Add policies for securing Chef products

Signed-off-by: Tim Smith <tsmith84@gmail.com>

community/chef-infra-client.yml

@@ -0,0 +1,208 @@
+policies:
+  - uid: chef-infra-client
+    name: Chef Infra Client Policy
+    version: "1.0.0"
+    authors:
+      - name: Tim Smith
+        email: tim@mondoo.com
+    docs:
+      desc: |-
+        Chef Infra Client Policy identifies insecure Chef Infra Client installations that could expose node credentials, as well as end of life client releases that no longer receive security updates per the [Chef Supported Versions documentation](https://docs.chef.io/versions/).
+          
+        If you have questions, comments, or have identified ways to improve this policy, please write me at tim@mondoo.com, or reach out in the [Mondoo Slack Community](https://mondoo.link/slack).
+    specs:
+      - asset_filter:
+          query: |
+            platform.family.contains(_ == 'unix')
+            file("/opt/chef/").exists
+        scoring_queries:
+          etc-chef-directory-permissions:
+          client-rb-permissions:
+          validation-pem-not-present:
+          non-eol-infra-client:
+          disable-legacy-encrypted-databags:
+          avoid-reporting-tokens-in-config:
+          client-pem-permissions:
+          var-log-chef-directory-permissions:
+          var-chef-directory-permissions:
+queries:
+  - uid: etc-chef-directory-permissions
+    title: Ensure /etc/chef/ is owned by root with 750 permissions
+    severity: 80
+    query: |
+      if (file("/etc/chef/").exists) {
+        file("/etc/chef") {
+          user.name == 'root'
+          permissions.user_readable == true
+          permissions.user_writeable == true
+          permissions.user_executable == true
+          permissions.group_readable == true
+          permissions.group_writeable == false
+          permissions.group_executable == true
+          permissions.other_readable == false
+          permissions.other_writeable == false
+          permissions.other_executable == false
+        }
+      }
+    docs:
+      desc: |
+        The /etc/chef directory contains sensitive files configuring Chef Infra Client and should only be writeable by root and readable by root and the root group.
+      remediation: |
+        Run the following commands to set proper permissions on your /etc/chef directory:
+
+        ```
+        chown root:root /etc/chef
+        chmod 700 /etc/chef
+        ```
+  - uid: var-chef-directory-permissions
+    title: Ensure /var/chef/ is owned by root with 750 permissions
+    severity: 80
+    query: |
+      if (file("/var/chef/").exists) {
+        file("/var/chef") {
+          user.name == 'root'
+          permissions.user_readable == true
+          permissions.user_writeable == true
+          permissions.user_executable == true
+          permissions.group_readable == true
+          permissions.group_writeable == false
+          permissions.group_executable == true
+          permissions.other_readable == false
+          permissions.other_writeable == false
+          permissions.other_executable == false
+        }
+      }
+    docs:
+      desc: |
+        The /var/chef directory contains sensitive system configuration backup files and cached remote_file downloads. It should only be writeable by root and readable by root and the root group.
+      remediation: |
+        Run the following commands to set proper permissions on your /var/chef directory:
+
+        ```
+        chown root:root /var/chef
+        chmod 700 /var/chef
+        ```
+  - uid: var-log-chef-directory-permissions
+    title: Ensure /var/log/chef/ is owned by root with 750 permissions
+    query: |
+      if (file("/var/log/chef/").exists) {
+        file("/var/log/chef") {
+          user.name == 'root'
+          permissions.user_readable == true
+          permissions.user_writeable == true
+          permissions.user_executable == true
+          permissions.group_readable == true
+          permissions.group_writeable == false
+          permissions.group_executable == true
+          permissions.other_readable == false
+          permissions.other_writeable == false
+          permissions.other_executable == false
+        }
+      }
+    docs:
+      desc: |
+        The /var/log/chef directory contains sensitive log files and should only be writeable by root and readable by root and the root group.
+      remediation: |
+        Run the following commands to set proper permissions on your /var/log/chef directory:
+
+        ```
+        chown root:root /var/log/chef
+        chmod 700 /var/log/chef
+        ```
+  - uid: client-rb-permissions
+    title: Ensure /etc/chef/client.rb is owned by root with 640 permissions
+    severity: 100
+    query: |
+      if (file("/etc/chef/client.rb").exists) {
+        file("/etc/chef/client.rb") {
+          user.name == 'root'
+          permissions.user_readable == true
+          permissions.user_writeable == true
+          permissions.user_executable == false
+          permissions.group_readable == true
+          permissions.group_writeable == false
+          permissions.group_executable == false
+          permissions.other_readable == false
+          permissions.other_writeable == false
+          permissions.other_executable == false
+        }
+      }
+    docs:
+      desc: The /etc/chef/client.rb configuration file contains sensitive Infra Client configuration information. It should be owned by root and permissions should be set to 640.
+      remediation: |
+        Run the following commands to set proper permissions on your /etc/chef/client.rb file:
+
+        ```
+        chown root:root /etc/chef/client.rb
+        chmod 640 /etc/chef/client.rb
+        ```
+  - uid: client-pem-permissions
+    title: Ensure /etc/chef/client.pem is owned by root with 640 permissions
+    severity: 100
+    query: |
+      if (file("/etc/chef/client.pem").exists) {
+        file("/etc/chef/client.pem") {
+          user.name == 'root'
+          permissions.user_readable == true
+          permissions.user_writeable == true
+          permissions.user_executable == false
+          permissions.group_readable == true
+          permissions.group_writeable == false
+          permissions.group_executable == false
+          permissions.other_readable == false
+          permissions.other_writeable == false
+          permissions.other_executable == false
+        }
+      }
+    docs:
+      desc: The /etc/chef/client.pem key file contains the key used to communicate with Chef Infra Server. It should be owned by root and permissions should be set to 640.
+      remediation: |
+        Run the following commands to set proper permissions on your /etc/chef/client.pem file:
+
+        ```
+        chown root:root /etc/chef/client.pem
+        chmod 640 /etc/chef/client.pem
+        ```
+  - uid: validation-pem-not-present
+    title: Ensure /etc/chef/validation.pem is not present
+    severity: 100
+    query: |
+      file("/etc/chef/validation.pem").exists == "false"
+    docs:
+      desc: The /etc/chef/validation.pem file can be used to register any system with Chef Infra Server and should not be left on system after they are bootstrapped into the Chef Infra organization.
+      remediation: |
+        Run the following command to remove the validation.pem file:
+
+        ```
+        rm /etc/chef/validation.pem
+        ```
+  - uid: non-eol-infra-client
+    severity: 70
+    title: Ensure a non-EOL Chef Infra Client release is used
+    query: |
+      command("chef-client -v") {
+        stdout == /^Chef Infra Client: (16|17|18|19|20|21).*/
+      }
+    docs:
+      desc: Chef Infra Client is released once a year in April and 2 major versions are supported at any time (N-1). Prior releases do not receive security updates and should not be used in production environments. See the [Chef Supported Versions documentation](https://docs.chef.io/versions/) for an up-to-date list of supported Infra Client releases.
+      remediation: Upgrade to a non-EOL release of Chef Infra Client. Note that this will require validation of cookbook content for compatibility as newer major version releases introduce breaking changes.
+  - uid: disable-legacy-encrypted-databags
+    severity: 80
+    title: Disable support for less secure Encrypted Databag versions
+    query: |
+      if (file("/etc/chef/client.rb").exists) {
+        file("/etc/chef/client.rb").content.contains("data_bag_decrypt_minimum_version 3")
+      }
+    docs:
+      desc: Encrypted databags v0, v1, and v2 are less secure than v3 and should not be used. See https://docs.chef.io/data_bags/#encryption-versions for more details on the encryption versions.
+      remediation: To set the Infra Client to only accept encrypted data bags v3 or above set `data_bag_decrypt_minimum_version 3` in the `client.rb` file.
+  - uid: avoid-reporting-tokens-in-config
+    severity: 70
+    title: Avoid storing Automate tokens in the client.rb config
+    query: |
+      if (file("/etc/chef/client.rb").exists) {
+        file("/etc/chef/client.rb").content.contains("data_collector.token") == false
+      }
+    docs:
+      desc: When sending reporting data directly to Automate an Automate API token must be stored in the `client.rb` configuration file. Instead of setting the token, proxy Infra Client report data through the Infra Server so that the Automate API token only needs to be stored in the Infra Server.
+      remediation: See https://docs.chef.io/server/config_rb_server_optional_settings/#data_collector-14 for more information on configuring the Infra Server to proxy reporting data. Once the Infra Server has been configured for proxying you can set `data_collector.server_url` in client.rb to the URL of the Infra Server and remove the `data_collector.token` configuration.