CHANGELOG.md

Changelog

---

• 0.6.10

-- [[email protected]] - Added template for /etc/aide.conf and it updates the aide database -- [[email protected]] - Added default attributes for Centos 6 & 7 for /etc/aide.conf -- [[email protected]] - Added inspec and unit tests for /etc/aide.conf -- [[email protected]] - Corrected inspec tests centos7 to run aide tests for redhat platforms

• 0.6.9

-- [[email protected]] - Updated more audit not included in the last version -- [[email protected]] - Combined two audit steps into one to save time/processing

• 0.6.8

-- [[email protected]] - Updated audit scripts to not double-check file mounts that may appear twice in df output

• 0.6.7

-- [[email protected]] - Updated defaults for audit.rules to avoid 32/64 bit syscall mismatch warning -- [[email protected]] - Removed "redhat" from the test for purging the avahi-daemon package -- [[email protected]] - Updated unit tests to work around errors -- [[email protected]] - Updated style tests for later version of foodcritic/rubocop

• 0.6.6

-- [[email protected]] - Updating the cookbook to work properly with CentOS 7 -- [[email protected]] - Added disabling vfat and ipv6 to modprobe -- [[email protected]] - Update avahi daemon recipe for CentOS 7 (chkconfig vs sysctl) -- [[email protected]] - Update ipv6 recipe for CentOS 7 -- [[email protected]] - Fixed idempotency issue in ipv6 recipe for CentOS 6 -- [[email protected]] - Update dhcp recipe for CentOS 7 -- [[email protected]] - Update rsyslog.conf default attributes to the latest CIS recommendations -- [[email protected]] - Update sshd_config template to put logic on keywords that may or may not exist in sshd -- [[email protected]] - Switched system_auth recipe to use templates instead of very touchy sed/grep -- [[email protected]] - Changed default PASS_MIN_DAYS in login_defs to 7 as per stig -- [[email protected]] - Updated file_permissions recipe to not branch on ubuntu/rhel -- [[email protected]] - Split InSpec tests into CentOS 6 and CentOS 7 -- [[email protected]] - Updated Gemfile to require a minimal inspec gem version

• 0.6.5

-- [[email protected]] - Leaving sysctl attribute mutation solely to the sysctl cookbook. -- [[email protected]] - Removing STIG cookbook attributes for sysctl. Using only sysctl cookbook attributes

• 0.6.4

-- [[email protected]] - Update mail transfer agent recipe to fully parameterize the CentOS template for main.cf

• 0.6.3

-- [[email protected]] - Update the system_auth recipe to respect pre-existing symlinks -- [[email protected]] - Fix boot_settings recipe to catch if selinux is disabled and move on

• 0.6.2

-- [[email protected]] - More testing -- [[email protected]] - Updated auditd ruleset to include more rules -- [[email protected]] - Created ChefSpec testing for auditd_rules recipe -- [[email protected]] - Updated ServerSpec testing for all default auditd rules

• 0.6.1 -- [[email protected]] - More rubocop fixes -- [[email protected]] - Rework of sshd_config recipe to allow more customization -- [[email protected]] - Updated templates to point to proper GitHub URL -- [[email protected]] - Updated dependency version for sysctl cookbook in Berksfile -- [[email protected]] - Fixed kitchen converge warnings

• 0.6.0 -- [[email protected]] - fix some rubocop violations -- [[email protected]] - switch to using chef inspec -- [[email protected]] - remove Centos 6.6 and 6.8
  -- [[email protected]] - bump version to 0.6.0 -- [[email protected]] - remove kitchen version pin.

• 0.5.5 -- [arothian@github] - Update aide to setup crontab for ubuntu

• 0.5.4 -- [[email protected]] - Fix an issue with auth-config being improperly written to for pass reuse limit

• 0.5.3 -- [[email protected]] - Switch sysctl write flags

• 0.5.2 -- [[email protected]] - Ignore errors on unknown sysctl keys

• 0.5.1 -- [[email protected]] - Included third-party sysctl cookbook as a hard-coupled dependency by calling it in proc_hard recipe

• 0.5.0 -- [[email protected]] - Switched sysctl.conf template writing out and brought in the third-party sysctl cookbook to handle writing .d config file -- [[email protected]] - Updated serverspec testing

• 0.4.3 -- [[email protected]] - Updated to switch out which file in /etc/pam.d/system-auth* gets symlinked

• 0.4.2 -- [[email protected]] - Fix most foodcritic errors and warnings -- [[email protected]] - CIS 1.6.2 (Configure ExecShield) was removed in 2.0.0 of all CIS STIG. No longer testing for it -- [[email protected]] - Added updates to SSHD config to allow boolean for password authentication -- [[email protected]] - Updated system auth recipe to be less destructive to /etc/pam.d/system-auth since that may be updated by authconfig -- [[email protected]] - Fixed a few tests

• 0.4.1 -- [[email protected]] - Updated sshd config to include approved ciphers (RHEL6 STIG 6.2.11) -- [[email protected]] - Added the ability to change ChallengeResponseAuthentication in sshd config -- [[email protected]] - Added the ability to change UsePAM in sshd config

• 0.4.0 -- [[email protected]] - Users may now add auditd rules directly as a series of attributes

• 0.3.11 -- [[email protected]] - More Auditd fixes

• 0.3.10 -- [[email protected]] - Fix auditd default parameters which break the build -- [[email protected]] - Add documentation for new attributes

• 0.3.9 -- [[email protected]] - Fully parameterized auditd configuration file -- [[email protected]] - No longer calling the auditd cookbook directly from auditd.rb -- [[email protected]] - Auditd cookbook is no longer a direct dependency of the STIG cookbook. Should be part of an overall runlist

• 0.3.8 -- [[email protected]] - Updated STIG and Audit rules to CIS RHEL Stig 1.4.0 -- [[email protected]] - Added CentOS 6 ruleset 3.2 - "Remove the X Window System" -- [[email protected]] - Fixed and added many Serverspec tests -- [[email protected]] - Corrected a typo in check_duplicate_gid.sh to correct STIG control number -- [[email protected]] - Removed CIS wording from audit scripts -- [[email protected]] - Enforced permissions on /boot/grub/grub.conf as per STIG 1.5.2 -- [[email protected]] - Removed grub.conf template -- [[email protected]] - Updated mounting of /dev/shm to be idempotent