{"id":73119,"date":"2018-01-31T08:44:09","date_gmt":"2018-01-31T16:44:09","guid":{"rendered":""},"modified":"2025-01-23T15:47:34","modified_gmt":"2025-01-23T23:47:34","slug":"applying-compliance-frameworks-chef-inspec-azure-government","status":"publish","type":"post","link":"https:\/\/opensource.microsoft.com\/blog\/2018\/01\/31\/applying-compliance-frameworks-chef-inspec-azure-government\/","title":{"rendered":"Applying compliance frameworks with Chef InSpec on Azure Government"},"content":{"rendered":"\n

In government, compliance and security are critical components of our job function. The current state of compliance frameworks are bulky and unwieldy for those inexperienced with OpenSCAP\/XML. The Microsoft Azure Government<\/a> cloud and Chef InSpec<\/a> are designed to provide a common language for security, compliance, and automation teams to converge around.<\/p>\n\n\n\n

Microsoft Azure Government is designed to solve your compliance needs all the way up to the systems you manage. That\u2019s where Chef Automate and InSpec take over for that \u201dlast mile.\u201d Chef Automate<\/a> and InSpec help you view compliance controls in a human-readable, easily digestible format.<\/p>\n\n\n\n

The below example is the DISA STIG RHEL6 Control, pertaining to which protocol version of SSH your system runs. This is just one of hundreds of controls published by DISA for managing RedHat systems. The value of InSpec over traditional testing and compliance frameworks is that InSpec includes all the context we need to understand not only the actual code check itself, but also all of the other information we need to understand why we\u2019re checking for this setting. Chef Automate includes profiles for DISA STIGs and CIS Benchmarks out of the box.<\/p>\n\n\n

\n title 'RHEL-06-000227: The SSH daemon must be configured to use only the SSHv2 protocol.'\ncontrol 'RHEL-06-000227' do\n impact 1.0\n title 'The SSH daemon must be configured to use only the SSHv2 protocol.'\n desc 'SSH protocol version 1 suffers from design flaws that result in security vulnerabilities and should not be used.'\n tag group: 'SRG-OS-000112'\n tag vulid: 'V-38607'\n tag ruleid: 'SV-50408r1_rule'\n tag severity: 'CAT I'\n tag stigid: 'RHEL-06-000227'\n tag cci: 'CCI-000774'\n tag fixtext: 'Only SSH protocol version 2 connections should be permitted. The default setting in \"\/etc\/ssh\/sshd_config\" is correct, and can be verified by ensuring that the following line appears: Protocol 2'\n tag checkcontent: 'To check which SSH protocol version is allowed, run the following command: # grep Protocol \/etc\/ssh\/sshd_config If configured properly, output should be Protocol 2 If it is not, this is a finding.'\n tag remediation: ''\n ref 'http:\/\/iasecontent.disa.mil\/stigs\/zip\/U_RedHat_6_V1R15_STIG.zip'\ndescribe sshd_config do\n its('Protocol') { should eq('2') }\n end\n end\n<\/pre><\/div>\n\n\n
By using these InSpec profiles in conjunction with Microsoft Azure Government, we can simplify and reduce the effort it takes to provide compliance in an environment. Recently, we presented a live webinar on this topic with Microsoft\u2019s Technical Solutions Specialist, Derrick Schwartz<\/a>, to show how our technologies work together to achieve this goal. You can watch a recording of the webinar below.<\/p>\n\n\n\n
\n