bosh-stemcell 1.5.0.pre.1193 → 1.5.0.pre.1209

data/lib/bosh/stemcell/stage_collection.rb

@@ -57,7 +57,7 @@ module Bosh::Stemcell
         #:system_open_vm_tools,
         :system_parameters,
         :bosh_clean,
-        #:bosh_harden,
+        :bosh_harden,
         #:bosh_dpkg_list,
         :image_create,
         :image_install_grub,

data/lib/bosh/stemcell/version.rb

@@ -1,5 +1,5 @@
 module Bosh
   module Stemcell
-    VERSION = '1.5.0.pre.1193'
+    VERSION = '1.5.0.pre.1209'
   end
 end

data/spec/bosh/stemcell/stage_collection_spec.rb

@@ -176,7 +176,7 @@ module Bosh::Stemcell
               #:system_open_vm_tools,
               :system_parameters,
               :bosh_clean,
-              #:bosh_harden,
+              :bosh_harden,
               #:bosh_dpkg_list,
               :image_create,
               :image_install_grub,

data/spec/stemcells/centos_spec.rb

@@ -129,4 +129,18 @@ describe 'CentOs Stemcell' do
       it { should contain('centos') }
     end
   end
+
+  context 'installed by bosh_harden' do
+    describe 'disallow unsafe setuid binaries' do
+      subject { backend.run_command('find / -xdev -perm +6000 -a -type f')[:stdout].split }
+
+      it { should match_array(%w(/bin/su /usr/bin/sudo)) }
+    end
+
+    describe 'disallow root login' do
+      subject { file('/etc/ssh/sshd_config') }
+
+      it { should contain /^PermitRootLogin no$/ }
+    end
+  end
 end

data/spec/stemcells/ubuntu_spec.rb

@@ -136,9 +136,30 @@ describe 'Ubuntu Stemcell' do
     end
   end
 
+  context 'installed by bosh_user' do
+    describe file('/etc/passwd') do
+      it { should be_file }
+      it { should contain '/home/vcap:/bin/bash' }
+    end
+  end
+
   context 'installed by system_parameters' do
     describe file('/var/vcap/bosh/etc/operating_system') do
       it { should contain('ubuntu') }
     end
   end
+
+  context 'installed by bosh_harden' do
+    describe 'disallow unsafe setuid binaries' do
+      subject { backend.run_command('find / -xdev -perm +6000 -a -type f')[:stdout].split }
+
+      it { should match_array(%w(/bin/su /usr/bin/sudo /usr/bin/sudoedit)) }
+    end
+
+    describe 'disallow root login' do
+      subject { file('/etc/ssh/sshd_config') }
+
+      it { should contain /^PermitRootLogin no$/ }
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bosh-stemcell
 version: !ruby/object:Gem::Version
-  version: 1.5.0.pre.1193
+  version: 1.5.0.pre.1209
   prerelease: 6
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-10-29 00:00:00.000000000 Z
+date: 2013-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bosh_aws_cpi
@@ -18,7 +18,7 @@ dependencies:
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
-        version: 1.5.0.pre.1193
+        version: 1.5.0.pre.1209
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -26,7 +26,7 @@ dependencies:
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
-        version: 1.5.0.pre.1193
+        version: 1.5.0.pre.1209
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement