Skip to content

Commit e403844

Browse files
ssokolicssokolic
authored
Merge pull request #21 from xoap-io/dev
Feat: added STIG August 2023 configurations
2 parents 96e3d44 + c33b120 commit e403844

File tree

183 files changed

+31822
-6378
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

183 files changed

+31822
-6378
lines changed

‎.github/workflows/commit-message-validator.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ jobs:
66
commitlint:
77
runs-on: ubuntu-latest
88
steps:
9-
- uses: actions/checkout@v3
9+
- uses: actions/checkout@v4
1010
with:
1111
fetch-depth: 0
1212
- uses: wagoid/commitlint-github-action@v5

‎.github/workflows/dependabot.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
steps:
1212
- name: Dependabot metadata
1313
id: dependabot-metadata
14-
uses: dependabot/fetch-metadata@v1.4.0
14+
uses: dependabot/fetch-metadata@v1.6.0
1515
with:
1616
github-token: ${{ secrets.GITHUB_TOKEN }}
1717
- name: Approve a PR

‎.github/workflows/megalinter.yaml

+1-17
Original file line numberDiff line numberDiff line change
@@ -12,23 +12,7 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Checkout Code
15-
uses: actions/checkout@v3
15+
uses: actions/checkout@v4
1616
with:
1717
token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
1818
fetch-depth: 0
19-
- name: MegaLinter
20-
id: ml
21-
uses: megalinter/megalinter/flavors/terraform@v6
22-
env:
23-
VALIDATE_ALL_CODEBASE: true
24-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
25-
DISABLE: COPYPASTE,SPELL
26-
DISABLE_LINTERS: TERRAFORM_TERRASCAN
27-
- name: Archive production artifacts
28-
if: ${{ success() }} || ${{ failure() }}
29-
uses: actions/upload-artifact@v3
30-
with:
31-
name: MegaLinter reports
32-
path: |
33-
report
34-
mega-linter.log

‎.github/workflows/tagging.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Checkout
15-
uses: actions/checkout@v3
15+
uses: actions/checkout@v4
1616
with:
1717
token: ${{ secrets.PAT || secrets.GITHUB_TOKEN }}
1818
fetch-depth: 0

‎.idea/misc.xml

-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎README.md

+22-16
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,15 @@ Please check the links for more info, including usage information and full docum
2828
- [Twitter](https://twitter.com/xoap_io)
2929
- [LinkedIn](https://www.linkedin.com/company/xoap_io)
3030

31+
This repository hosts some of the most common DSC configurations that we use in our projects.
32+
33+
You will find the following DSC configurations in this repository:
34+
35+
- Citrix infrastructure and Citrix optimizer configurations
36+
- DoD STIG configurations
37+
- general Windows configurations
38+
- Microsoft security baseline configurations
39+
3140
---
3241

3342
## Disclaimer
@@ -36,7 +45,7 @@ Please check the links for more info, including usage information and full docum
3645

3746
Be sure to always test any of those configurations in separated test environment and test clients and servers.
3847

39-
>Some of the available DSC configurations make severe changes to security-related configurations and could leave your Windows operating system in an unusable state.
48+
> Some of the available DSC configurations make severe changes to security-related configurations and could leave your Windows operating system in an unusable state.
4049
4150
So please test once, twice or trice.
4251

@@ -116,15 +125,13 @@ You can download it [here](https://www.microsoft.com/en-us/download/details.aspx
116125

117126
A typical DSC configuration looks like this:
118127

119-
```
120-
Configuration MSTF_SecurityBaseline_Edge_v107_Computer
128+
```PowerShell
129+
Configuration 'MSTF_SecurityBaseline_Edge_v107_Computer'
121130
{
122131
123132
Import-DSCResource -ModuleName 'GPRegistryPolicyDsc' -ModuleVersion '1.2.0'
124-
Import-DSCResource -ModuleName 'AuditPolicyDSC' -ModuleVersion '1.4.0.0'
125-
Import-DSCResource -ModuleName 'SecurityPolicyDSC' -ModuleVersion '2.10.0.0'
126133
127-
Node MSTF_SecurityBaseline_Edge_v107_Computer
134+
Node 'MSTF_SecurityBaseline_Edge_v107_Computer'
128135
{
129136
RegistryPolicyFile 'Registry(POL): HKLM:\Software\Policies\Microsoft\Edge\SitePerProcess'
130137
{
@@ -136,19 +143,20 @@ Configuration MSTF_SecurityBaseline_Edge_v107_Computer
136143
}
137144
}
138145
}
146+
MSTF_SecurityBaseline_Edge_v107_Computer -OutputPath 'C:\MSTF_SecurityBaseline_Edge_v107_Computer'
139147
```
140148

141149
In order to compile this example, you need to take care that all the referenced DSC modules are available locally.
142150

143151
You can check availability with:
144152

145-
```
153+
```PowerShell
146154
Get-DcsResource
147155
```
148156

149157
If DSC modules are missing, you can install them simply by e.g. running:
150158

151-
```
159+
```PowerShell
152160
Install-Module SecurityPolicyDSC
153161
```
154162

@@ -160,15 +168,13 @@ and that you have to trust the PSGallery to be able to install the DSC modules.
160168
161169
Defining the versions of the modules could look like this:
162170

163-
```
164-
Configuration MSTF_SecurityBaseline_Edge_v107_Computer
171+
```PowerShell
172+
Configuration 'MSTF_SecurityBaseline_Edge_v107_Computer'
165173
{
166174
167175
Import-DSCResource -ModuleName 'GPRegistryPolicyDsc' -ModuleVersion '1.2.0' -ModuleVersion '1.2.0'
168-
Import-DSCResource -ModuleName 'AuditPolicyDSC' -ModuleVersion '1.4.0.0' -ModuleVersion '1.4.0.0'
169-
Import-DSCResource -ModuleName 'SecurityPolicyDSC' -ModuleVersion '2.10.0.0' -ModuleVersion '2.1.0.0'
170176
171-
Node MSTF_SecurityBaseline_Edge_v107_Computer
177+
Node 'MSTF_SecurityBaseline_Edge_v107_Computer'
172178
{
173179
RegistryPolicyFile 'Registry(POL): HKLM:\Software\Policies\Microsoft\Edge\SitePerProcess'
174180
{
@@ -185,7 +191,7 @@ Configuration MSTF_SecurityBaseline_Edge_v107_Computer
185191
So now that all DSC modules are available and the module versions are defined,
186192
you need to run the following command in your Powershell to compile it locally:
187193

188-
```
194+
```PowerShell
189195
. PATHTOYOURSCRIPT\MSTF_SecurityBaseline_Edge_v107_Computer.ps1
190196
MSTF_SecurityBaseline_Edge_v107_Computer
191197
```
@@ -194,7 +200,7 @@ You should now have a localhost.mof file in this location.
194200

195201
The last step is to apply this configuration to your local host:
196202

197-
```
203+
```PowerShell
198204
Start-DscConfiguration -Path PATHTOYOURCONFIGURATION\MSTF_SecurityBaseline_Edge_v107_Computer -Verbose -Wait
199205
```
200206

@@ -204,4 +210,4 @@ Start-DscConfiguration -Path PATHTOYOURCONFIGURATION\MSTF_SecurityBaseline_Edge_
204210

205211
### Usage in XOAP and config.XO
206212

207-
Refer to our documentation [here](https://docs.xoap.io/configuration-management/quickstarts/add-configurations/)
213+
Refer to our documentation [here](https://docs.xoap.io/configuration-management/)

‎STIG/dod_stig_august_2023/DoD_Adobe_Acrobat_Pro_DC_Continuous_STIG_Computer_V2R1.ps1

+222
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
Configuration 'DoD_Adobe_Acrobat_Pro_DC_Continuous_STIG_Computer_V2R1'
2+
{
3+
Import-DscResource -ModuleName 'PSDesiredStateConfiguration'
4+
Import-DSCResource -ModuleName 'GPRegistryPolicyDsc' -ModuleVersion '1.2.0'
5+
Import-DSCResource -ModuleName 'AuditPolicyDSC' -ModuleVersion '1.4.0.0'
6+
Import-DSCResource -ModuleName 'SecurityPolicyDSC' -ModuleVersion '2.10.0.0'
7+
8+
Node 'DoD_Adobe_Acrobat_Pro_DC_Continuous_STIG_Computer_V2R1'
9+
{
10+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Adobe\Adobe Acrobat\DC\Installer\DisableMaintenance'
11+
{
12+
ValueName = 'DisableMaintenance'
13+
ValueData = 1
14+
ValueType = 'Dword'
15+
TargetType = 'ComputerConfiguration'
16+
Key = 'SOFTWARE\Adobe\Adobe Acrobat\DC\Installer'
17+
}
18+
19+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\bEnhancedSecurityStandalone'
20+
{
21+
ValueName = 'bEnhancedSecurityStandalone'
22+
ValueData = 1
23+
ValueType = 'Dword'
24+
TargetType = 'ComputerConfiguration'
25+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown'
26+
}
27+
28+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\bEnhancedSecurityInBrowser'
29+
{
30+
ValueName = 'bEnhancedSecurityInBrowser'
31+
ValueData = 1
32+
ValueType = 'Dword'
33+
TargetType = 'ComputerConfiguration'
34+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown'
35+
}
36+
37+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\iFileAttachmentPerms'
38+
{
39+
ValueName = 'iFileAttachmentPerms'
40+
ValueData = 1
41+
ValueType = 'Dword'
42+
TargetType = 'ComputerConfiguration'
43+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown'
44+
}
45+
46+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\bEnableFlash'
47+
{
48+
ValueName = 'bEnableFlash'
49+
ValueData = 0
50+
ValueType = 'Dword'
51+
TargetType = 'ComputerConfiguration'
52+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown'
53+
}
54+
55+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\bDisableTrustedFolders'
56+
{
57+
ValueName = 'bDisableTrustedFolders'
58+
ValueData = 1
59+
ValueType = 'Dword'
60+
TargetType = 'ComputerConfiguration'
61+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown'
62+
}
63+
64+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\bProtectedMode'
65+
{
66+
ValueName = 'bProtectedMode'
67+
ValueData = 1
68+
ValueType = 'Dword'
69+
TargetType = 'ComputerConfiguration'
70+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown'
71+
}
72+
73+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\iProtectedView'
74+
{
75+
ValueName = 'iProtectedView'
76+
ValueData = 2
77+
ValueType = 'Dword'
78+
TargetType = 'ComputerConfiguration'
79+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown'
80+
}
81+
82+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\bDisablePDFHandlerSwitching'
83+
{
84+
ValueName = 'bDisablePDFHandlerSwitching'
85+
ValueData = 1
86+
ValueType = 'Dword'
87+
TargetType = 'ComputerConfiguration'
88+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown'
89+
}
90+
91+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\bDisableTrustedSites'
92+
{
93+
ValueName = 'bDisableTrustedSites'
94+
ValueData = 1
95+
ValueType = 'Dword'
96+
TargetType = 'ComputerConfiguration'
97+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown'
98+
}
99+
100+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cCloud\bAdobeSendPluginToggle'
101+
{
102+
ValueName = 'bAdobeSendPluginToggle'
103+
ValueData = 1
104+
ValueType = 'Dword'
105+
TargetType = 'ComputerConfiguration'
106+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cCloud'
107+
}
108+
109+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cCloud\bDisableADCFileStore'
110+
{
111+
ValueName = 'bDisableADCFileStore'
112+
ValueData = 1
113+
ValueType = 'Dword'
114+
TargetType = 'ComputerConfiguration'
115+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cCloud'
116+
}
117+
118+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cDefaultLaunchURLPerms\iUnknownURLPerms'
119+
{
120+
ValueName = 'iUnknownURLPerms'
121+
ValueData = 3
122+
ValueType = 'Dword'
123+
TargetType = 'ComputerConfiguration'
124+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cDefaultLaunchURLPerms'
125+
}
126+
127+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cDefaultLaunchURLPerms\iURLPerms'
128+
{
129+
ValueName = 'iURLPerms'
130+
ValueData = 1
131+
ValueType = 'Dword'
132+
TargetType = 'ComputerConfiguration'
133+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cDefaultLaunchURLPerms'
134+
}
135+
136+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cServices\bTogglePrefsSync'
137+
{
138+
ValueName = 'bTogglePrefsSync'
139+
ValueData = 1
140+
ValueType = 'Dword'
141+
TargetType = 'ComputerConfiguration'
142+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cServices'
143+
}
144+
145+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cServices\bToggleWebConnectors'
146+
{
147+
ValueName = 'bToggleWebConnectors'
148+
ValueData = 1
149+
ValueType = 'Dword'
150+
TargetType = 'ComputerConfiguration'
151+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cServices'
152+
}
153+
154+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cSharePoint\bDisableSharePointFeatures'
155+
{
156+
ValueName = 'bDisableSharePointFeatures'
157+
ValueData = 1
158+
ValueType = 'Dword'
159+
TargetType = 'ComputerConfiguration'
160+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cSharePoint'
161+
}
162+
163+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cWebmailProfiles\bDisableWebmail'
164+
{
165+
ValueName = 'bDisableWebmail'
166+
ValueData = 1
167+
ValueType = 'Dword'
168+
TargetType = 'ComputerConfiguration'
169+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cWebmailProfiles'
170+
}
171+
172+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cWelcomeScreen\bShowWelcomeScreen'
173+
{
174+
ValueName = 'bShowWelcomeScreen'
175+
ValueData = 0
176+
ValueType = 'Dword'
177+
TargetType = 'ComputerConfiguration'
178+
Key = 'SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockdown\cWelcomeScreen'
179+
}
180+
181+
RegistryPolicyFile 'Registry(POL): HKLM:\SOFTWARE\Wow6432Node\Adobe\Adobe Acrobat\DC\Installer\DisableMaintenance'
182+
{
183+
ValueName = 'DisableMaintenance'
184+
ValueData = 1
185+
ValueType = 'Dword'
186+
TargetType = 'ComputerConfiguration'
187+
Key = 'SOFTWARE\Wow6432Node\Adobe\Adobe Acrobat\DC\Installer'
188+
}
189+
190+
<#RegistryPolicyFile 'Registry(POL): HKCU:\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\bFIPSMode'
191+
{
192+
ValueName = 'bFIPSMode'
193+
ValueData = 1
194+
ValueType = 'Dword'
195+
TargetType = 'ComputerConfiguration'
196+
Key = 'HKCU:\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral'
197+
}#>
198+
199+
<#RegistryPolicyFile 'Registry(POL): HKCU:\SOFTWARE\Adobe\Adobe Acrobat\DC\Security\cDigSig\cAdobeDownload\bLoadSettingsFromURL'
200+
{
201+
ValueName = 'bLoadSettingsFromURL'
202+
ValueData = 0
203+
ValueType = 'Dword'
204+
TargetType = 'ComputerConfiguration'
205+
Key = 'HKCU:\SOFTWARE\Adobe\Adobe Acrobat\DC\Security\cDigSig\cAdobeDownload'
206+
}#>
207+
208+
<#RegistryPolicyFile 'Registry(POL): HKCU:\SOFTWARE\Adobe\Adobe Acrobat\DC\Security\cDigSig\cEUTLDownload\bLoadSettingsFromURL'
209+
{
210+
ValueName = 'bLoadSettingsFromURL'
211+
ValueData = 0
212+
ValueType = 'Dword'
213+
TargetType = 'ComputerConfiguration'
214+
Key = 'HKCU:\SOFTWARE\Adobe\Adobe Acrobat\DC\Security\cDigSig\cEUTLDownload'
215+
}#>
216+
217+
RefreshRegistryPolicy 'ActivateClientSideExtension'
218+
{
219+
IsSingleInstance = 'Yes'
220+
}
221+
}
222+
}

0 commit comments

Comments
 (0)