Merge lp:~vds/charm-helpers/Support_MTOUT into lp:charm-helpers

[Vincenzo Di Somma]

Setting default timeout for ssh sessions.

[Ryan Beisner (1chb1n)]

review: Approve

[Ryan Beisner (1chb1n)]

review: Needs Information

[Ryan Beisner (1chb1n)]

Apologies, I had too many LP reviews open; didn't intend to approve this just yet.

[Ryan Beisner (1chb1n)]

@vds - is there a LP BUG that you can link and reference here? That will help provide context to these proposed changes. Thank you.

[Ante Karamatić (ivoks)]

This commit is one of few recent commits to charm-helpers, which are implementing some common principles in security hardening. They are based on security reviews from existing deployments.

review: Approve

[Ryan Beisner (1chb1n)]

Ack - are we intending for this to be backported to stable charms, or will this go out with the next release by normal process (17.05)?

[Ante Karamatić (ivoks)]

Yes, backporting will be needed, I'm afraid.

On Tue, Mar 21, 2017 at 3:14 PM Ryan Beisner <email address hidden>
wrote:

> Ack - are we intending for this to be backported to stable charms, or will
> this go out with the next release by normal process (17.05)?
> --
> https://code.launchpad.net/~vds/charm-helpers/Support_MTOUT/+merge/320391
> You are reviewing the proposed merge of
> lp:~vds/charm-helpers/Support_MTOUT into lp:charm-helpers.
>
--
Ante Karamatić
<email address hidden>
Canonical

[Ryan Beisner (1chb1n)]

Ok, that should be doable. In that case I'd like to see us start the process out with an LP bug to track it all the way through. It will be a hard requirement for a stable backport anyway. Thanks!

[Edward Hope-Morley (hopem)]

This looks mostly good apart from one thing; you need to extend the ProfileContext class to be able to be able to extract tmout.

review: Needs Fixing

[lp:~vds/charm-helpers/Support_MTOUT]

727. By Vincenzo Di Somma on 2017-03-23

Added ssh_tmout to profile context.

[Edward Hope-Morley (hopem)]

Please run make test before pushing changes:

$ make test
Checking for Python syntax...
charmhelpers/contrib/hardening/host/checks/profile.py:48:18: E127 continuation line over-indented for visual indent
Makefile:70: recipe for target 'lint' failed
make: *** [lint] Error 1

If the rest of the review of ok I will fix this inline before merging.

[Edward Hope-Morley (hopem)]

Ok lgtm. Please add a better commit message next though.

review: Approve

=== modified file 'charmhelpers/contrib/hardening/defaults/os.yaml'
--- charmhelpers/contrib/hardening/defaults/os.yaml	2016-03-14 13:57:17 +0000
+++ charmhelpers/contrib/hardening/defaults/os.yaml	2017-03-23 08:41:57 +0000
@@ -58,6 +58,7 @@
         rsync
     kernel_enable_module_loading: True  # (type:boolean)
     kernel_enable_core_dump: False  # (type:boolean)
+    ssh_tmout: 300
 
 sysctl:
     kernel_secure_sysrq: 244  # 4 + 16 + 32 + 64 + 128

=== modified file 'charmhelpers/contrib/hardening/defaults/os.yaml.schema'
--- charmhelpers/contrib/hardening/defaults/os.yaml.schema	2016-03-14 13:57:17 +0000
+++ charmhelpers/contrib/hardening/defaults/os.yaml.schema	2017-03-23 08:41:57 +0000
@@ -34,6 +34,7 @@
     packages_list:
     kernel_enable_module_loading:
     kernel_enable_core_dump:
+    ssh_tmout:
 sysctl:
     kernel_secure_sysrq:
     kernel_enable_sysrq:

=== modified file 'charmhelpers/contrib/hardening/host/checks/profile.py'
--- charmhelpers/contrib/hardening/host/checks/profile.py	2016-07-06 14:41:05 +0000
+++ charmhelpers/contrib/hardening/host/checks/profile.py	2017-03-23 08:41:57 +0000
@@ -25,7 +25,6 @@
     audits = []
 
     settings = utils.get_settings('os')
-
     # If core dumps are not enabled, then don't allow core dumps to be
     # created as they may contain sensitive information.
     if not settings['security']['kernel_enable_core_dump']:
@@ -33,11 +32,18 @@
                                     ProfileContext(),
                                     template_dir=TEMPLATES_DIR,
                                     mode=0o0755, user='root', group='root'))
+    if settings['security']['ssh_tmout']:
+        audits.append(TemplatedFile('/etc/profile.d/99-hardening.sh',
+                                    ProfileContext(),
+                                    template_dir=TEMPLATES_DIR,
+                                    mode=0o0644, user='root', group='root'))
     return audits
 
 
 class ProfileContext(object):
 
     def __call__(self):
-        ctxt = {}
+        settings = utils.get_settings('os')
+        ctxt = {'ssh_tmout':
+                 settings['security']['ssh_tmout']}
         return ctxt

=== added file 'charmhelpers/contrib/hardening/host/templates/99-hardening.sh'
--- charmhelpers/contrib/hardening/host/templates/99-hardening.sh	1970-01-01 00:00:00 +0000
+++ charmhelpers/contrib/hardening/host/templates/99-hardening.sh	2017-03-23 08:41:57 +0000
@@ -0,0 +1,5 @@
+TMOUT={{ tmout }}
+readonly TMOUT
+export TMOUT
+
+readonly HISTFILE

=== modified file 'tests/contrib/hardening/host/checks/test_profile.py'
--- tests/contrib/hardening/host/checks/test_profile.py	2016-07-06 14:41:05 +0000
+++ tests/contrib/hardening/host/checks/test_profile.py	2017-03-23 08:41:57 +0000
@@ -22,15 +22,29 @@
 class ProfileTestCase(TestCase):
 
     @patch.object(profile.utils, 'get_settings', lambda x:
-                  {'security': {'kernel_enable_core_dump': False}})
+                  {'security': {'kernel_enable_core_dump': False, 'ssh_tmout': False}})
     def test_core_dump_disabled(self):
         audits = profile.get_audits()
         self.assertEqual(1, len(audits))
         self.assertTrue(isinstance(audits[0], profile.TemplatedFile))
 
     @patch.object(profile.utils, 'get_settings', lambda x: {
-        'security': {'kernel_enable_core_dump': True}
+        'security': {'kernel_enable_core_dump': True, 'ssh_tmout': False}
     })
     def test_core_dump_enabled(self):
         audits = profile.get_audits()
         self.assertEqual(0, len(audits))
+
+    @patch.object(profile.utils, 'get_settings', lambda x:
+                  {'security': {'kernel_enable_core_dump': True, 'ssh_tmout': False}})
+    def test_ssh_tmout_disabled(self):
+        audits = profile.get_audits()
+        self.assertEqual(0, len(audits))
+
+    @patch.object(profile.utils, 'get_settings', lambda x: {
+        'security': {'kernel_enable_core_dump': True, 'ssh_tmout': 300}
+    })
+    def test_ssh_tmout_enabled(self):
+        audits = profile.get_audits()
+        self.assertEqual(1, len(audits))
+        self.assertTrue(isinstance(audits[0], profile.TemplatedFile))