tomrgio

file '/etc/issue.net' do 
  content 'SUPER SECURE BANNER' 
end

node.default['ssh-hardening']['ssh']['server']['banner'] = '/etc/issue.net'
node.default['ssh-hardening']['ssh']['server']['challenge_response_authentication'] = true
node.default['ssh-hardening']['ssh']['server']['password_authentication'] = true 

include_recipe 'ssh-hardening'

tomrgio

# encoding: utf-8 
describe sshd_config do 
  its('Banner') { should eq '/etc/issue.net' }   
  its('ChallengeResponseAuthentication') { should eq 'yes' }
  its('PasswordAuthentication') { should eq 'yes' } 
end 

describe file('/etc/issue.net') do 
  its('content') { should match /SUPER SECURE BANNER/ } 
end

tomrgio

depends: 
 - name: ssh-baseline 
   url: https://github.com/dev-sec/ssh-baseline/archive/master.tar.gz

tomrgio

node.default['ssh-hardening']['ssh']['server']['banner'] = '/etc/issue.net'
node.default['ssh-hardening']['ssh']['server']['challenge_response_authentication'] = true
node.default['ssh-hardening']['ssh']['server']['password_authentication'] = true 

include_recipe 'ssh-hardening'

tomrgio

# encoding: utf-8 
describe sshd_config do 
	its('Banner') { should eq '/etc/issue.net' }   
	its('ChallengeResponseAuthentication') { should eq 'yes' }
	its('PasswordAuthentication') { should eq 'yes' } 
end 

describe file('/etc/issue.net') do 
	its('content') { should match /SUPER SECURE BANNER/ } 
end

tomrgio

---
 driver:
   name: vagrant

 provisioner:
   name: chef_zero
   # You may wish to disable always updating cookbooks in CI or other testing environments.
   # For example:
   #   always_update_cookbooks: <%= !ENV['CI'] %>
   always_update_cookbooks: true

tomrgio

# encoding: utf-8 
include_controls 'ssh-baseline' do 
  skip_control 'sshd-27'
  skip_control 'sshd-29' 
  skip_control 'sshd-46' 
end

control 'mycorp-sshd-27' do 
  impact 1.0 
  title 'Server: Enable password based authentication'

tomrgio

all_web_nodes = search('node', 'role:web')

members = []

all_web_nodes.each do |web_node|
  member = {
    'address' => web_node['cloud']['public_hostname'],
    'weight' => 100,
    'port' => 80,
    'ssl_port' => 80