openstack
/
charm-ceph-osd
Code Issues Proposed changes
charm-ceph-osd/hooks/charmhelpers/contrib/hardening
History
Chris Holcombe 7d42f6e060 Add support for apparmor security profiles 
Install apparmor profile for ceph-osd processes, and provide
associated configuration option to place any ceph-osd processes
into enforce, complain, or disable apparmor profile mode.

As this is the first release of this feature, default to disabled
and allow charm users to test and provide feedback for this
release.

Change-Id: I4524c587ac70de13aa3a0cb912033e6eb44b0403
 		2016-09-28 09:30:52 +01:00
..
apache Resync charmhelpers for licensing change 2016-07-06 16:29:43 +01:00
audits Resync charmhelpers for licensing change 2016-07-06 16:29:43 +01:00
defaults Add hardening support 2016-03-24 11:14:47 +00:00
host Resync charmhelpers for licensing change 2016-07-06 16:29:43 +01:00
mysql Resync charmhelpers for licensing change 2016-07-06 16:29:43 +01:00
ssh Add support for apparmor security profiles 2016-09-28 09:30:52 +01:00
README.hardening.md Add hardening support 2016-03-24 11:14:47 +00:00
__init__.py Resync charmhelpers for licensing change 2016-07-06 16:29:43 +01:00
harden.py Resync charmhelpers for licensing change 2016-07-06 16:29:43 +01:00
templating.py Resync charmhelpers for licensing change 2016-07-06 16:29:43 +01:00
utils.py Resync charmhelpers for licensing change 2016-07-06 16:29:43 +01:00

README.hardening.md

Juju charm-helpers hardening library

Description

This library provides multiple implementations of system and application hardening that conform to the standards of http://hardening.io/.

Current implementations include:

  • OS
  • SSH
  • MySQL
  • Apache

Requirements

  • Juju Charms

Usage

  1. Synchronise this library into your charm and add the harden() decorator (from contrib.hardening.harden) to any functions or methods you want to use to trigger hardening of your application/system.

  2. Add a config option called 'harden' to your charm config.yaml and set it to a space-delimited list of hardening modules you want to run e.g. "os ssh"

  3. Override any config defaults (contrib.hardening.defaults) by adding a file called hardening.yaml to your charm root containing the name(s) of the modules whose settings you want override at root level and then any settings with overrides e.g.

    os: general: desktop_enable: True

  4. Now just run your charm as usual and hardening will be applied each time the hook runs.