Python utils.get_settings方法代码示例

# 需要导入模块: from charmhelpers.contrib.hardening import utils [as 别名]
# 或者: from charmhelpers.contrib.hardening.utils import get_settings [as 别名]
def get_audits():
    """Get OS hardening sysctl audits.

    :returns:  dictionary of audits
    """
    audits = []
    settings = utils.get_settings('os')

    # Apply the sysctl settings which are configured to be applied.
    audits.append(SysctlConf())
    # Make sure that only root has access to the sysctl.conf file, and
    # that it is read-only.
    audits.append(FilePermissionAudit('/etc/sysctl.conf',
                                      user='root',
                                      group='root', mode=0o0440))
    # If module loading is not enabled, then ensure that the modules
    # file has the appropriate permissions and rebuild the initramfs
    if not settings['security']['kernel_enable_module_loading']:
        audits.append(ModulesTemplate())

    return audits 

# 需要导入模块: from charmhelpers.contrib.hardening import utils [as 别名]
# 或者: from charmhelpers.contrib.hardening.utils import get_settings [as 别名]
def __call__(self):
        settings = utils.get_settings('os')
        with open('/proc/cpuinfo', 'r') as fd:
            cpuinfo = fd.readlines()

        for line in cpuinfo:
            match = re.search(r"^vendor_id\s+:\s+(.+)", line)
            if match:
                vendor = match.group(1)

        if vendor == "GenuineIntel":
            vendor = "intel"
        elif vendor == "AuthenticAMD":
            vendor = "amd"

        ctxt = {'arch': platform.processor(),
                'cpuVendor': vendor,
                'desktop_enable': settings['general']['desktop_enable']}

        return ctxt 

# 需要导入模块: from charmhelpers.contrib.hardening import utils [as 别名]
# 或者: from charmhelpers.contrib.hardening.utils import get_settings [as 别名]
def get_audits():
    """Get OS hardening security limits audits.

    :returns:  dictionary of audits
    """
    audits = []
    settings = utils.get_settings('os')

    # Ensure that the /etc/security/limits.d directory is only writable
    # by the root user, but others can execute and read.
    audits.append(DirectoryPermissionAudit('/etc/security/limits.d',
                                           user='root', group='root',
                                           mode=0o755))

    # If core dumps are not enabled, then don't allow core dumps to be
    # created as they may contain sensitive information.
    if not settings['security']['kernel_enable_core_dump']:
        audits.append(TemplatedFile('/etc/security/limits.d/10.hardcore.conf',
                                    SecurityLimitsContext(),
                                    template_dir=TEMPLATES_DIR,
                                    user='root', group='root', mode=0o0440))
    return audits 

# 需要导入模块: from charmhelpers.contrib.hardening import utils [as 别名]
# 或者: from charmhelpers.contrib.hardening.utils import get_settings [as 别名]
def get_audits():
    """Get OS hardening PAM authentication audits.

    :returns:  dictionary of audits
    """
    audits = []

    settings = utils.get_settings('os')

    if settings['auth']['pam_passwdqc_enable']:
        audits.append(PasswdqcPAM('/etc/passwdqc.conf'))

    if settings['auth']['retries']:
        audits.append(Tally2PAM('/usr/share/pam-configs/tally2'))
    else:
        audits.append(DeletedFile('/usr/share/pam-configs/tally2'))

    return audits 

# 需要导入模块: from charmhelpers.contrib.hardening import utils [as 别名]
# 或者: from charmhelpers.contrib.hardening.utils import get_settings [as 别名]
def get_audits():
    """Get OS hardening apt audits.

    :returns:  dictionary of audits
    """
    audits = [AptConfig([{'key': 'APT::Get::AllowUnauthenticated',
                          'expected': 'false'}])]

    settings = get_settings('os')
    clean_packages = settings['security']['packages_clean']
    if clean_packages:
        security_packages = settings['security']['packages_list']
        if security_packages:
            audits.append(RestrictedPackages(security_packages))

    return audits 

# 需要导入模块: from charmhelpers.contrib.hardening import utils [as 别名]
# 或者: from charmhelpers.contrib.hardening.utils import get_settings [as 别名]
def __call__(self):
        settings = utils.get_settings('ssh')
        if settings['common']['network_ipv6_enable']:
            addr_family = 'any'
        else:
            addr_family = 'inet'

        ctxt = {
            'addr_family': addr_family,
            'remote_hosts': settings['common']['remote_hosts'],
            'password_auth_allowed':
            settings['client']['password_authentication'],
            'ports': settings['common']['ports'],
            'ciphers': self.get_ciphers(settings['client']['cbc_required']),
            'macs': self.get_macs(settings['client']['weak_hmac']),
            'kexs': self.get_kexs(settings['client']['weak_kex']),
            'roaming': settings['client']['roaming'],
        }
        return ctxt 

# 需要导入模块: from charmhelpers.contrib.hardening import utils [as 别名]
# 或者: from charmhelpers.contrib.hardening.utils import get_settings [as 别名]
def get_audits():
    """Get OS hardening profile audits.

    :returns:  dictionary of audits
    """
    audits = []

    settings = utils.get_settings('os')
    # If core dumps are not enabled, then don't allow core dumps to be
    # created as they may contain sensitive information.
    if not settings['security']['kernel_enable_core_dump']:
        audits.append(TemplatedFile('/etc/profile.d/pinerolo_profile.sh',
                                    ProfileContext(),
                                    template_dir=TEMPLATES_DIR,
                                    mode=0o0755, user='root', group='root'))
    if settings['security']['ssh_tmout']:
        audits.append(TemplatedFile('/etc/profile.d/99-hardening.sh',
                                    ProfileContext(),
                                    template_dir=TEMPLATES_DIR,
                                    mode=0o0644, user='root', group='root'))
    return audits