How to configure the module: Examples and guidelines
Configuration examples are provided to help you understand how CEM is used in a production environment. Guidelines are provided to help optimize your configuration.
-
Basic configuration example
When you specify a compliance framework, CEM is configured to provide rule enforcement and configuration for that framework. For example, to enforce the Center for Internet Security (CIS) Server Level 1 benchmark for a node, you must classify the node with thecem_linux
class, set thebenchmark
parameter tocis,
and run Puppet. -
Advanced configuration example
Building on the basic configuration example, the advanced configuration example customizes the Advanced Intrusion Detection Environment (AIDE) configuration file in Hiera. -
Automatically regenerate and enforce bootloader configurations
In rare cases, it might be useful to enable automatic regeneration of the bootloader configuration, and you might want to set a bootloader password. By setting a bootloader password, you can provide an extra layer of security for your infrastructure. -
Configure DISA STIG
The US Defense Information Systems Agency (DISA) has developed Security Technical Implementation Guide (STIG) standards that are designed to secure information systems and software. -
Apply CIS Benchmarks to a new Puppet Enterprise installation
To ensure that the Compliance Enforcement Module (CEM) for Linux can enforce Center for Internet Security (CIS) Benchmarks after a new installation of Puppet Enterprise (PE), you must update the CEM configuration. -
Configure custom logrotate rules
To help ensure that logs are pruned on a regular basis to conserve system space, you can specifylogrotate
rules. -
Configure sudo without a password
You can give users and user groups the ability to run some or all commands as root without a password. -
Configure user SSH keys
To use the Secure Shell (SSH) protocol for communication between computers, you must configure SSH keys. You can also configure SSH keys for individual users. -
Configure SSH permissions for users and groups
You can configure Secure Shell (SSH) protocol settings at a granular level to specify permissions for users and groups. -
Configure the firewall type
To help protect your infrastructure, CEM enforces a firewall solution,firewalld
, by default.firewalld
is zone-based software that is designed to monitor traffic and take appropriate action. To change the firewall type or specify that CEM does not manage a firewall, you can update the firewall configuration. -
Configure rules that rely on site-specific information
Some Center for Internet Security (CIS) rules require information that is specific to a customer site. You can use Bolt tasks to configure these rules.