Fix cis compliance stemcell issues

bosh-stemcell/spec/support/os_image_shared_examples.rb

@@ -21,11 +21,17 @@
     end
   end
 
-  context "installed by bosh_sudoers" do
+  context "installed by bosh_sudoers (CIS-5.2.2, CIS-5.2.3)" do
     describe file("/etc/sudoers") do
       it { should be_file }
       its(:content) { should match(/%bosh_sudoers ALL=\(ALL\) NOPASSWD: ALL/m) }
       its(:content) { should match "#includedir /etc/sudoers.d" }
+      its(:content) { should match(/^Defaults\s+use_pty$/) }
+      its(:content) { should match(%r{^Defaults\s+logfile=/var/log/sudo\.log$}) }
+    end
+
+    describe command("egrep -sh '!use_pty' /etc/sudoers /etc/sudoers.d/* | egrep -v '^[[:space:]]*#' --") do
+      its(:stdout) { should eq("") }
     end
   end
 
@@ -69,6 +75,17 @@
       it { should be_file }
     end
 
+    context "idle session timeout (CIS-5.4.3.2)" do
+      describe file("/etc/profile.d/01-tmout.sh") do
+        it { should be_file }
+        it { should be_mode(0o644) }
+        it { should be_owned_by("root") }
+        its(:group) { should eq("root") }
+        its(:content) { should match(/^readonly TMOUT=900$/) }
+        its(:content) { should match(/^export TMOUT$/) }
+      end
+    end
+
     describe command("grep -q .bashrc /root/.profile") do
       it("has exit status of 0") { expect(subject.exit_status).to eq 0 }
     end
@@ -229,6 +246,10 @@
       expect(sshd_config.content).to match(/^MaxAuthTries 3$/)
     end
 
+    it "sets MaxStartups to 10:30:60 (CIS-5.1.18)" do
+      expect(sshd_config.content.scan(/^[ \t]*MaxStartups\s+\S+$/).map(&:strip)).to contain_exactly("MaxStartups 10:30:60")
+    end
+
     it "sets PermitEmptyPasswords to no (stig: V-38614)" do
       expect(sshd_config.content).to match(/^PermitEmptyPasswords no$/)
     end

stemcell_builder/stages/base_ssh/apply.sh

@@ -24,6 +24,10 @@ echo 'X11Forwarding no' >> $chroot/etc/ssh/sshd_config
 sed "/^ *MaxAuthTries/d" -i $chroot/etc/ssh/sshd_config
 echo 'MaxAuthTries 3' >> $chroot/etc/ssh/sshd_config
 
+# CIS 5.1.18 - Ensure SSH MaxStartups is configured
+sed "/^[ \t]*MaxStartups/d" -i "$chroot/etc/ssh/sshd_config"
+echo 'MaxStartups 10:30:60' >> "$chroot/etc/ssh/sshd_config"
+
 sed "/^ *PermitEmptyPasswords/d" -i $chroot/etc/ssh/sshd_config
 echo 'PermitEmptyPasswords no' >> $chroot/etc/ssh/sshd_config
 

stemcell_builder/stages/bosh_sudoers/apply.sh

@@ -6,9 +6,9 @@ base_dir=$(readlink -nf $(dirname $0)/../..)
 source $base_dir/lib/prelude_apply.bash
 source $base_dir/lib/prelude_bosh.bash
 
-# setup sudoers to use includedir, and make sure we don't break anything
-cp -p $chroot/etc/sudoers $chroot/etc/sudoers.save
-echo '#includedir /etc/sudoers.d' >> $chroot/etc/sudoers
+# enable sudoers.d drop-in support (used by CIS 5.2.2/5.2.3 hardening applied via bosh_users), and make sure we don't break anything
+cp -p "$chroot/etc/sudoers" "$chroot/etc/sudoers.save"
+grep -q '#includedir /etc/sudoers.d' "$chroot/etc/sudoers" || echo '#includedir /etc/sudoers.d' >> "$chroot/etc/sudoers"
 run_in_bosh_chroot $chroot "visudo -c"
 if [ $? -ne 0 ]; then
   echo "ERROR: bad sudoers file"

stemcell_builder/stages/bosh_users/apply.sh

@@ -36,3 +36,10 @@ cp $assets_dir/ps1.sh $chroot/etc/profile.d/00-bosh-ps1
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/root/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/home/vcap/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/etc/skel/.bashrc
+
+# configure idle session shell timeout (CIS 5.4.3.2)
+cat << 'EOF' > "$chroot/etc/profile.d/01-tmout.sh"
+readonly TMOUT=900
+export TMOUT
+EOF
+chmod 0644 "$chroot/etc/profile.d/01-tmout.sh"

stemcell_builder/stages/bosh_users/assets/sudoers

@@ -4,6 +4,10 @@
 # Defaults
 
 Defaults        !lecture,tty_tickets,!fqdn
+# CIS 5.2.2
+Defaults        use_pty
+# CIS 5.2.3
+Defaults        logfile=/var/log/sudo.log
 
 # Uncomment to allow members of group sudo to not need a password
 # %sudo ALL=NOPASSWD: ALL
@@ -22,3 +26,5 @@ root    ALL=(ALL) ALL
 
 # Members of bosh_sudoers do not require password to run sudo commands
 %bosh_sudoers ALL=(ALL) NOPASSWD: ALL
+
+#includedir /etc/sudoers.d