aws.attributes.yml

# encoding: utf-8
#
# This is an example of an attributes file that can be passed to the profile
# to override the defaults of the attributes defined in each of the tests.
# You can use this to automatically adjust your tests when using automation or
# progromatic deployment or validation of differnt deployment patterns without
# having to adjust the core profile.

# === PROFILE USER EDIT ===

#description: Path for the nginx configuration file
nginx_conf_file: '/etc/nginx/nginx.conf'

#description: Path to nginx backup repository
nginx_backup_repository: '/usr/share/nginx/html'

#description: Subnet of the DMZ
dmz_subnet: '62.0.0.0/24'

#description: Minimum Web vendor-supported version.
nginx_min_ver: '1.12.0'

#description: Nginx owner
nginx_owner: 'nginx'

#description: The Nginx group,
nginx_group: 'nginx'

#description: The system adminstrator,
sys_admin: ['root','centos']

#description: The system adminstrator group,
sys_admin_group: 'root'

#description: List of non admin user accounts
authorized_user_list: ['user']

#description: Monitoring software for CGI or equivalent programs,
monitoring_software: ['audit', 'auditd']

#description: List of allowed services
allowed_services_list:
  - arp-ethers
  - auditd
  - auth-rpcgss-module
  - autovt@
  - blk-availability
  - brandbot
  - chrony-dnssrv@
  - chrony-wait
  - chronyd
  - cloud-config
  - cloud-final
  - cloud-init-local
  - cloud-init
  - console-getty
  - console-shell
  - container-getty@
  - cpupower
  - crond
  - dbus-org.freedesktop.hostname1
  - dbus-org.freedesktop.import1
  - dbus-org.freedesktop.locale1
  - dbus-org.freedesktop.login1
  - dbus-org.freedesktop.machine1
  - dbus-org.freedesktop.timedate1
  - dbus
  - debug-shell
  - dnsmasq
  - dracut-cmdline
  - dracut-initqueue
  - dracut-mount
  - dracut-pre-mount
  - dracut-pre-pivot
  - dracut-pre-trigger
  - dracut-pre-udev
  - dracut-shutdown
  - emergency
  - fstrim
  - getty@
  - gssproxy
  - halt-local
  - initrd-cleanup
  - initrd-parse-etc
  - initrd-switch-root
  - initrd-udevadm-cleanup-db
  - irqbalance
  - kdump
  - kmod-static-nodes
  - messagebus
  - microcode
  - nfs-blkmap
  - nfs-config
  - nfs-idmap
  - nfs-idmapd
  - nfs-lock
  - nfs-mountd
  - nfs-rquotad
  - nfs-secure
  - nfs-server
  - nfs-utils
  - nfs
  - nfslock
  - nginx-debug
  - nginx
  - polkit
  - quotaon
  - rc-local
  - rdisc
  - rdma-ndd
  - rdma
  - rescue
  - rhel-autorelabel-mark
  - rhel-autorelabel
  - rhel-configure
  - rhel-dmesg
  - rhel-domainname
  - rhel-import-state
  - rhel-loadmodules
  - rhel-readonly
  - rpc-gssd
  - rpc-rquotad
  - rpc-statd-notify
  - rpc-statd
  - rpcbind
  - rpcgssd
  - rpcidmapd
  - rsyncd
  - rsyncd@
  - rsyslog
  - selinux-policy-migrate-local-changes@
  - serial-getty@
  - sshd-keygen
  - sshd
  - sshd@
  - systemd-ask-password-console
  - systemd-ask-password-wall
  - systemd-backlight@
  - systemd-binfmt
  - systemd-bootchart
  - systemd-firstboot
  - systemd-fsck-root
  - systemd-fsck@
  - systemd-halt
  - systemd-hibernate-resume@
  - systemd-hibernate
  - systemd-hostnamed
  - systemd-hwdb-update
  - systemd-hybrid-sleep
  - systemd-importd
  - systemd-initctl
  - systemd-journal-catalog-update
  - systemd-journal-flush
  - systemd-journald
  - systemd-kexec
  - systemd-localed
  - systemd-logind
  - systemd-machine-id-commit
  - systemd-machined
  - systemd-modules-load
  - systemd-nspawn@
  - systemd-poweroff
  - systemd-quotacheck
  - systemd-random-seed
  - systemd-readahead-collect
  - systemd-readahead-done
  - systemd-readahead-drop
  - systemd-readahead-replay
  - systemd-reboot
  - systemd-remount-fs
  - systemd-rfkill@
  - systemd-shutdownd
  - systemd-suspend
  - systemd-sysctl
  - systemd-timedated
  - systemd-tmpfiles-clean
  - systemd-tmpfiles-setup-dev
  - systemd-tmpfiles-setup
  - systemd-udev-settle
  - systemd-udev-trigger
  - systemd-udevd
  - systemd-update-done
  - systemd-update-utmp-runlevel
  - systemd-update-utmp
  - systemd-user-sessions
  - systemd-vconsole-setup
  - tcsd
  - teamd@
  - tuned
  - wpa_supplicant
  - qemu-guest-agent

#description: List of disallowed services
disallowed_services_list:
  - mysql
  - postgres
  - named
  - postfix

# description: 'List of allowed packages',
allowed_packages_list:
  - tuned
  - filesystem
  - cloud-init
  - quota
  - openssh-server
  - authconfig
  - dracut-config-rescue
  - libsepol
  - irqbalance
  - json-c
  - info
  - sudo
  - python-pillow
  - popt
  - bzip2-libs
  - kernel
  - postfix
  - pkgconfig
  - libgpg-error
  - parted
  - passwd
  - diffutils
  - libsysfs
  - findutils
  - gpg-pubkey
  - libmnl
  - grub2-common
  - libassuan
  - ncurses-base
  - groff-base
  - glibc-common
  - libunistring
  - pcre
  - libcap
  - libref_array
  - libdb
  - lzo
  - grep
  - shared-mime-info
  - newt
  - cpio
  - libtirpc
  - nss
  - dbus-glib
  - python
  - acl
  - dmidecode
  - setools-libs
  - pciutils-libs
  - elfutils-libs
  - gettext-libs
  - python-babel
  - cracklib
  - audit-libs-python
  - dbus-python
  - nss-tools
  - python-gobject-base
  - libdb-utils
  - python-kitchen
  - rpm
  - libnfsidmap
  - python-backports-ssl_match_hostname
  - yum
  - python-IPy
  - tar
  - yum-metadata-parser
  - gmp
  - freetype
  - libxml2-python
  - kernel-tools-libs
  - linux-firmware
  - glibc
  - libtevent
  - python-urllib3
  - libuser
  - ncurses
  - python-urlgrabber
  - iwl7265-firmware
  - libmodman
  - libsemanage
  - numactl-libs
  - libstdc++
  - shadow-utils
  - elfutils-libs
  - libcap-ng
  - pth
  - util-linux
  - gpgme
  - dracut
  - libpath_utils
  - systemd-sysv
  - initscripts
  - qrencode-libs
  - grub2-pc
  - PyYAML
  - rpcbind
  - net-tools
  - pciutils
  - polkit-pkla-compat
  - glib-networking
  - setup
  - crontabs
  - basesystem
  - ppp
  - zlib
  - libtiff
  - sed
  - nginx
  - libcap-ng
  - libxml2
  - libffi
  - tcp_wrappers-libs
  - dbus-libs
  - libacl
  - man-db
  - keyutils-libs
  - expat
  - rootfiles
  - libidn
  - chef
  - openssl-libs
  - libverto
  - libgcc
  - centos-release
  - bind-license
  - tzdata
  - nss-softokn-freebl
  - which
  - glibc
  - ncurses-libs
  - libedit
  - libselinux
  - audit-libs
  - chkconfig
  - libnfnetlink
  - nss-util
  - libcollection
  - libuuid
  - libbasicobjects
  - elfutils-libelf
  - hostname
  - krb5-libs
  - gdbm
  - glib2
  - slang
  - libnl3
  - p11-kit
  - gzip
  - libcroco
  - less
  - nss-softokn
  - nss-pem
  - nettle
  - e2fsprogs-libs
  - keyutils
  - python-libs
  - python-setuptools
  - tcp_wrappers
  - libgomp
  - libtasn1
  - ca-certificates
  - pinentry
  - ethtool
  - make
  - elfutils-default-yama-scope
  - systemd-libs
  - coreutils
  - python-pyudev
  - gettext
  - pyserial
  - python-jinja2
  - python-linux-procfs
  - python-perf
  - cracklib-dicts
  - pam
  - python-configobj
  - python-backports
  - newt-python
  - python-six
  - python-requests
  - pyxattr
  - python-jsonpointer
  - libssh2
  - python-pycurl
  - centos-logos
  - libproxy
  - sysvinit-tools
  - libutempter
  - gnupg2
  - pygpgme
  - libini_config
  - libdaemon
  - checkpolicy
  - libpipeline
  - libyaml
  - hardlink
  - dbus
  - systemd-libs
  - libsoup
  - rdma-core
  - selinux-policy-targeted
  - grub2
  - openssh-clients
  - kernel
  - dnsmasq
  - audit
  - dracut-config-generic
  - rsync
  - chrony
  - cloud-utils-growpart
  - rdma-core
  - python-schedutils
  - libteam
  - gobject-introspection
  - bind-libs-lite
  - cyrus-sasl-lib
  - libcurl
  - rpm-libs
  - openldap
  - dhcp-common
  - rpm-build-libs
  - yum-plugin-fastestmirror
  - binutils
  - e2fsprogs
  - logrotate
  - vim-minimal
  - fipscheck-lib
  - libseccomp
  - jansson
  - libfastjson
  - libnetfilter_conntrack
  - iproute
  - kbd-legacy
  - nss-softokn-freebl
  - zlib
  - kernel-tools
  - teamd
  - libgudev1
  - python-pygments
  - btrfs-progs
  - mariadb-libs
  - libpcap
  - libsepol
  - bzip2-libs
  - xz-libs
  - libgcrypt
  - pcre
  - elfutils-libelf
  - cracklib
  - libcap
  - audit-libs
  - pam
  - cryptsetup-libs
  - systemd
  - kpartx
  - device-mapper
  - policycoreutils
  - iputils
  - grub2-tools
  - grub2-tools-extra
  - dhclient
  - selinux-policy
  - libcgroup
  - polkit
  - cronie-anacron
  - hwdata
  - gssproxy
  - gnutls
  - virt-what
  - nfs-utils
  - os-prober
  - kexec-tools
  - quota-nls
  - kbd
  - wpa_supplicant
  - rsyslog
  - microcode_ctl
  - jbigkit-libs
  - xz-libs
  - gpg-pubkey
  - python-cheetah
  - nspr
  - sqlite
  - libattr
  - lua
  - file-libs
  - openssl
  - file
  - grub2-pc-modules
  - bash
  - xz
  - libstdc++
  - libcom_err
  - gawk
  - libblkid
  - libjpeg-turbo
  - libmount
  - libgcrypt
  - libverto-tevent
  - libnl3-cli
  - nss-sysinit
  - readline
  - libselinux-python
  - p11-kit-trust
  - mozjs17
  - kmod-libs
  - GeoIP
  - procps-ng
  - python-markupsafe
  - python-prettytable
  - python-decorator
  - python-jsonpatch
  - libpwquality
  - gsettings-desktop-schemas
  - grubby
  - python-chardet
  - curl
  - dhcp-libs
  - rpm-python
  - python-iniparse
  - libss
  - python-boto
  - libselinux-utils
  - pyliblzma
  - fipscheck
  - python-markdown
  - libtalloc
  - iptables
  - libevent
  - kbd-misc
  - libgcc
  - yum-utils
  - xfsprogs
  - libwebp
  - libgpg-error
  - snappy
  - libsemanage-python
  - ustr
  - libselinux
  - libattr
  - libdb
  - kmod
  - device-mapper-libs
  - libndp
  - grub2-tools-minimal
  - openssh
  - libestr
  - dracut-network
  - policycoreutils-python
  - cronie
  - trousers
  - qemu-guest-agent
  - libverto-libevent
  - wget
  - unzip


# description: 'List of disallowed packages',
disallowed_packages_list: ['postfix']

# description: List of disallowed compilers
disallowed_compiler_list: ['gcc']

#description: DoD-approved PKIs (e.g., DoD PKI, DoD ECA, and DoD-approved external partners.
dod_approved_pkis: ['DoD', 'ECA']

#description: File list of  documentation, sample code, example applications, and tutorials.
nginx_disallowed_file_list: ['/usr/share/man/man8/nginx.8.gz']

#description: File list of allowed documentation, sample code, example applications, and tutorials.
nginx_allowed_file_list: []

#description: List of  authorized nginx modules.
nginx_authorized_modules:
  - http_addition
  - http_auth_request
  - http_dav
  - http_flv
  - http_gunzip
  - http_gzip_static
  - http_mp4
  - http_random_index
  - http_realip
  - http_secure_link
  - http_slice
  - http_ssl
  - http_stub_status
  - http_sub
  - http_v2
  - mail_ssl
  - stream_realip
  - stream_ssl
  - stream_ssl_preread


#description: List of  unauthorized nginx modules.
nginx_unauthorized_modules: []

#description: Path for the nginx binary
nginx_path: '/usr/sbin/nginx'

#description: domain and port to the OCSP Server
ocsp_server: 'login.live.com:443'

#description: Frequency at which CRL is updated in days
crl_udpate_frequency: 7