Skip to content

Cis harden script with increased controls. #545

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sumitmishra-spectro wants to merge 18 commits into
base: main
Choose a base branch
from
Open

Cis harden script with increased controls. #545

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
d5b973e
new cis harden script using usg
Jan 21, 2026
592f637
using USG generated script for CIS harden
Feb 5, 2026
98fe756
Update CIS hardening script for Level 2 compliance (ISO build compati…
Feb 5, 2026
a7d371a
Add additional CIS controls from STIG analysis
Feb 5, 2026
fb11498
Fix: Install AIDE without recommends to avoid postfix dependency
Feb 5, 2026
c70a289
Fix: Add DEBIAN_FRONTEND=noninteractive for apt commands
Feb 5, 2026
f54927c
Add CIS compliance improvements
Feb 5, 2026
613b709
fixed conflicts with RHEL and CentOS versions
Feb 6, 2026
74a82dd
docs: Add CIS_HARDENING parameter to README
Feb 6, 2026
5cd80f6
feat: Add Ubuntu 20.04 compatibility for CIS hardening
Feb 6, 2026
17fe9d0
updating branch from main. (#544)
sumitmishra-spectro Feb 8, 2026
962bec7
refactor: Scope CIS hardening changes to Ubuntu only
Feb 9, 2026
80f8476
revert header
Feb 9, 2026
edab727
revert header
Feb 9, 2026
2650798
revert header
Feb 9, 2026
65750ae
fix systax error
Feb 9, 2026
b977487
updating branch from master (#547)
sumitmishra-spectro Feb 9, 2026
1aa99b6
enable audit log rotation
Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion Earthfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,8 @@ ARG TARGETARCH

# Default image repositories used in the builds.
ARG SPECTRO_PUB_REPO=us-docker.pkg.dev/palette-images
ARG SPECTRO_THIRD_PARTY_IMAGE=us-east1-docker.pkg.dev/spectro-images/third-party/spectro-third-party:4.6
ARG BUILDER_3RDPARTY_VERSION=4.8
ARG SPECTRO_THIRD_PARTY_IMAGE=us-docker.pkg.dev/palette-images/third-party/spectro-third-party:$BUILDER_3RDPARTY_VERSION
ARG ALPINE_TAG=3.20
ARG ALPINE_IMG=$SPECTRO_PUB_REPO/edge/canvos/alpine:$ALPINE_TAG
FROM $ALPINE_IMG
Expand Down
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,8 +236,9 @@ cp .arg.template .arg
| HTTPS_PROXY | URL of the HTTPS Proxy server to be used if needed (Optional) | string | |
| NO_PROXY | URLS that should be excluded from proxying (Optional) | string | |
| UPDATE_KERNEL | Determines whether to upgrade the Kernel version to the latest from the upstream OS provider | boolean | `false` |
| DISABLE_SELINUX | Disable selinux in the operating system. Some applications (like Kubevirt) do not like selinux | boolean | `true` |
| CLUSTERCONFIG | Path of the cluster config | string | |
| DISABLE_SELINUX | Disable selinux in the operating system. Some applications (like Kubevirt) do not like selinux | boolean | `true` |
| CIS_HARDENING | Enable CIS Benchmark hardening for the image. When set to `true`, applies CIS Benchmark security controls during the build. | boolean | `false` |
| CLUSTERCONFIG | Path of the cluster config | string | |
| IS_UKI | Build UKI(Trusted boot) images | boolean | `false` |
| UKI_BRING_YOUR_OWN_KEYS | Bring your own public/private key pairs if this is set to true. Otherwise, CanvOS will generate the key pair. | boolean | `false` |
| INCLUDE_MS_SECUREBOOT_KEYS | Include Microsoft 3rd Party UEFI CA certificate in generated keys | boolean | `true` |
Expand Down
Loading