes.

Platform support

• Document supported platforms
• Add supported platforms to metdata file

Rename recipes to be component-oriented

The current recipes are following the numbers by https://github.com/dev-sec/windows-baseline/tree/master/controls

Instead I propose we are using a component-oriented model like in https://github.com/dev-sec/chef-os-hardening/tree/master/recipes

Current failing tests

We no longer have 100% coverage against the https://github.com/dev-sec/windows-baseline profile.

Current failing tests follow:

• Registry Key HKLM\System\CurrentControlSet\Services\LanManServer\Parameters SMB1 should eq 0
• Audit Policy Computer Account Management should eq "Success and Failure"
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging should exist
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging EnableScriptBlockLogging should eq 0
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription should exist
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription EnableTranscripting should eq 0
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Settings\AllowYourAccount should exist
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Settings\AllowYourAccount value should eq 0
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore should exist
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore AutoDownload should eq 4
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore DisableOSUpgrade should eq 1
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search should exist
• Registry Key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Search AllowIndexingEncryptedStoresOrItems should eq 0

implement the full CIS Benchmark for Win2012r2 and 2016

i implemented until cis 17.2.4 control for windows 2012 r2 and win 2016

i used the 2 documents from CIS

CIS Microsoft Windows Server 2012 R2 Benchmark v2.3.0 - 03-30-2018
CIS Microsoft Windows Server 2016 RTM (Release 1607) Benchmark v1.1.0 - 10-31-2018

New release

Hi!

Can we get a new release?

user_rights.rb empty?

just curious where the content went?

enable_winrm_access does not seem to work

Describe the bug
Using packer to create an image, apply hardening cookbook and enable_winrm_acesss and reboot
Expected behavior
Winrm is available after reboot

Actual behavior
after reboot winrm is no longer available

edr-widows-2016-base-20190228-074531: Recipe: windows-hardening::enable_winrm_access
edr-widows-2016-base-20190228-074531:   * powershell_script[Remote Management] action run[2019-02-28T15:53:42+00:00] INFO: Processing powershell_script[Remote Management] action run (windows-hardening::enable_winrm_access line 10)
2019/02/28 07:53:41 [INFO] (telemetry) ending chef-client
2019/02/28 07:53:41 [INFO] (telemetry) Starting provisioner windows-restart
==> edr-widows-2016-base-20190228-074531: Restarting Machine
2019/02/28 07:53:41 [INFO] 0 bytes written for 'stdout'
2019/02/28 07:53:41 [INFO] 0 bytes written for 'stderr'
2019/02/28 07:53:41 packer: 2019/02/28 07:53:41 Retryable error: http response error: 401 - invalid content type

After the 10 minute timeout packer exits as winrm does not become available.
Example code

OS / Environment
aws windows 2016 base
Chef Version

14.10.9

Cookbook Version

0.9.1

I also attempt to connect to the host via telnet ip 5985 and I cannot.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update dependency highline to v3
• chore(deps): update dependency inspec to v6

Detected dependencies

bundler

Gemfile

• berkshelf '~> 8.0'
• chef '~> 18.0'
• foodcritic '~> 16.0'
• highline '~> 2.1.0'
• rubocop '~> 1.63.0'
• inspec '~> 5'
• github_changelog_generator '~> 1.16.0'

github-actions

.github/workflows/codespell.yml

---

• Check this box to trigger a request for Renovate to run again on this repository