How to configure the module: Examples and guidelines
Configuration examples are provided to help you understand how CEM is used in a production environment. Guidelines are provided to help optimize your configuration.
-
Basic configuration example
When you specify a compliance framework, CEM is configured to provide rule enforcement and configuration for that framework. For example, to enforce the Center for Internet Security (CIS) Server Level 1 benchmark for a node, you must classify the node with thecem_linux
class, set thebenchmark
parameter tocis,
and run Puppet. -
Advanced configuration example
Building on the basic configuration example, the advanced configuration example customizes the Advanced Intrusion Detection Environment (AIDE) configuration file in Hiera. -
Automatically regenerate and enforce bootloader configurations
In rare cases, it might be useful to enable automatic regeneration of the bootloader configuration, and you might want to set a bootloader password. By setting a bootloader password, you can provide an extra layer of security for your infrastructure. -
Configure DISA STIG
The US Defense Information Systems Agency (DISA) has developed Security Technical Implementation Guide (STIG) standards that are designed to secure information systems and software. -
Configure authentication rules with PAM
You can use a pluggable authentication module (PAM) to set authentication rules. To configure PAM settings, specify control values in Hiera. -
Configure system authentication with the authselect utility
Theauthselect
utility can be used to configure system authentication on a Red Hat Enterprise Linux (RHEL) host. If you installed CEM on a RHEL 8 operating system,authselect
options are available, but should be avoided in almost all cases. Theauthselect
utility is disabled by default because enablement ofauthselect
can break authentication methods, and use of the utility requires extensive configuration. -
Apply CIS Benchmarks to a new Puppet Enterprise installation
To ensure that the Compliance Enforcement Module (CEM) for Linux can enforce Center for Internet Security (CIS) Benchmarks or STIG standards after a new installation of Puppet Enterprise (PE), you must update the CEM configuration. The configuration update helps to ensure that CEM can work on a PE primary server without issues that might be caused by default log rotation rules. -
Configure custom logrotate rules
To help ensure that logs are pruned on a regular basis to conserve system space, you can specifylogrotate
rules. -
Configure sudo without a password
You can give users and user groups the ability to run some or all commands as root without a password. -
Configure user SSH keys
To use the Secure Shell (SSH) protocol for communication between computers, you must configure SSH keys. You can also configure SSH keys for individual users. -
Configure SSH permissions for users and groups
You can configure Secure Shell (SSH) protocol settings at a granular level to specify permissions for users and groups. -
Configure the firewall type
To help protect your infrastructure, CEM enforces a firewall solution,firewalld
, by default.firewalld
is zone-based software that is designed to monitor traffic and take appropriate action. To change the firewall type or specify that CEM does not manage a firewall, you can update the firewall configuration. -
Configure rules that rely on site-specific information
Some Center for Internet Security (CIS) rules require information that is specific to a customer site. You can use Puppet Bolt tasks to configure these rules. For more information about Puppet Bolt, see Welcome to Puppet Bolt.