|
2 | 2 | name: windows-baseline |
3 | 3 | title: DevSec Windows Security Baseline |
4 | 4 | summary: An InSpec Compliance Profile that covers CIS Microsoft Windows Server 2012R2, 2016 RTM (Release 1607) Benchmark Level 1 and 2 and additional controls from MS technet. |
5 | | -version: 2.1.1 |
| 5 | +version: 2.0.1 |
6 | 6 | maintainer: DevSec Hardening Framework Team |
7 | 7 | copyright: DevSec Hardening Framework Team |
8 | 8 | copyright_email: hello@dev-sec.io |
9 | 9 | license: Apache-2.0 |
10 | 10 | supports: |
11 | | - - platform-family: windows |
| 11 | + - platform-family: windows |
12 | 12 | attributes: |
13 | | - - name: level_1_or_2 |
14 | | - required: false |
15 | | - description: 'define if you want to execute Level 1 or (Level 1 and Level 2)' |
16 | | - value: 1, |
17 | | - type: numeric |
18 | | - - name: ms_or_dc |
19 | | - required: false |
20 | | - description: 'define if you want to execute the profile in the context of a Memeber Server (MS) or Domain Controler (DC)' |
21 | | - value: 'MS' |
22 | | - type: string |
23 | | - - name: password_history_size |
24 | | - required: false |
25 | | - description: 'define password history size' |
26 | | - value: 24 |
27 | | - type: numeric |
28 | | - - name: maximum_password_age |
29 | | - required: false |
30 | | - description: 'define MaximumPasswordAge' |
31 | | - value: 60 |
32 | | - type: numeric |
33 | | - - name: se_network_logon_right |
34 | | - required: false |
35 | | - description: 'define which users are allowed to access this computer from the network' |
36 | | - value: ['S-1-5-9', 'S-1-5-32-544'] |
37 | | - type: array |
38 | | - - name: se_interactive_logon_right |
39 | | - required: false |
40 | | - description: 'define which users are allowed to log on locally' |
41 | | - value: ['S-1-5-32-544'] |
42 | | - type: array |
43 | | - - name: se_remote_interactive_logon_right |
44 | | - required: false |
45 | | - description: 'define which users are allowed to log on through Remote Desktop Services' |
46 | | - value: ['S-1-5-32-544'] |
47 | | - type: array |
48 | | - - name: se_backup_privilege |
49 | | - required: false |
50 | | - description: 'define which users are allowed to backup files and directories' |
51 | | - value: ['S-1-5-32-544'] |
52 | | - type: array |
53 | | - - name: se_systemtime_privilege |
54 | | - required: false |
55 | | - description: 'define which users are allowed to change system time' |
56 | | - value: ['S-1-5-19', 'S-1-5-32-544'] |
57 | | - type: array |
58 | | - - name: se_time_zone_privilege |
59 | | - required: false |
60 | | - description: 'define which users are allowed to change system time zone' |
61 | | - value: ['S-1-5-19', 'S-1-5-32-544'] |
62 | | - type: array |
63 | | - - name: se_create_symbolic_link_privilege |
64 | | - required: false |
65 | | - description: 'define which users are allowed to create symbolic links' |
66 | | - value: ['S-1-5-32-544'] |
67 | | - type: array |
68 | | - - name: se_deny_network_logon_right |
69 | | - required: false |
70 | | - description: 'define which users are not allowed to access this computer from the network' |
71 | | - value: ['S-1-5-32-546'] |
72 | | - type: array |
73 | | - - name: se_deny_remote_interactive_logon_right |
74 | | - required: false |
75 | | - description: 'define which users are not allowed to log on through Remote Desktop Services' |
76 | | - value: ['S-1-5-32-546'] |
77 | | - type: array |
78 | | - - name: se_enable_delegation_privilege |
79 | | - required: false |
80 | | - description: 'define which users are allowed to enable computer and user accounts to be trusted' |
81 | | - value: [] |
82 | | - type: array |
83 | | - - name: se_impersonate_privilege |
84 | | - required: false |
85 | | - description: 'define which users are allowed to impersonate a client after authentication' |
86 | | - value: ['S-1-5-19', 'S-1-5-20', 'S-1-5-32-544', 'S-1-5-6'] |
87 | | - type: array |
88 | | - - name: se_load_driver_privilege |
89 | | - required: false |
90 | | - description: 'define which users are allowed to impersonate a client after authentication' |
91 | | - value: ['S-1-5-32-544'] |
92 | | - type: array |
93 | | - - name: se_batch_logon_right |
94 | | - required: false |
95 | | - description: 'define which users are allowed to log on as a batch job' |
96 | | - value: ['S-1-5-32-544', 'S-1-5-32-551'] |
97 | | - type: array |
98 | | - - name: se_security_privilege |
99 | | - required: false |
100 | | - description: 'define which users are allowed to manage auditing and security logs' |
101 | | - value: ['S-1-5-32-544'] |
102 | | - type: array |
103 | | - - name: se_assign_primary_token_privilege |
104 | | - required: false |
105 | | - description: 'define which users are allowed to replace a process level token' |
106 | | - value: ['S-1-5-19', 'S-1-5-20'] |
107 | | - type: array |
108 | | - - name: se_restore_privilege |
109 | | - required: false |
110 | | - description: 'define which users are allowed to restore files and directories' |
111 | | - value: ['S-1-5-32-544'] |
112 | | - type: array |
113 | | - - name: hklm_null_session_pipes |
114 | | - required: false |
115 | | - description: 'define named pipes that can be accessed anonymously' |
116 | | - value: [] |
117 | | - type: array |
| 13 | + - name: level_1_or_2 |
| 14 | + required: false |
| 15 | + description: 'define if you want to execute Level 1 or (Level 1 and Level 2)' |
| 16 | + value: 1, |
| 17 | + type: numeric |
| 18 | + - name: ms_or_dc |
| 19 | + required: false |
| 20 | + description: 'define if you want to execute the profile in the context of a Memeber Server (MS) or Domain Controler (DC)' |
| 21 | + value: 'MS' |
| 22 | + type: string |
| 23 | + - name: password_history_size |
| 24 | + required: false |
| 25 | + description: 'define password history size' |
| 26 | + value: 24 |
| 27 | + type: numeric |
| 28 | + - name: maximum_password_age |
| 29 | + required: false |
| 30 | + description: 'define MaximumPasswordAge' |
| 31 | + value: 60 |
| 32 | + type: numeric |
| 33 | + - name: se_network_logon_right |
| 34 | + required: false |
| 35 | + description: 'define which users are allowed to access this computer from the network' |
| 36 | + value: ['S-1-5-9', 'S-1-5-32-544'] |
| 37 | + type: array |
| 38 | + - name: se_interactive_logon_right |
| 39 | + required: false |
| 40 | + description: 'define which users are allowed to log on locally' |
| 41 | + value: ['S-1-5-32-544'] |
| 42 | + type: array |
| 43 | + - name: se_remote_interactive_logon_right |
| 44 | + required: false |
| 45 | + description: 'define which users are allowed to log on through Remote Desktop Services' |
| 46 | + value: ['S-1-5-32-544'] |
| 47 | + type: array |
| 48 | + - name: se_backup_privilege |
| 49 | + required: false |
| 50 | + description: 'define which users are allowed to backup files and directories' |
| 51 | + value: ['S-1-5-32-544'] |
| 52 | + type: array |
| 53 | + - name: se_systemtime_privilege |
| 54 | + required: false |
| 55 | + description: 'define which users are allowed to change system time' |
| 56 | + value: ['S-1-5-19', 'S-1-5-32-544'] |
| 57 | + type: array |
| 58 | + - name: se_time_zone_privilege |
| 59 | + required: false |
| 60 | + description: 'define which users are allowed to change system time zone' |
| 61 | + value: ['S-1-5-19', 'S-1-5-32-544'] |
| 62 | + type: array |
| 63 | + - name: se_create_symbolic_link_privilege |
| 64 | + required: false |
| 65 | + description: 'define which users are allowed to create symbolic links' |
| 66 | + value: ['S-1-5-32-544'] |
| 67 | + type: array |
| 68 | + - name: se_deny_network_logon_right |
| 69 | + required: false |
| 70 | + description: 'define which users are not allowed to access this computer from the network' |
| 71 | + value: ['S-1-5-32-546'] |
| 72 | + type: array |
| 73 | + - name: se_deny_remote_interactive_logon_right |
| 74 | + required: false |
| 75 | + description: 'define which users are not allowed to log on through Remote Desktop Services' |
| 76 | + value: ['S-1-5-32-546'] |
| 77 | + type: array |
| 78 | + - name: se_enable_delegation_privilege |
| 79 | + required: false |
| 80 | + description: 'define which users are allowed to enable computer and user accounts to be trusted' |
| 81 | + value: [] |
| 82 | + type: array |
| 83 | + - name: se_impersonate_privilege |
| 84 | + required: false |
| 85 | + description: 'define which users are allowed to impersonate a client after authentication' |
| 86 | + value: ['S-1-5-19', 'S-1-5-20', 'S-1-5-32-544', 'S-1-5-6'] |
| 87 | + type: array |
| 88 | + - name: se_load_driver_privilege |
| 89 | + required: false |
| 90 | + description: 'define which users are allowed to impersonate a client after authentication' |
| 91 | + value: ['S-1-5-32-544'] |
| 92 | + type: array |
| 93 | + - name: se_batch_logon_right |
| 94 | + required: false |
| 95 | + description: 'define which users are allowed to log on as a batch job' |
| 96 | + value: ['S-1-5-32-544', 'S-1-5-32-551'] |
| 97 | + type: array |
| 98 | + - name: se_security_privilege |
| 99 | + required: false |
| 100 | + description: 'define which users are allowed to manage auditing and security logs' |
| 101 | + value: ['S-1-5-32-544'] |
| 102 | + type: array |
| 103 | + - name: se_assign_primary_token_privilege |
| 104 | + required: false |
| 105 | + description: 'define which users are allowed to replace a process level token' |
| 106 | + value: ['S-1-5-19', 'S-1-5-20'] |
| 107 | + type: array |
| 108 | + - name: se_restore_privilege |
| 109 | + required: false |
| 110 | + description: 'define which users are allowed to restore files and directories' |
| 111 | + value: ['S-1-5-32-544'] |
| 112 | + type: array |
| 113 | + - name: hklm_null_session_pipes |
| 114 | + required: false |
| 115 | + description: 'define named pipes that can be accessed anonymously' |
| 116 | + value: [] |
| 117 | + type: array |
0 commit comments