Skip to content

Commit 5e6cd42

Browse files
arlimusarlimus
committed
Merge pull request #5 from ehaselwanter/fix-to-meet-new-testing-requirements
fix puppet hardening to pass all requirements (this requires the latest tests-apache too)
2 parents d2f0063 + 389949e commit 5e6cd42

File tree

7 files changed

+144
-8
lines changed

7 files changed

+144
-8
lines changed

‎.kitchen.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,10 @@ platforms:
2121
driver_config:
2222
box: opscode-centos-6.5
2323
box_url: http://opscode-vm-bento.s3.amazonaws.com/vagrant/virtualbox/opscode_centos-6.5_chef-provisionerless.box
24-
- name: oracle-6.4
25-
driver_config:
26-
box: oracle-6.4
27-
box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel64-64.box
24+
# - name: oracle-6.4
25+
# driver_config:
26+
# box: oracle-6.4
27+
# box_url: https://storage.us2.oraclecloud.com/v1/istoilis-istoilis/vagrant/oel64-64.box
2828
- name: oracle-6.5
2929
driver_config:
3030
box: oracle-6.5

‎Gemfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ end
2525
group :integration do
2626
gem 'test-kitchen'
2727
gem 'kitchen-vagrant'
28-
gem 'kitchen-puppet', '= 0.0.11'
28+
gem 'kitchen-puppet'
2929
gem 'librarian-puppet'
3030
gem 'kitchen-sharedtests', '~> 0.2.0'
3131
end

‎manifests/puppetlabs.pp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
$apache_version = $apache::apache_version
3131
$confd_dir = $apache::confd_dir
3232
$conf_dir = $apache::conf_dir
33+
$mod_dir = $apache::mod_dir
3334

3435
file { "${confd_dir}/90.hardening.conf":
3536
ensure => file,
@@ -50,4 +51,10 @@
5051
path => ['/bin','/usr/bin', '/usr/sbin'],
5152
unless => "find ${conf_dir} -perm -o+r -type f -o -perm -o+w -type f | wc -l | egrep '^0$'"
5253
}
54+
55+
File['alias.conf'] {
56+
content => template('apache_hardening/mod/alias.conf.erb'),
57+
mode => '0640',
58+
}
59+
5360
}

‎manifests/puppetlabs_override.pp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@
1717

1818
$server_signature = 'Off',
1919
$server_tokens = 'Prod',
20-
$trace_enable = 'Off'
20+
$trace_enable = 'Off',
2121

2222
) inherits ::apache {
2323

2424
File["${::apache::conf_dir}/${::apache::params::conf_file}"]{
25-
content => template($::apache::params::conf_template),
25+
content => template('apache_hardening/httpd.conf.erb'),
2626
mode => '0640',
2727
}
2828
}

‎metadata.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"name": "hardening/apache_hardening",
2+
"name": "hardening-apache_hardening",
33
"version": "0.1.0",
44
"source": "https://github.com/TelekomLabs/puppet-apache-hardening",
55
"author": "Markus Schmall",

‎templates/httpd.conf.erb‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# Security
2+
ServerTokens <%= @server_tokens %>
3+
ServerSignature <%= @server_signature %>
4+
TraceEnable <%= @trace_enable %>
5+
6+
ServerName "<%= @servername %>"
7+
ServerRoot "<%= @server_root %>"
8+
PidFile <%= @pidfile %>
9+
Timeout <%= @timeout %>
10+
KeepAlive <%= @keepalive %>
11+
MaxKeepAliveRequests <%= @max_keepalive_requests %>
12+
KeepAliveTimeout <%= @keepalive_timeout %>
13+
14+
User <%= @user %>
15+
Group <%= @group %>
16+
17+
AccessFileName .htaccess
18+
<FilesMatch "^\.ht">
19+
<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%>
20+
Require all denied
21+
<%- else -%>
22+
Order allow,deny
23+
Deny from all
24+
Satisfy all
25+
<%- end -%>
26+
</FilesMatch>
27+
28+
<Directory />
29+
Options -Indexes -FollowSymLinks
30+
AllowOverride None
31+
</Directory>
32+
33+
DefaultType none
34+
HostnameLookups Off
35+
ErrorLog "<%= @logroot %>/<%= @error_log %>"
36+
LogLevel <%= @log_level %>
37+
EnableSendfile <%= @sendfile %>
38+
<%- if @allow_encoded_slashes -%>
39+
AllowEncodedSlashes <%= @allow_encoded_slashes %>
40+
<%- end -%>
41+
42+
#Listen 80
43+
44+
<% if @apxs_workaround -%>
45+
# Workaround: without this hack apxs would be confused about where to put
46+
# LoadModule directives and fail entire procedure of apache package
47+
# installation/reinstallation. This problem was observed on FreeBSD (apache22).
48+
#LoadModule fake_module libexec/apache22/mod_fake.so
49+
<% end -%>
50+
51+
Include "<%= @mod_load_dir %>/*.load"
52+
<% if @mod_load_dir != @confd_dir and @mod_load_dir != @vhost_load_dir -%>
53+
Include "<%= @mod_load_dir %>/*.conf"
54+
<% end -%>
55+
Include "<%= @ports_file %>"
56+
57+
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
58+
LogFormat "%h %l %u %t \"%r\" %>s %b" common
59+
LogFormat "%{Referer}i -> %U" referer
60+
LogFormat "%{User-agent}i" agent
61+
<% if @log_formats and !@log_formats.empty? -%>
62+
<%- @log_formats.sort.each do |nickname,format| -%>
63+
LogFormat "<%= format -%>" <%= nickname %>
64+
<%- end -%>
65+
<% end -%>
66+
67+
<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%>
68+
IncludeOptional "<%= @confd_dir %>/*.conf"
69+
<%- else -%>
70+
Include "<%= @confd_dir %>/*.conf"
71+
<%- end -%>
72+
<% if @vhost_load_dir != @confd_dir -%>
73+
<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%>
74+
IncludeOptional "<%= @vhost_load_dir %>/*"
75+
<%- else -%>
76+
Include "<%= @vhost_load_dir %>/*"
77+
<%- end -%>
78+
<% end -%>
79+
80+
<% if @error_documents -%>
81+
# /usr/share/apache2/error on debian
82+
Alias /error/ "<%= @error_documents_path %>/"
83+
84+
<Directory "<%= @error_documents_path %>">
85+
AllowOverride None
86+
Options IncludesNoExec
87+
AddOutputFilter Includes html
88+
AddHandler type-map var
89+
<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%>
90+
Require all granted
91+
<%- else -%>
92+
Order allow,deny
93+
Allow from all
94+
<%- end -%>
95+
LanguagePriority en cs de es fr it nl sv pt-br ro
96+
ForceLanguagePriority Prefer Fallback
97+
</Directory>
98+
99+
ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var
100+
ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var
101+
ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var
102+
ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var
103+
ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var
104+
ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var
105+
ErrorDocument 410 /error/HTTP_GONE.html.var
106+
ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var
107+
ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var
108+
ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
109+
ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var
110+
ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
111+
ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var
112+
ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var
113+
ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var
114+
ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var
115+
ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var
116+
<% end -%>

‎templates/mod/alias.conf.erb‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<IfModule alias_module>
2+
Alias /icons/ "<%= @icons_path %>/"
3+
<Directory "<%= @icons_path %>">
4+
Options -Indexes +MultiViews -FollowSymLinks
5+
AllowOverride None
6+
<%- if scope.function_versioncmp([@apache_version, '2.4']) >= 0 -%>
7+
Require all granted
8+
<%- else -%>
9+
Order allow,deny
10+
Allow from all
11+
<%- end -%>
12+
</Directory>
13+
</IfModule>

0 commit comments

Comments
 (0)