Amazon Linux 2 score is always 50, with or without hardening in place #270
Comments
|
The output of [50/100] does not show the amount of checks passed but the score achieved. |
|
While thinking about this, I think we want to improve the CLI output to show both the amount of passed checks and the achieved asset score. |
|
Mmm but still though, why having non hardening or having hardening, achieve exactly the same score? I would expect that if some hardening is in place, the achieved score has improved, not keep the same |
|
I am going to have a detailed look. Can you provide the hardening that you applied? |
|
Every hardening measure applied, was taken from the remediations defined in the cnspec-core policies, these defined here: https://github.com/mondoohq/cnspec-policies/blob/main/core/mondoo-linux-security.mql.yaml The remediations applied are the next ones, keep in mind that I am actually wrapping them inside a script, but these is what's being added/executed: For auditd for example these are (these is the total, they are separated into files): For sysctl: For rsyslog (dropped under /etc/rsyslog.d): For sudo (dropped under /etc/sudoers.d): And /etc/ssh/sshd_config |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
I'm building an Amazon Linux 2, after the scan kicks in and some policies are flagged as Fail/Pass, the scan is always scored as 50. This happens regardless of whether hardening policies are in place (they are being shown as Pass by the scan), or if no extra hardening is in place. No matter what's done, the score is always 50.
This has happened either by using the latest v11.7.3, v11.5.0, or v10.9.2 (I haven't tried with other versions). The version of Packer I am using is v1.11.0, and the version of the Amazon provider is amazon-ebs v1.3.2.
To Reproduce
Steps to reproduce the behavior:
If this code from the examples https://github.com/mondoohq/packer-plugin-cnspec/blob/main/examples/aws/amazon-linux-2.pkr.hcl is used, the parameter score_threshold added (set to 50 and then to 80 for example), and a build attempt is executed with both one with hardening in place and one without, the score should always be 50.
Expected behavior
Correct behavior should be, if the image has been hardened the score should reflect such a thing. An image with multiple Pass should score higher than one with multiple Fails.
Screenshots or CLI Output
Here's a CLI output generating an image without any hardening measure in place (49 Fail):
and here, it's an output with some hardening in place (notice most of the scoring is a Pass, only 11 are a Fail) and despite this, the final score remains unchanged):
Desktop (please complete the following information):
Additional context
The same behavior happens either by running Packer locally in my machine or by running from this Docker container: https://hub.docker.com/r/hashicorp/packer.
The text was updated successfully, but these errors were encountered: