dev-sec / puppet-os-hardening Goto Github PK

Implement automated integration tests on DO with Travis as described here

I apply the hardening with the following command:

puppet apply -e "class { 'os_hardening': enable_ipv6 => true, enable_ipv4_forwarding => true, enable_ipv6_forwarding => true, allow_core_dump => true}"

but I still see /etc/security/limits.d/10.hardcore.conf and /etc/profile.d/pinerolo_profile.sh files setup with hardening values. I wouldn't have expected this outcome based on my setting allow_core_dump to true

We have multiple options, one option is to use test-kitchen as we use this for Chef and Ansible.

Not sure why this line is commented-out:
https://github.com/hardening-io/puppet-os-hardening/blob/master/manifests/sysctl.pp#L144

In chef and ansible flavors of this module it defaults to 0.
However from hardening perspective it should probably default to 1 and optionally set to 0.

Should i prepare a PR?

I just wanted to check if there is some special reason why this module only sets accept_ra on 'all', but not also on 'default'?

https://github.com/hardening-io/puppet-os-hardening/blob/master/manifests/sysctl.pp#L66-67

I can submit PR for this.

Hello,

I encounter an issue with this module with a HP physical server, using uefi.
To fix the issue I had to use rescue mode and follow this KB :
https://access.redhat.com/solutions/3215551

I'm not an expert, but defaults settings are a bit aggressive don't you think ? Maybe we can add some logic in order to detect uefi and prevent some default settings in this case ?
Or maybe a documentation update.

What do you think ?

Regards,

• OpenSUSE 15
• Puppet 5 + 6

Already prepared in kitchen.yml, but os detection doesn't work
-> We have to wait for inspec/train#377

The problem from issue #164 is still not fixed in release 2.2.0. With r10k the module is not usable as some files have restricted file permissions. This module is the only module with this behaviour.

I expect the module build process to be the root cause here. If you look into the tar file that can be downloaded from forge.puppet.com you can actually see the missing read permission for others (mode 640) for some of the files (e.g. metadata.json).

Some test runs are still broken:

• centos-6
• rhel-6
• debian-6
• opensuse-leap-42
• sles-11
• sles-12

• Use PDK toolset (howto / additional info)
• Cleanup tests and code
• Update README on testing

with Travis CI (howto)

Hello,

I seem to be running into an issue as sysctl can't find a key for net.ipv4.tcp_rfc1337. I get a sysctl error message when trying to run os_hardening.

I am running Ubuntu 17.04 in LXC containers ( 4.13.0-36-generic #40~16.04.1-Ubuntu SMP Fri Feb 16 23:25:58 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux). Couldn't find anything online about the key not existing anymore in newer kernels.

Any pointer how to correct the above would be appreciated.

Thanks,
Danny

Thias/puppet-sysctl was last update Feb 5th 2016
The thias/puppet-sysctl module (https://github.com/thias/puppet-sysctl) has seen no update in a long time and @thias does not seem to be active any more. The duritong/puppet-sysctl module (https://github.com/duritong/puppet-sysctl) is seeming to be updated more frequently and is implemented as an type/provider. Would you accept and a pull request that changes the dependency to duritong/puppet-sysctl instead of thias/puppet-sysctl?

Change would be to the metadata.json and change
sysctl
To
sysctl::value

See https://help.github.com/articles/adding-a-license-to-a-repository/

Puppet Enterprise 2016.1 (at least, maybe before) is now resolving the actual resource and not allowing "aliases" to those resources.

This is manifesting itself in several ways. For one, as I reported before, Puppet manages /usr/local/bin, so os_hardening managing /usr/local/bin results in a duplicate resource declaration error.

As well, if you create a system user in a manifest PE will also declare a resource conflict because os_hardening tries to manage those users.

For example, in a manifest I have:

user { 'ocoe':
  ensure => present,
  uid    => 350,
}

You will receive an error message similar to this:

Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Resource Statement, Duplicate declaration: User[ocoe] is already declared in file /etc/puppetlabs/code/environments/development/modules/classify_oc/manifests/init.pp:109; cannot redeclare at /etc/puppetlabs/code/environments/development/modules/os_hardening/manifests/minimize_access.pp:63 at /etc/puppetlabs/code/environments/development/modules/os_hardening/manifests/minimize_access.pp:63:3 on node cncdxocea1001.xxx.com

I tried to work around this by declaring a custom resource type:

define os_hardening::lockdown_users {
  user { "osh_user_${title}":
    ensure   => present,
    name     => $title,
    shell    => '/usr/sbin/nologin',
    password => '*',
  }
}

And calling that from minimize_access.pp:

os_hardening::lockdown_users { $target_system_users: }

But puppet now 'helpfully' resolves osh_user_${title} to the actual user and slaps you on the wrist:

Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Resource Statement, Cannot alias User[osh_user_ocoe] to ["ocoe"] at /etc/puppetlabs/code/environments/development/modules/os_hardening/manifests/lockdown_users.pp:3; resource ["User", "ocoe"] already declared at /etc/puppetlabs/code/environments/development/modules/classify_oc/manifests/init.pp:109 at /etc/puppetlabs/code/environments/development/modules/os_hardening/manifests/lockdown_users.pp:3:3 at /etctc/puppetlabs/code/environments/development/modules/os_hardening/manifests/minimize_access.pp:63 on node cncdxocsr1001.xxx.com

I have no suggestions yet on how to handle this. Since the unique resource name 'trick' isn't working anymore, the only thing I can do is lock down the user when I create it and then add it to the ignore users array.

For the folders I think an 'ignore directory' needs to be added, similar to the ignore users.

Additionally, it appears the internal API has changed again, we get this:

ERROR puppetlabs.facter - error while resolving custom facts in /opt/puppetlabs/puppet/cache/lib/facter/retrieve_system_users.rb: uninitialized constant Puppet

Which corresponds to:

Facter.add(:retrieve_system_users) do 
  sys_users = [] 
  Puppet::Type.type('user').instances.find_all do |user|
    user_value = user.retrieve
    sys_users.push(user.name) unless user_value[user.property(:uid)].to_i > su_maxid
  end
  setcode do 
    sys_users.join(',')
  end
end

I suspect that this rabbit hole goes pretty deep.

When using os_hardening along apache

https://travis-ci.org/juju4/puppet-meta-harden-linux/jobs/432286466#L3000

             sudo -E /opt/puppetlabs/bin/puppet apply /tmp/kitchen/manifests/ --modulepath=/tmp/kitchen/modules --fileserverconfig=/tmp/kitchen/fileserver.conf     --hiera_config=/tmp/kitchen/hiera.global.yaml  -v     
)
       Info: Loading facts
       Info: Loading facts
       Info: Loading facts
       Info: Loading facts
       Info: Loading facts
       Info: Loading facts
       Info: Loading facts
       Info: Loading facts
       Warning: The function 'hiera_hash' is deprecated in favor of using 'lookup'. See https://docs.puppet.com/puppet/5.5/reference/deprecated_language.html\n   (file & line not available)
       /tmp/kitchen/modules/osquery/lib/puppet/parser/functions/sorted_json.rb:5: warning: constant ::Fixnum is deprecated
       Warning: /tmp/kitchen/modules/rsyslog/hiera.yaml: Use of 'hiera.yaml' version 4 is deprecated. It should be converted to version 5
          (file: /tmp/kitchen/modules/rsyslog/hiera.yaml)
       Warning: Defining "data_provider": "hiera" in metadata.json is deprecated.
          (file: /tmp/kitchen/modules/rsyslog/metadata.json)
       Error: Evaluation Error: Error while evaluating a Resource Statement, Duplicate declaration: User[www-data] is already declared at (file: /tmp/kitchen/modules/os_hardening/manifests/minimize_access.pp, line: 89); cannot redeclare (file: /tmp/kitchen/modules/apache/manifests/init.pp, line: 140) (file: /tmp/kitchen/modules/apache/manifests/init.pp, line: 140, column: 5) on node default-ubuntu-1804-1537750847.lxd
D      Cleaning up local sandbox in /tmp/default-ubuntu-1804-sandbox-20180924-19022-1u48kau

I'm not sure: would renaming resource and use user attributes be enough?

Any updates on when #64 will be merged?
It's a bit of a pain that each puppet run results in an error state because of this.

Hello,

I just notive that in Readme file, there is a missing requirement :
Currently there is :

Requirements

    Puppet OpenSource or Enterprise
    Module stdlib

It miss the module thias/sysctl

I can open a PR if you want.

Regards,

Right now, only these distros are setup:

• CentOS 7
• Debian 8
• Ubuntu 16.04

Goal: Test all non-commercial platforms defined in metadata.json
OpenSUSE: kitchen-puppet does not yet support this (write PR?)

Hi,

just playing a bit with your module which is great.
I like when a module manage a file it add a comment in top of it with something like :
# file managed by puppet
This doesn't cost much, but I think in some cases can be helpfull.

What do you think ?

update to newest pdk template with
pdk convert --template-url https://github.com/puppetlabs/pdk-templates

Maybe create our own pdk template?

Running OS_hardening module throws the following error,

Error: /Stage[main]/Os_hardening::Minimize_access/File[/usr/bin]: Failed to generate additional resources using 'eval_generate': Too many levels of symbolic links @ rb_file_s_stat - /usr/bin/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/lzcat

OS_hardening is at version 1.1.2 on patched Debian Jessie. I'm instantiating the module with these parameters,

class spacex_os_hardening_rules {
  class { "os_hardening":
    system_environment        => "default",
    desktop_enabled           => false,
    enable_ipv4_forwarding    => false,
    enable_ipv6_forwarding    => false,
    enable_ipv6               => false,
    arp_restricted            => true,
    extra_user_paths          => [],
    umask                     => "027",
    password_max_age          => 182,
    password_min_age          => 7,
    auth_retries              => 5,
    auth_lockout_time         => 300,
    login_timeout             => 60,
    allow_login_without_home  => true,
    passwdqc_enabled          => false,
    # passwdqc_options          => "",
    allow_change_user         => true,
    enable_module_loading     => true,
    load_modules              => [],
    enable_sysrq              => false,
    enable_core_dump          => false,
    enable_stack_protection   => true,
    # cpu_vendor                => 'intel'
    root_ttys                 => ["console","tty1","tty2","tty3","tty4","tty5","tty6","ttyS0","ttyS1"],
    # whitelist                 => [],
    # blacklist                 => [],
    # remove_from_unknown       => false,
    # dry_run_on_unknown        => false,
  }
}

Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Resource Statement, Duplicate declaration: File[/usr/local/bin] is already declared in file /etc/puppetlabs/code/environments/production/modules/os_hardening/manifests/minimize_access.pp:27; cannot redeclare at /opt/puppetlabs/puppet/modules/puppet_enterprise/manifests/symlinks.pp:31 at /opt/puppetlabs/puppet/modules/puppet_enterprise/manifests/symlinks.pp:31:5 on node mgppxblct1001.xxx.com
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run

Do we need all those skip_* ??
Should work already: dev-sec/linux-baseline#91

• Current README guidelines
• Auto-generate parameter list with puppet-strings
  • Implementation example

See dev-sec/linux-baseline#82, this are definitely the better defaults for RH systems.

Chef implementation is in dev-sec/chef-os-hardening#177

I tried running this using following command but got IPv6 disabled amongst other settings even though I had enable_ipv6 and enable_ipv6_forwarding set to true in the various files (including init.pp)

Any ideas?

puppet apply --verbose -e "include os_hardening" /root/puppet-os-hardening/manifests/init.pp
Info: Loading facts
Warning: Config file /etc/puppet/hiera.yaml not found, using Hiera defaults
Notice: Compiled catalog for bfs-dl360g7-44-xm7.bfs.openwave.com in environment production in 0.58 seconds
Info: Applying configuration version '1453729939'
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ignore_bogus_error_responses]/File[/etc/sysctl.d/net.ipv4.icmp_ignore_bogus_error_responses.conf]/ensure: defined content as '{md5}380beb39ed6bd0769c5e936b28eb6488'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ignore_bogus_error_responses]/File[/etc/sysctl.d/net.ipv4.icmp_ignore_bogus_error_responses.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.icmp_ignore_bogus_error_responses]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ignore_bogus_error_responses]/File[/etc/sysctl.d/net.ipv4.icmp_ignore_bogus_error_responses.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.icmp_ignore_bogus_error_responses]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ignore_bogus_error_responses]/Exec[sysctl-net.ipv4.icmp_ignore_bogus_error_responses]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.accept_redirects]/File[/etc/sysctl.d/net.ipv4.conf.default.accept_redirects.conf]/ensure: defined content as '{md5}16ec2ab639b0abd0d03b64cea5c8290c'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.accept_redirects]/File[/etc/sysctl.d/net.ipv4.conf.default.accept_redirects.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.default.accept_redirects]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.accept_redirects]/File[/etc/sysctl.d/net.ipv4.conf.default.accept_redirects.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.default.accept_redirects]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.accept_redirects]/Exec[sysctl-net.ipv4.conf.default.accept_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.sysrq]/File[/etc/sysctl.d/kernel.sysrq.conf]/ensure: defined content as '{md5}1a903ed9a2508adec3f27ce94d996a65'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.sysrq]/File[/etc/sysctl.d/kernel.sysrq.conf]: Scheduling refresh of Exec[sysctl-kernel.sysrq]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.sysrq]/File[/etc/sysctl.d/kernel.sysrq.conf]: Scheduling refresh of Exec[update-sysctl.conf-kernel.sysrq]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_pinfo]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_ra_pinfo.conf]/ensure: defined content as '{md5}f90c62943f9f5df8b047b180cd86af06'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_pinfo]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_ra_pinfo.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.default.accept_ra_pinfo]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_pinfo]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_ra_pinfo.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.default.accept_ra_pinfo]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_pinfo]/Exec[sysctl-net.ipv6.conf.default.accept_ra_pinfo]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_pinfo]/Exec[update-sysctl.conf-net.ipv6.conf.default.accept_ra_pinfo]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.sysrq]/Exec[update-sysctl.conf-kernel.sysrq]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.rp_filter]/File[/etc/sysctl.d/net.ipv4.conf.all.rp_filter.conf]/ensure: defined content as '{md5}7f41e4d8ddc8cbba00dab408cb71c857'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.rp_filter]/File[/etc/sysctl.d/net.ipv4.conf.all.rp_filter.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.all.rp_filter]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.rp_filter]/File[/etc/sysctl.d/net.ipv4.conf.all.rp_filter.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.all.rp_filter]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.arp_ignore]/File[/etc/sysctl.d/net.ipv4.conf.all.arp_ignore.conf]/ensure: defined content as '{md5}ecd0cc79078347de778392678ea93c16'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.arp_ignore]/File[/etc/sysctl.d/net.ipv4.conf.all.arp_ignore.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.all.arp_ignore]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.arp_ignore]/File[/etc/sysctl.d/net.ipv4.conf.all.arp_ignore.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.all.arp_ignore]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.arp_ignore]/Exec[sysctl-net.ipv4.conf.all.arp_ignore]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_rfc1337]/File[/etc/sysctl.d/net.ipv4.tcp_rfc1337.conf]/ensure: defined content as '{md5}a853f01d533e7ba66f7ccf1372f81e92'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_rfc1337]/File[/etc/sysctl.d/net.ipv4.tcp_rfc1337.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.tcp_rfc1337]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_rfc1337]/File[/etc/sysctl.d/net.ipv4.tcp_rfc1337.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.tcp_rfc1337]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ratelimit]/File[/etc/sysctl.d/net.ipv4.icmp_ratelimit.conf]/ensure: defined content as '{md5}4185d9fda8041d81d77e19a857055193'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ratelimit]/File[/etc/sysctl.d/net.ipv4.icmp_ratelimit.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.icmp_ratelimit]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ratelimit]/File[/etc/sysctl.d/net.ipv4.icmp_ratelimit.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.icmp_ratelimit]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ratelimit]/Exec[update-sysctl.conf-net.ipv4.icmp_ratelimit]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_source_route]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_source_route.conf]/ensure: defined content as '{md5}fda3ea0fb306b79d5a67be8cead9c627'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_source_route]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_source_route.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.default.accept_source_route]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_source_route]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_source_route.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.default.accept_source_route]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_source_route]/Exec[sysctl-net.ipv6.conf.default.accept_source_route]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.secure_redirects]/File[/etc/sysctl.d/net.ipv4.conf.default.secure_redirects.conf]/ensure: defined content as '{md5}7e4b2efc1507dcb5838f5d12764295df'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.secure_redirects]/File[/etc/sysctl.d/net.ipv4.conf.default.secure_redirects.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.default.secure_redirects]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.secure_redirects]/File[/etc/sysctl.d/net.ipv4.conf.default.secure_redirects.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.default.secure_redirects]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.secure_redirects]/Exec[update-sysctl.conf-net.ipv4.conf.default.secure_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_rtr_pref]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_ra_rtr_pref.conf]/ensure: defined content as '{md5}570ee97412dc5b5d14e03683ed93de5b'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_rtr_pref]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_ra_rtr_pref.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.default.accept_ra_rtr_pref]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_rtr_pref]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_ra_rtr_pref.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.default.accept_ra_rtr_pref]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_rtr_pref]/Exec[update-sysctl.conf-net.ipv6.conf.default.accept_ra_rtr_pref]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_rtr_pref]/Exec[sysctl-net.ipv6.conf.default.accept_ra_rtr_pref]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.ip_forward]/File[/etc/sysctl.d/net.ipv4.ip_forward.conf]/ensure: defined content as '{md5}871a8782d97b3e80a2324ed591f6efbb'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.ip_forward]/File[/etc/sysctl.d/net.ipv4.ip_forward.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.ip_forward]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.ip_forward]/File[/etc/sysctl.d/net.ipv4.ip_forward.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.ip_forward]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.ip_forward]/Exec[update-sysctl.conf-net.ipv4.ip_forward]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.ip_forward]/Exec[sysctl-net.ipv4.ip_forward]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.secure_redirects]/Exec[sysctl-net.ipv4.conf.default.secure_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.disable_ipv6]/File[/etc/sysctl.d/net.ipv6.conf.all.disable_ipv6.conf]/ensure: defined content as '{md5}f761f671ddbae29bccd5e9d92f106e37'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.disable_ipv6]/File[/etc/sysctl.d/net.ipv6.conf.all.disable_ipv6.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.all.disable_ipv6]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.disable_ipv6]/File[/etc/sysctl.d/net.ipv6.conf.all.disable_ipv6.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.all.disable_ipv6]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.disable_ipv6]/Exec[update-sysctl.conf-net.ipv6.conf.all.disable_ipv6]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.disable_ipv6]/Exec[sysctl-net.ipv6.conf.all.disable_ipv6]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.send_redirects]/File[/etc/sysctl.d/net.ipv4.conf.all.send_redirects.conf]/ensure: defined content as '{md5}b13c09b98a8da943e92a750e819830da'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.send_redirects]/File[/etc/sysctl.d/net.ipv4.conf.all.send_redirects.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.all.send_redirects]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.send_redirects]/File[/etc/sysctl.d/net.ipv4.conf.all.send_redirects.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.all.send_redirects]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.send_redirects]/Exec[update-sysctl.conf-net.ipv4.conf.all.send_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.send_redirects]/Exec[sysctl-net.ipv4.conf.all.send_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_defrtr]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_ra_defrtr.conf]/ensure: defined content as '{md5}09e73c1eb03e63898359aeec6c072ff7'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_defrtr]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_ra_defrtr.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.default.accept_ra_defrtr]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_defrtr]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_ra_defrtr.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.default.accept_ra_defrtr]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_defrtr]/Exec[update-sysctl.conf-net.ipv6.conf.default.accept_ra_defrtr]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_defrtr]/Exec[sysctl-net.ipv6.conf.default.accept_ra_defrtr]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.arp_ignore]/Exec[update-sysctl.conf-net.ipv4.conf.all.arp_ignore]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.shared_media]/File[/etc/sysctl.d/net.ipv4.conf.default.shared_media.conf]/ensure: defined content as '{md5}098c029398ed4b26890f4c4925635930'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.shared_media]/File[/etc/sysctl.d/net.ipv4.conf.default.shared_media.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.default.shared_media]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.shared_media]/File[/etc/sysctl.d/net.ipv4.conf.default.shared_media.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.default.shared_media]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.shared_media]/Exec[update-sysctl.conf-net.ipv4.conf.default.shared_media]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.shared_media]/Exec[sysctl-net.ipv4.conf.default.shared_media]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.accept_redirects]/File[/etc/sysctl.d/net.ipv4.conf.all.accept_redirects.conf]/ensure: defined content as '{md5}604caf8e8371cf0e27ca7bd0db4af6bb'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.accept_redirects]/File[/etc/sysctl.d/net.ipv4.conf.all.accept_redirects.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.all.accept_redirects]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.accept_redirects]/File[/etc/sysctl.d/net.ipv4.conf.all.accept_redirects.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.all.accept_redirects]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.accept_redirects]/Exec[update-sysctl.conf-net.ipv4.conf.all.accept_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.accept_source_route]/File[/etc/sysctl.d/net.ipv4.conf.all.accept_source_route.conf]/ensure: defined content as '{md5}70b61e1f916bfc9d42d442a4ded85c98'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.accept_source_route]/File[/etc/sysctl.d/net.ipv4.conf.all.accept_source_route.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.all.accept_source_route]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.accept_source_route]/File[/etc/sysctl.d/net.ipv4.conf.all.accept_source_route.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.all.accept_source_route]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.accept_source_route]/Exec[update-sysctl.conf-net.ipv4.conf.all.accept_source_route]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.accept_source_route]/Exec[sysctl-net.ipv4.conf.all.accept_source_route]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.send_redirects]/File[/etc/sysctl.d/net.ipv4.conf.default.send_redirects.conf]/ensure: defined content as '{md5}e5694a229563dcd97cdd72c6c9866a9f'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.send_redirects]/File[/etc/sysctl.d/net.ipv4.conf.default.send_redirects.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.default.send_redirects]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.send_redirects]/File[/etc/sysctl.d/net.ipv4.conf.default.send_redirects.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.default.send_redirects]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.send_redirects]/Exec[update-sysctl.conf-net.ipv4.conf.default.send_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ignore_bogus_error_responses]/Exec[update-sysctl.conf-net.ipv4.icmp_ignore_bogus_error_responses]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.max_addresses]/File[/etc/sysctl.d/net.ipv6.conf.default.max_addresses.conf]/ensure: defined content as '{md5}f55b8c3ed4233ef76463c6b3bc5e1e48'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.max_addresses]/File[/etc/sysctl.d/net.ipv6.conf.default.max_addresses.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.default.max_addresses]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.max_addresses]/File[/etc/sysctl.d/net.ipv6.conf.default.max_addresses.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.default.max_addresses]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.max_addresses]/Exec[update-sysctl.conf-net.ipv6.conf.default.max_addresses]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.accept_redirects]/Exec[sysctl-net.ipv4.conf.all.accept_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_redirects]/File[/etc/sysctl.d/net.ipv6.conf.all.accept_redirects.conf]/ensure: defined content as '{md5}5c498215d1620e1f18a79f44dbfa1235'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_redirects]/File[/etc/sysctl.d/net.ipv6.conf.all.accept_redirects.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.all.accept_redirects]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_redirects]/File[/etc/sysctl.d/net.ipv6.conf.all.accept_redirects.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.all.accept_redirects]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_redirects]/Exec[update-sysctl.conf-net.ipv6.conf.all.accept_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_redirects]/Exec[sysctl-net.ipv6.conf.all.accept_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.accept_redirects]/Exec[update-sysctl.conf-net.ipv4.conf.default.accept_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_rfc1337]/Exec[update-sysctl.conf-net.ipv4.tcp_rfc1337]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ratelimit]/Exec[sysctl-net.ipv4.icmp_ratelimit]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.send_redirects]/Exec[sysctl-net.ipv4.conf.default.send_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_echo_ignore_broadcasts]/File[/etc/sysctl.d/net.ipv4.icmp_echo_ignore_broadcasts.conf]/ensure: defined content as '{md5}7195e26f16bdc860aac6a373fd9b731e'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_echo_ignore_broadcasts]/File[/etc/sysctl.d/net.ipv4.icmp_echo_ignore_broadcasts.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.icmp_echo_ignore_broadcasts]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_echo_ignore_broadcasts]/File[/etc/sysctl.d/net.ipv4.icmp_echo_ignore_broadcasts.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.icmp_echo_ignore_broadcasts]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_echo_ignore_broadcasts]/Exec[sysctl-net.ipv4.icmp_echo_ignore_broadcasts]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.rp_filter]/Exec[sysctl-net.ipv4.conf.all.rp_filter]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_redirects]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_redirects.conf]/ensure: defined content as '{md5}594504b28e500a511553f1976c50c659'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_redirects]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_redirects.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.default.accept_redirects]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_redirects]/File[/etc/sysctl.d/net.ipv6.conf.default.accept_redirects.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.default.accept_redirects]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_redirects]/Exec[update-sysctl.conf-net.ipv6.conf.default.accept_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.sysrq]/Exec[sysctl-kernel.sysrq]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.accept_source_route]/File[/etc/sysctl.d/net.ipv4.conf.default.accept_source_route.conf]/ensure: defined content as '{md5}9846b42222457a0814e55bf937dad0a2'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.accept_source_route]/File[/etc/sysctl.d/net.ipv4.conf.default.accept_source_route.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.default.accept_source_route]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.accept_source_route]/File[/etc/sysctl.d/net.ipv4.conf.default.accept_source_route.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.default.accept_source_route]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.accept_source_route]/Exec[update-sysctl.conf-net.ipv4.conf.default.accept_source_route]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.accept_source_route]/Exec[sysctl-net.ipv4.conf.default.accept_source_route]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_redirects]/Exec[sysctl-net.ipv6.conf.default.accept_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.router_solicitations]/File[/etc/sysctl.d/net.ipv6.conf.default.router_solicitations.conf]/ensure: defined content as '{md5}55500cb7011f3a41d03bbb1d0aad9549'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.router_solicitations]/File[/etc/sysctl.d/net.ipv6.conf.default.router_solicitations.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.default.router_solicitations]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.router_solicitations]/File[/etc/sysctl.d/net.ipv6.conf.default.router_solicitations.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.default.router_solicitations]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.router_solicitations]/Exec[update-sysctl.conf-net.ipv6.conf.default.router_solicitations]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_echo_ignore_broadcasts]/Exec[update-sysctl.conf-net.ipv4.icmp_echo_ignore_broadcasts]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.router_solicitations]/Exec[sysctl-net.ipv6.conf.default.router_solicitations]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_rfc1337]/Exec[sysctl-net.ipv4.tcp_rfc1337]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.randomize_va_space]/File[/etc/sysctl.d/kernel.randomize_va_space.conf]/ensure: defined content as '{md5}8d3abb75095ab04dcceeed67be19d23c'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.randomize_va_space]/File[/etc/sysctl.d/kernel.randomize_va_space.conf]: Scheduling refresh of Exec[sysctl-kernel.randomize_va_space]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.randomize_va_space]/File[/etc/sysctl.d/kernel.randomize_va_space.conf]: Scheduling refresh of Exec[update-sysctl.conf-kernel.randomize_va_space]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.randomize_va_space]/Exec[sysctl-kernel.randomize_va_space]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.randomize_va_space]/Exec[update-sysctl.conf-kernel.randomize_va_space]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.shared_media]/File[/etc/sysctl.d/net.ipv4.conf.all.shared_media.conf]/ensure: defined content as '{md5}c4027d962c6c465d2a9a7f58585ea44c'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.shared_media]/File[/etc/sysctl.d/net.ipv4.conf.all.shared_media.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.all.shared_media]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.shared_media]/File[/etc/sysctl.d/net.ipv4.conf.all.shared_media.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.all.shared_media]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.shared_media]/Exec[update-sysctl.conf-net.ipv4.conf.all.shared_media]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.shared_media]/Exec[sysctl-net.ipv4.conf.all.shared_media]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.dad_transmits]/File[/etc/sysctl.d/net.ipv6.conf.default.dad_transmits.conf]/ensure: defined content as '{md5}366f20546ba5b31094e1e43c42f04f32'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.dad_transmits]/File[/etc/sysctl.d/net.ipv6.conf.default.dad_transmits.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.default.dad_transmits]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.dad_transmits]/File[/etc/sysctl.d/net.ipv6.conf.default.dad_transmits.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.default.dad_transmits]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.dad_transmits]/Exec[update-sysctl.conf-net.ipv6.conf.default.dad_transmits]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.dad_transmits]/Exec[sysctl-net.ipv6.conf.default.dad_transmits]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.rp_filter]/Exec[update-sysctl.conf-net.ipv4.conf.all.rp_filter]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_ra]/File[/etc/sysctl.d/net.ipv6.conf.all.accept_ra.conf]/ensure: defined content as '{md5}bafa79b072e7a4e659949f42b440a80d'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_ra]/File[/etc/sysctl.d/net.ipv6.conf.all.accept_ra.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.all.accept_ra]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_ra]/File[/etc/sysctl.d/net.ipv6.conf.all.accept_ra.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.all.accept_ra]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_ra]/Exec[sysctl-net.ipv6.conf.all.accept_ra]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_ra]/Exec[update-sysctl.conf-net.ipv6.conf.all.accept_ra]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.max_addresses]/Exec[sysctl-net.ipv6.conf.default.max_addresses]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.arp_announce]/File[/etc/sysctl.d/net.ipv4.conf.all.arp_announce.conf]/ensure: defined content as '{md5}7264d69769b84a28d2f9a529cdc2aaa1'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.arp_announce]/File[/etc/sysctl.d/net.ipv4.conf.all.arp_announce.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.all.arp_announce]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.arp_announce]/File[/etc/sysctl.d/net.ipv4.conf.all.arp_announce.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.all.arp_announce]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.arp_announce]/Exec[update-sysctl.conf-net.ipv4.conf.all.arp_announce]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.forwarding]/File[/etc/sysctl.d/net.ipv6.conf.all.forwarding.conf]/ensure: defined content as '{md5}78a627a2e6c70437e629ce36aedb22b1'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.forwarding]/File[/etc/sysctl.d/net.ipv6.conf.all.forwarding.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.all.forwarding]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.forwarding]/File[/etc/sysctl.d/net.ipv6.conf.all.forwarding.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.all.forwarding]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.forwarding]/Exec[update-sysctl.conf-net.ipv6.conf.all.forwarding]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.forwarding]/Exec[sysctl-net.ipv6.conf.all.forwarding]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ratemask]/File[/etc/sysctl.d/net.ipv4.icmp_ratemask.conf]/ensure: defined content as '{md5}782cfd85594bdfd1ea13bcb56035c3be'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ratemask]/File[/etc/sysctl.d/net.ipv4.icmp_ratemask.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.icmp_ratemask]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ratemask]/File[/etc/sysctl.d/net.ipv4.icmp_ratemask.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.icmp_ratemask]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ratemask]/Exec[sysctl-net.ipv4.icmp_ratemask]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.icmp_ratemask]/Exec[update-sysctl.conf-net.ipv4.icmp_ratemask]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.secure_redirects]/File[/etc/sysctl.d/net.ipv4.conf.all.secure_redirects.conf]/ensure: defined content as '{md5}e950dcb71eebfff44ae67b94811ad393'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.secure_redirects]/File[/etc/sysctl.d/net.ipv4.conf.all.secure_redirects.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.all.secure_redirects]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.secure_redirects]/File[/etc/sysctl.d/net.ipv4.conf.all.secure_redirects.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.all.secure_redirects]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.secure_redirects]/Exec[update-sysctl.conf-net.ipv4.conf.all.secure_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.secure_redirects]/Exec[sysctl-net.ipv4.conf.all.secure_redirects]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[fs.suid_dumpable]/File[/etc/sysctl.d/fs.suid_dumpable.conf]/ensure: defined content as '{md5}f62cd4ea250228661e2252a43d77d52e'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[fs.suid_dumpable]/File[/etc/sysctl.d/fs.suid_dumpable.conf]: Scheduling refresh of Exec[sysctl-fs.suid_dumpable]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[fs.suid_dumpable]/File[/etc/sysctl.d/fs.suid_dumpable.conf]: Scheduling refresh of Exec[update-sysctl.conf-fs.suid_dumpable]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[fs.suid_dumpable]/Exec[sysctl-fs.suid_dumpable]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[fs.suid_dumpable]/Exec[update-sysctl.conf-fs.suid_dumpable]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.all.arp_announce]/Exec[sysctl-net.ipv4.conf.all.arp_announce]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_source_route]/Exec[update-sysctl.conf-net.ipv6.conf.default.accept_source_route]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.autoconf]/File[/etc/sysctl.d/net.ipv6.conf.default.autoconf.conf]/ensure: defined content as '{md5}0db957d6a2151f6a660bd88ed74f48ed'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.autoconf]/File[/etc/sysctl.d/net.ipv6.conf.default.autoconf.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.default.autoconf]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.autoconf]/File[/etc/sysctl.d/net.ipv6.conf.default.autoconf.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.default.autoconf]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.autoconf]/Exec[update-sysctl.conf-net.ipv6.conf.default.autoconf]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.autoconf]/Exec[sysctl-net.ipv6.conf.default.autoconf]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_timestamps]/File[/etc/sysctl.d/net.ipv4.tcp_timestamps.conf]/ensure: defined content as '{md5}92c3932a409c8f490161c20b55baef94'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_timestamps]/File[/etc/sysctl.d/net.ipv4.tcp_timestamps.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.tcp_timestamps]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_timestamps]/File[/etc/sysctl.d/net.ipv4.tcp_timestamps.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.tcp_timestamps]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_timestamps]/Exec[update-sysctl.conf-net.ipv4.tcp_timestamps]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_timestamps]/Exec[sysctl-net.ipv4.tcp_timestamps]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.rp_filter]/File[/etc/sysctl.d/net.ipv4.conf.default.rp_filter.conf]/ensure: defined content as '{md5}fa638b987ed743c795d765a70f641731'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.rp_filter]/File[/etc/sysctl.d/net.ipv4.conf.default.rp_filter.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.conf.default.rp_filter]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.rp_filter]/File[/etc/sysctl.d/net.ipv4.conf.default.rp_filter.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.conf.default.rp_filter]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.rp_filter]/Exec[sysctl-net.ipv4.conf.default.rp_filter]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.rp_filter]/Exec[update-sysctl.conf-net.ipv4.conf.default.rp_filter]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_syncookies]/File[/etc/sysctl.d/net.ipv4.tcp_syncookies.conf]/ensure: defined content as '{md5}6ad40ed45dd9aef772cabde25d74cfc0'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_syncookies]/File[/etc/sysctl.d/net.ipv4.tcp_syncookies.conf]: Scheduling refresh of Exec[sysctl-net.ipv4.tcp_syncookies]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_syncookies]/File[/etc/sysctl.d/net.ipv4.tcp_syncookies.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv4.tcp_syncookies]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_syncookies]/Exec[sysctl-net.ipv4.tcp_syncookies]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.tcp_syncookies]/Exec[update-sysctl.conf-net.ipv4.tcp_syncookies]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_source_route]/File[/etc/sysctl.d/net.ipv6.conf.all.accept_source_route.conf]/ensure: defined content as '{md5}80a4851fb5e81f8ff50f20da4340f239'
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_source_route]/File[/etc/sysctl.d/net.ipv6.conf.all.accept_source_route.conf]: Scheduling refresh of Exec[sysctl-net.ipv6.conf.all.accept_source_route]
Info: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_source_route]/File[/etc/sysctl.d/net.ipv6.conf.all.accept_source_route.conf]: Scheduling refresh of Exec[update-sysctl.conf-net.ipv6.conf.all.accept_source_route]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_source_route]/Exec[update-sysctl.conf-net.ipv6.conf.all.accept_source_route]: Triggered 'refresh' from 1 events
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_source_route]/Exec[sysctl-net.ipv6.conf.all.accept_source_route]: Triggered 'refresh' from 1 events
Notice: Finished catalog run in 20.34 seconds

There's a handful of warnings looking like this:
Variable access via 'additional_user_paths' is deprecated. Use '@additional_user_paths' instead. template[/tmp/vagrant-puppet/modules-0/os_hardening/templates/login.defs.erb]:59

Fix them

I get a lot of these errors:

Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv4.conf.default.rp_filter]/ensure: change from 'absent' to 'present' failed: Could not set 'present' on ensure: no implicit conversion of Integer into String (file:/etc/puppetlabs/code/environments/ifi/modules/os_hardening/manifests/sysctl.pp, line: 78)
Error: Could not set 'present' on ensure: no implicit conversion of
Integer into String (file:/etc/puppetlabs/code/environments/ifi/modules/os_hardening/manifests/sysctl.pp, line: 111)
Error: Could not set 'present' on ensure: no implicit conversion of Integer into String (file:/etc/puppetlabs/code/environments/ifi/modules/os_hardening/manifests/sysctl.pp, line: 111)
Wrapped exception:no implicit conversion of Integer into String

even if I just use the module with default parameter values, i.e.

class { "os_hardening": }

in fact, it seems I get such an error for every instance of 'bool2num' in os_hardening/manifests/sysctl.pp, e.g. (corresponding to the error above)

line 111: sysctl { 'net.ipv4.conf.all.arp_ignore': value =>
bool2num($arp_restricted) }

I am using

• puppetserver 6.3.0-1stretch (on debian stretch)
• herculesteam-augeasproviders_sysctl (v2.3.1)

Best,
Hp

AWS or DO

I came across two different issues with symlinks (that already existed on VM images I was deploying)

• a VM image that had symlink /usr/bin/X11 targeting itself X11 -> . causing the following error:

Error: /Stage[main]/Os_hardening::Minimize_access/File[/usr/bin]: Failed to generate additional resources using 'eval_generate': Too many levels of symbolic links - /usr/bin/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/X11/cc

• a VM image that had broken symlink (target did not exist)

Error: /Stage[main]/Os_hardening::Minimize_access/File[/usr/bin]: Failed to generate additional resources using 'eval_generate': No such file or directory - /usr/bin/vmware-user-wrapper

I agree that the image itself should have this things fixed, but it might be worth considering a better approach that would deal with this type of issues in this module.

Hi,

This module(2.1.2) on the forge is missing multiple parameters if you compare it with the version from github...which also states it is version 2.1.2.
Can you guys fix the sync between both sites?

Thx in advance!

Hello,

I hope I'm not wrong, the module doesn't allow to set the default system umask. Like this :
https://www.cyberciti.biz/tips/understanding-linux-unix-umask-value-usage.html
I see that there is a default umask for newly home user directory, but this doesn't affect newly file created.

I use to modify the umask tosomething like '027 ' in /etc/profile

Is this something you plan to add ?

Regards,

The current code does not remove group-writable from /usr/local/bin or /usr/local/games, while this should be done according to the dev-sec/cis-dil-benchmark. Tested by running the cis-dil-benchmark on a fresh Debian Stretch install with this module applied.

We disable ipv6 on our SLES and OEL systems using
install ipv6 /bin/true in /etc/modprobe.d/ipv6

Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.router_solicitations]/Exec[enforce-sysctl-value-net.ipv6.conf.default.router_solicitations]/returns: /proc/sys/net/ipv6/conf/default/router_solicitations: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.default.router_solicitations=0 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.router_solicitations]/Exec[enforce-sysctl-value-net.ipv6.conf.default.router_solicitations]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.default.router_solicitations=0 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_defrtr]/Exec[enforce-sysctl-value-net.ipv6.conf.default.accept_ra_defrtr]/returns: /proc/sys/net/ipv6/conf/default/accept_ra_defrtr: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.default.accept_ra_defrtr=0 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_defrtr]/Exec[enforce-sysctl-value-net.ipv6.conf.default.accept_ra_defrtr]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.default.accept_ra_defrtr=0 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_source_route]/Exec[enforce-sysctl-value-net.ipv6.conf.all.accept_source_route]/returns: /proc/sys/net/ipv6/conf/all/accept_source_route: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.all.accept_source_route=0 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_source_route]/Exec[enforce-sysctl-value-net.ipv6.conf.all.accept_source_route]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.all.accept_source_route=0 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_redirects]/Exec[enforce-sysctl-value-net.ipv6.conf.default.accept_redirects]/returns: /proc/sys/net/ipv6/conf/default/accept_redirects: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.default.accept_redirects=0 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_redirects]/Exec[enforce-sysctl-value-net.ipv6.conf.default.accept_redirects]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.default.accept_redirects=0 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_source_route]/Exec[enforce-sysctl-value-net.ipv6.conf.default.accept_source_route]/returns: /proc/sys/net/ipv6/conf/default/accept_source_route: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.default.accept_source_route=0 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_source_route]/Exec[enforce-sysctl-value-net.ipv6.conf.default.accept_source_route]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.default.accept_source_route=0 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.max_addresses]/Exec[enforce-sysctl-value-net.ipv6.conf.default.max_addresses]/returns: /proc/sys/net/ipv6/conf/default/max_addresses: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.default.max_addresses=1 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.max_addresses]/Exec[enforce-sysctl-value-net.ipv6.conf.default.max_addresses]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.default.max_addresses=1 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.disable_ipv6]/Exec[enforce-sysctl-value-net.ipv6.conf.all.disable_ipv6]/returns: /proc/sys/net/ipv6/conf/all/disable_ipv6: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.all.disable_ipv6=1 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.disable_ipv6]/Exec[enforce-sysctl-value-net.ipv6.conf.all.disable_ipv6]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.all.disable_ipv6=1 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_rtr_pref]/Exec[enforce-sysctl-value-net.ipv6.conf.default.accept_ra_rtr_pref]/returns: /proc/sys/net/ipv6/conf/default/accept_ra_rtr_pref: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.default.accept_ra_rtr_pref=0 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_rtr_pref]/Exec[enforce-sysctl-value-net.ipv6.conf.default.accept_ra_rtr_pref]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.default.accept_ra_rtr_pref=0 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_ra]/Exec[enforce-sysctl-value-net.ipv6.conf.all.accept_ra]/returns: /proc/sys/net/ipv6/conf/all/accept_ra: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.all.accept_ra=0 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_ra]/Exec[enforce-sysctl-value-net.ipv6.conf.all.accept_ra]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.all.accept_ra=0 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.autoconf]/Exec[enforce-sysctl-value-net.ipv6.conf.default.autoconf]/returns: /proc/sys/net/ipv6/conf/default/autoconf: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.default.autoconf=0 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.autoconf]/Exec[enforce-sysctl-value-net.ipv6.conf.default.autoconf]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.default.autoconf=0 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_redirects]/Exec[enforce-sysctl-value-net.ipv6.conf.all.accept_redirects]/returns: /proc/sys/net/ipv6/conf/all/accept_redirects: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.all.accept_redirects=0 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.all.accept_redirects]/Exec[enforce-sysctl-value-net.ipv6.conf.all.accept_redirects]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.all.accept_redirects=0 returned 255 instead of one of [0]
Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_pinfo]/Exec[enforce-sysctl-value-net.ipv6.conf.default.accept_ra_pinfo]/returns: /proc/sys/net/ipv6/conf/default/accept_ra_pinfo: No such file or directory
Error: /sbin/sysctl -w net.ipv6.conf.default.accept_ra_pinfo=0 returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[net.ipv6.conf.default.accept_ra_pinfo]/Exec[enforce-sysctl-value-net.ipv6.conf.default.accept_ra_pinfo]/returns: change from notrun to 0 failed: /sbin/sysctl -w net.ipv6.conf.default.accept_ra_pinfo=0 returned 255 instead of one of [0]
^CNotice: Caught INT; exiting

Is it possible before the ipv6 configurations to check whether ipv6 is activated at all?

For example, if the /proc/net/if_inet6 file exists !

Some rules cannot be implemented in container setups (docker, lxc), e.g. kernel settings.

Only for some features of this module rspec tests are defined

Describe the bug
When I deploy this module with r10k, puppet failed to execute code on agent :
Error: /File[/opt/puppetlabs/puppet/cache/locales]: Failed to generate additional resources using 'eval_generate': Error 500 on SERVER: Server Error: Permission denied - /etc/puppetlabs/code/environments/production/modules/os_hardening/metadata.json
Looking on the server permissions are too restrictive :

$ ll /etc/puppetlabs/code/environments/production/modules/os_hardening/metadata.json
-rw-r----- 1 root root 1705 déc.  13 09:16 /etc/puppetlabs/code/environments/production/modules/os_hardening/metadata.json

The puppetserver is running under user puppet.

I have this issue with module in version 2.1.3

Regards,

Running the OS hardening code on a fresh Debian Stretch, does not fix the permissions on /etc/gshadow, which is required for CID DIL Benchmark 6.1.5 (according to dev-sec/cis-dil-benchmark).

• Travis CI
• Kitchen
• AWS or DO?

Currently the hardening is only implemented for debian and ubuntu (see pam.pp)

• CentOS, RedHat
• OpenSUSE, SLES

See also #134

Describe the bug

With non-local users, on Puppet 6 the custom fact for filtering non-local users crashes.

Expected behavior
It should be working fine, and filter out non-local users

Actual behavior

Error: Facter: error while resolving custom facts in /tmp-packer/puppet/module-0/os_hardening/lib/facter/retrieve_system_users.rb: undefined method `to_i' for :absent:symbol

OS / Environment
Ubuntu 18.04

Puppet Version
6.2.0

Notice: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.sysrq]/Exec[enforce-sysctl-value-kernel.sysrq]/returns: sysctl: cannot stat /proc/sys/kernel/sysrq: No such file or directory
Error: '/sbin/sysctl -w kernel.sysrq=0' returned 255 instead of one of [0]
Error: /Stage[main]/Os_hardening::Sysctl/Sysctl[kernel.sysrq]/Exec[enforce-sysctl-value-kernel.sysrq]/returns: change from 'notrun' to ['0'] failed: '/sbin/sysctl -w kernel.sysrq=0' returned 255 instead of one of [0]

Compare and adjust login.defs for different OS to reflect differences these systems have.

we should get on par with dev-sec/chef-os-hardening#73