3 ms·
what would be the difference between something like this and say using puppet to apply and manage CIS requirements?
by djschnei 10y ago
what would be the difference between something like this and say using puppet to apply and manage CIS requirements?
- antoncohen 10y agoI think that is a good point. If you can codify your security checks, there is a good chance you can write automation to fix them with configuration management. I think there may be some cases where you don't feel comfortable automating the full remediation, e.g., requires reboot, so separate audit system might be useful. There is also something nice about writing your audit rules, being able to show auditors "this is what we check for", and then running that across your infrastructure. In that case InSpec (http://inspec.io/ http://inspec.io/) might be more useful for writing custom compliance controls. It would be nice if there was a $CONGIG_MANAGEMENT_SYSTEM_OF_CHOICE module that did common security fixes, and you could just pick and choose which to apply. On a side note: Holy ^&$% Lynis has a lot of shell! Like a crazy amount of POSIX shell code!