make uid_min and gid_min of login.defs configurable

.rubocop.yml

@@ -1,6 +1,7 @@
 ---
 AllCops:
   Exclude:
+  - Berksfile
   - vendor/**/*
   - test/**/*
   - metadata.rb

Gemfile

@@ -7,7 +7,7 @@ gem 'chef',       '~> 11.12'
 
 group :test do
   gem 'rake'
-  gem 'chefspec', '~> 4.0'
+  gem 'chefspec', '~> 4.1.1'
   gem 'foodcritic', '~> 3.0'
   gem 'thor-foodcritic'
   gem 'rubocop',    '~> 0.23'

attributes/default.rb

@@ -62,6 +62,8 @@
 default['auth']['pam']['passwdqc']['enable']            = true
 default['auth']['pam']['passwdqc']['options']           = 'min=disabled,disabled,16,12,8'
 default['auth']['root_ttys']                          = %w(console tty1 tty2 tty3 tty4 tty5 tty6)
+default['auth']['uid_min']                             = 1000
+default['auth']['gid_min']                             = 1000
 # may contain: change_user
 default['security']['users']['allow']                  = []
 default['security']['kernel']['enable_module_loading'] = true

libraries/suid_sgid.rb

@@ -45,11 +45,11 @@ def self.find_all_suid_sgid_files(start_at = '/')
 
       def self.remove_suid_sgid_from_blacklist(blacklist)
         blacklist
-        .select { |file| File.exist?(file) }
-        .each do|file|
-          Chef::Log.info "suid_sgid: Blacklist SUID/SGID for '#{file}', removing bit..."
-          remove_suid_sgid_from(file)
-        end
+          .select { |file| File.exist?(file) }
+          .each do|file|
+            Chef::Log.info "suid_sgid: Blacklist SUID/SGID for '#{file}', removing bit..."
+            remove_suid_sgid_from(file)
+          end
       end
 
       def self.remove_suid_sgid_from_unkown(whitelist = [], root = '/', dry_run = false)

recipes/login_defs.rb

@@ -20,7 +20,7 @@
 
 template '/etc/login.defs' do
   source 'login.defs.erb'
-  mode 0444
+  mode '0444'
   owner 'root'
   group 'root'
   variables(
@@ -31,6 +31,8 @@
     login_retries: node['auth']['retries'],
     login_timeout: node['auth']['timeout'],
     chfn_restrict: '', # "rwh"
-    allow_login_without_home: node['auth']['allow_homeless']
+    allow_login_without_home: node['auth']['allow_homeless'],
+    uid_min: node['auth']['uid_min'],
+    gid_min: node['auth']['gid_min']
   )
 end

recipes/sysctl.rb

@@ -33,8 +33,8 @@
 # try to determine the real cpu vendor
 begin
   cpu_vendor = node['cpu']['0']['vendor_id']
-    .sub(/^.*GenuineIntel.*$/, 'intel')
-    .sub(/^.*AuthenticAMD.*$/, 'amd')
+               .sub(/^.*GenuineIntel.*$/, 'intel')
+               .sub(/^.*AuthenticAMD.*$/, 'amd')
   node.default['security']['cpu_vendor'] = cpu_vendor
 rescue
   log 'WARNING: Could not properly determine the cpu vendor. Fallback to intel cpu.' do

spec/recipes/default_spec.rb

@@ -21,7 +21,7 @@
 
   # converge
   let(:chef_run) do
-    ChefSpec::Runner.new do |node|
+    ChefSpec::ServerRunner.new do |node|
       # sysctl/attributes/default.rb will set the config dir
       # on rhel and debian, but apply requires it for notification
       # therefore we set it manually here

spec/recipes/limits_spec.rb

@@ -20,7 +20,7 @@
 describe 'os-hardening::limits' do
 
   let(:chef_run) do
-    ChefSpec::Runner.new.converge(described_recipe)
+    ChefSpec::ServerRunner.new.converge(described_recipe)
   end
 
   it 'creates /etc/sysconfig/init' do

spec/recipes/login_defs_spec.rb

@@ -0,0 +1,41 @@
+# encoding: UTF-8
+#
+# Copyright 2014, Deutsche Telekom AG
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative '../spec_helper'
+
+describe 'os-hardening::login_defs' do
+
+  let(:chef_run) do
+    ChefSpec::ServerRunner.new do |node|
+      node.set['auth']['uid_min'] = 5000
+      node.set['auth']['gid_min'] = 5000
+    end.converge(described_recipe)
+  end
+
+  it 'creates /etc/login.defs' do
+    expect(chef_run).to create_template('/etc/login.defs')
+      .with(mode: '0444')
+      .with(owner: 'root')
+      .with(group: 'root')
+  end
+
+  it 'uses uid_min and gid_min in /etc/login.defs' do
+    expect(chef_run).to render_file('/etc/login.defs')
+      .with_content(/^UID_MIN\s+5000$/)
+      .with_content(/^GID_MIN\s+5000$/)
+  end
+end

spec/recipes/securetty_spec.rb

@@ -20,7 +20,7 @@
 describe 'os-hardening::securetty' do
 
   let(:chef_run) do
-    ChefSpec::Runner.new.converge(described_recipe)
+    ChefSpec::ServerRunner.new.converge(described_recipe)
   end
 
   it 'creates /etc/securetty' do

spec/recipes/sysctl_spec.rb

@@ -22,7 +22,7 @@
   context 'intel' do
 
     let(:intel_run) do
-      ChefSpec::Runner.new do |node|
+      ChefSpec::ServerRunner.new do |node|
         node.set['sysctl']['conf_dir'] = '/etc/sysctl.d'
         node.set['cpu']['0']['vendor_id'] = 'GenuineIntel'
       end
@@ -38,7 +38,7 @@
   context 'amd' do
 
     let(:amd_run) do
-      ChefSpec::Runner.new do |node|
+      ChefSpec::ServerRunner.new do |node|
         node.set['sysctl']['conf_dir'] = '/etc/sysctl.d'
         node.set['cpu']['0']['vendor_id'] = 'AuthenticAMD'
       end
@@ -53,7 +53,7 @@
   context 'fallback' do
 
     let(:fallback_run) do
-      ChefSpec::Runner.new do |node|
+      ChefSpec::ServerRunner.new do |node|
         node.set['sysctl']['conf_dir'] = '/etc/sysctl.d'
       end
     end

spec/spec_helper.rb

@@ -17,7 +17,6 @@
 
 require 'chefspec'
 require 'chefspec/berkshelf'
-require 'chefspec/server'
 
 # coverage report
 ChefSpec::Coverage.start!

templates/default/login.defs.erb

@@ -109,14 +109,14 @@ PASS_MIN_DAYS <%= @password_min_age.to_s %>
 PASS_WARN_AGE	7
 
 # Min/max values for automatic uid selection in useradd
-UID_MIN			 1000
+UID_MIN			 <%= @uid_min.to_s %>
 UID_MAX			60000
 # System accounts
 #SYS_UID_MIN		  100
 #SYS_UID_MAX		  999
 
 # Min/max values for automatic gid selection in groupadd
-GID_MIN			 1000
+GID_MIN			 <%= @gid_min.to_s %>
 GID_MAX			60000
 # System accounts
 #SYS_GID_MIN		  100