|
| 1 | +# |
| 2 | +class example_manifest_with_multiple_lint_errors |
| 3 | +{ |
| 4 | + |
| 5 | + # -------------------------------------------------------------------- |
| 6 | + # Set cipher suites order as secure as possible (Enables Perfect Forward Secrecy) |
| 7 | + # Remediation list per CIS IIS 8 Benchmark v1.4.0 - 08-24-2015 (minus 3DES) |
| 8 | + # Removed DHE per ITSec on 4/6/16 |
| 9 | + # TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 |
| 10 | + # -------------------------------------------------------------------- |
| 11 | + $cipherSuitesOrder = "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256, \ |
| 12 | + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256, \ |
| 13 | + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256, \ |
| 14 | + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256, \ |
| 15 | + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P384, \ |
| 16 | + TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256_P256" |
| 17 | + |
| 18 | + registry::value { 'Cipher Suites': |
| 19 | + key => 'HKLM\\SOFTWARE\\Policies\\Microsoft\\Cryptography\\Configuration\\SSL\\00010002', |
| 20 | + type => string, |
| 21 | + value => 'Functions', |
| 22 | + data => $cipherSuitesOrder, |
| 23 | + } |
| 24 | + |
| 25 | + # -------------------------------------------------------------------- |
| 26 | + # Disable IP Source Routing - Microsoft Security Bulletin MS06-032 |
| 27 | + # -------------------------------------------------------------------- |
| 28 | + registry::value { 'DisableIPSourceRouting0': |
| 29 | + key => 'HKLM\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters', |
| 30 | + type => 'dword', |
| 31 | + value => 'DisableIPSourceRouting', |
| 32 | + data => 2, |
| 33 | + } |
| 34 | + |
| 35 | + # -------------------------------------------------------------------- |
| 36 | + # Disable IPv6 Source Routing - Microsoft Security Bulletin MS06-032 |
| 37 | + # -------------------------------------------------------------------- |
| 38 | + registry_value { 'HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\DisableIPSourceRouting': |
| 39 | + ensure => present, |
| 40 | + type => dword, |
| 41 | + data => 2, |
| 42 | + notify => Reboot['after_run'], |
| 43 | + } |
| 44 | + |
| 45 | + #Reboot Computer |
| 46 | + reboot { 'after_run': |
| 47 | + apply => finished, |
| 48 | + } |
| 49 | + |
| 50 | +} |
0 commit comments