audit_rules

pdk
Manage active directory audit rules.
Fervid

Fervid

fervid

1,256 downloads

1,256 latest version

5.0 quality score

Version information

  • 1.0.0 (latest)
released Oct 29th 2019
This version is compatible with:
  • Puppet Enterprise 2018.1.x, 2017.3.x, 2017.2.x, 2017.1.x, 2016.5.x, 2016.4.x
  • Puppet >= 4.7.0 < 6.0.0
  • windows

Start using this module

Documentation

fervid/audit_rules — version 1.0.0 Oct 29th 2019

audit_rules

License Build Status Puppet Forge Puppet Forge Score Puppet Forge Downloads

The ad_acl module supplies a audit_rules resource (via a Puppet custom type provider).

Table of Contents

  1. Description
  2. Setup - The basics of getting started with audit_rules
  3. Usage - Configuration options and additional functionality
  4. Reference - An under-the-hood peek at what the module is doing and how
  5. Limitations - OS compatibility, etc.
  6. Development - Guide for contributing to the module

Description

This module control access control lists for Windows Domain Controllers. Unless you can enforce security rules at a domain level you leave large parts of the Windows environment exposed to attack.

Setup

Beginning with audit_rules

The following rule will set basic hardening rules on the root domain.

ad_acl { "CN=Policies,CN=System,${root_domain}":
  audit_rules  => [
    {
      'ad_rights'        => 'WriteProperty, WriteDacl',
      'identity'         => 'S-1-1-0',
      'audit_flags'      => 'Success',
      'inheritance_type' => 'Descendents',
    },
    {
      'ad_rights'        => 'GenericAll',
      'identity'         => 'S-1-1-0',
      'audit_flags'      => 'Failure',
      'inheritance_type' => 'None',
    },
  ],
  access_rules => [
  {
    'identity'            => 'S-1-5-11',
    'ad_rights'           => 'GenericRead',
    'access_control_type' => 'Allow',
    'inheritance_type'    => 'None'
  },
  {
    'identity'            => 'S-1-5-18',
    'ad_rights'           => 'GenericAll',
    'access_control_type' => 'Allow',
    'inheritance_type'    => 'None'
  },
  {
    'identity'            => "${facts['domain_sid']}-512",
    'ad_rights'           => 'CreateChild, DeleteChild, Self, WriteProperty, ExtendedRight, GenericRead, WriteDacl, WriteOwner',
    'access_control_type' => 'Allow',
    'inheritance_type'    => 'None'
  },
  {
    'identity'            => "${facts['domain_sid']}-520",
    'ad_rights'           => 'CreateChild',
    'access_control_type' => 'Allow',
    'inheritance_type'    => 'None'
  }],
}

Usage

A typical ACL is made up of audit rules and access rules. They are each passed in as a hash of hashes.

Reference

Defined type: ad_acl

The main type of the module, responsible for all its functionality.

Parameters

All of the below parameters are optional, unless otherwise noted.

Audit Rules

Each audit_rules item contains four parameters:

  • ad_rights
  • identity
  • audit_flags
  • inheritance_type
Access rules

Each access_rules item contains 4 parameters:

  • identity
  • ad_rights
  • access_control_type
  • inheritance_type

Limitations

This has only been tested on Windows 2012 and Windows 2016.

Development

Any contributions are welcome.

Contributors

Bryan Belanger