security: Update on CIS benchmarks

acl/tests/kola_enforcing.yaml

@@ -112,6 +112,22 @@ tests:
   # TEMPORARY (AB#23640): Enable acl.packages.package-manifest in kola_enforcing.yaml once the mantle LKG carries it
   # - name: acl.packages.package-manifest
 
+  - name: acl.security.cis.logperms
+    exceptions:
+      - platforms: [qemu]
+        architectures: [aarch64]
+        reason: Flakiness on TCG-emulated arm64, failures due to slow device enumeration.
+  - name: acl.security.cis.modprobe
+    exceptions:
+      - platforms: [qemu]
+        architectures: [aarch64]
+        reason: Flakiness on TCG-emulated arm64, failures due to slow device enumeration.
+  - name: acl.security.cis.sshd
+    exceptions:
+      - platforms: [qemu]
+        architectures: [aarch64]
+        reason: Flakiness on TCG-emulated arm64, failures due to slow device enumeration.
+
   - name: bpf.execsnoop
     exceptions:
       - imageVariants: [acl-t]

build_library/rpm/build_image_util.sh

@@ -414,7 +414,7 @@ TMPFILES_SSHD
 # Support both traditional authorized_keys and Ignition's authorized_keys.d/ignition
 AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys.d/ignition
 SSHD_CONF
-    sudo chmod 644 "${ssh_config_dir}/sshd_config.d/10-authorized-keys.conf"
+    sudo chmod 600 "${ssh_config_dir}/sshd_config.d/10-authorized-keys.conf"
 
     # Phase 1 hardening: disable SSH password authentication at build time.
     # Closes the window between boot and WALinuxAgent provisioning where
@@ -428,7 +428,36 @@ PasswordAuthentication no
 KbdInteractiveAuthentication no
 ChallengeResponseAuthentication no
 SSHD_NOPASSWD
-    sudo chmod 644 "${ssh_config_dir}/sshd_config.d/50-acl-no-password-auth.conf"
+    sudo chmod 600 "${ssh_config_dir}/sshd_config.d/50-acl-no-password-auth.conf"
+
+    # CIS 5.2.7: Ensure SSH access is limited
+    # Deny root SSH access (matches AgentBaker's DenyUsers pattern).
+    # CIS requires at least one of AllowUsers/AllowGroups/DenyUsers/DenyGroups.
+    # CIS 5.2.10: Disable SSH forwarding (agent/TCP/X11/tunnel)
+    info "RPM mode: Adding CIS SSH access and forwarding restrictions"
+    sudo tee "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf" > /dev/null <<'SSHD_CIS'
+# CIS 5.2.7 - Ensure SSH access is limited
+# Azure Policy requires AllowUsers, but Azure admin names are dynamic.
+# Replace this file to narrow access, AllowUsers entries are additive.
+AllowUsers *
+DenyUsers root
+DenyGroups root
+# CIS 5.2.10 - Ensure SSH disableforwarding is enabled
+# OpenSSH keeps the first value, so a later drop-in cannot override this.
+DisableForwarding yes
+# CIS 5.2.23 - Ensure sshd granular forwarding is disabled
+# Keep the effective values explicit for CIS assessment.
+AllowTcpForwarding no
+AllowAgentForwarding no
+AllowStreamLocalForwarding no
+X11Forwarding no
+PermitTunnel no
+# CIS 5.2.16 - Ensure sshd MaxAuthTries is configured (<=4)
+# Note: counts keys offered, not accepted. Clients with >=4 loaded keys
+# should use IdentitiesOnly=yes to avoid "Too many authentication failures".
+MaxAuthTries 4
+SSHD_CIS
+    sudo chmod 600 "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf"
 
     # Ensure sshd_config includes the .d directory
     local sshd_config="${ssh_config_dir}/sshd_config"
@@ -439,13 +468,23 @@ SSHD_NOPASSWD
 # Include drop-in configurations
 Include /etc/ssh/sshd_config.d/*.conf
 SSHD_CONFIG_EOF
-        sudo chmod 644 "${sshd_config}"
     elif ! sudo grep -q "^Include.*/etc/ssh/sshd_config.d" "${sshd_config}"; then
         info "RPM mode: Adding Include directive to existing sshd_config"
         sudo sed -i '1i Include /etc/ssh/sshd_config.d/*.conf' "${sshd_config}"
     else
         info "RPM mode: sshd_config already has Include directive"
     fi
+    # CIS 5.2.1: Restrict SSH configuration to root.
+    sudo chown root:root \
+        "${sshd_config}" \
+        "${ssh_config_dir}/sshd_config.d/10-authorized-keys.conf" \
+        "${ssh_config_dir}/sshd_config.d/50-acl-no-password-auth.conf" \
+        "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf"
+    sudo chmod 600 \
+        "${sshd_config}" \
+        "${ssh_config_dir}/sshd_config.d/10-authorized-keys.conf" \
+        "${ssh_config_dir}/sshd_config.d/50-acl-no-password-auth.conf" \
+        "${ssh_config_dir}/sshd_config.d/60-acl-cis-hardening.conf"
 
     # Switch sshd to socket activation (matching Flatcar behavior)
     # The Azure Linux openssh RPM only ships sshd.service (traditional daemon).
@@ -1125,11 +1164,16 @@ _configure_cis_hardening_rpm() {
     info "RPM mode: Applying CIS Level 1 hardening"
 
     # 1.1.1.1: Blacklist cramfs kernel module
+    # 3.1.4: Blacklist sctp kernel module (matches AgentBaker modprobe-CIS.conf)
     sudo install -d -m 0755 "${root_fs_dir}/usr/lib/modprobe.d"
     sudo tee "${root_fs_dir}/usr/lib/modprobe.d/cis-blacklist.conf" > /dev/null <<'MODPROBE_CIS'
 # CIS 1.1.1.1 - Ensure cramfs kernel module is not available
 install cramfs /bin/false
 blacklist cramfs
+# CIS 3.1.4 - Ensure sctp kernel module is not available
+# /bin/true so modprobe callers get exit 0 (not a hard error from /bin/false)
+install sctp /bin/true
+blacklist sctp
 MODPROBE_CIS
     sudo chmod 0644 "${root_fs_dir}/usr/lib/modprobe.d/cis-blacklist.conf"
 
@@ -1146,12 +1190,6 @@ MODPROBE_CIS
     # 5.1.1 (cron daemon enabled):
     #   ACL does not ship cronie. No cron daemon exists to enable. Should be
     #   excluded from the ACL CIS benchmark.
-    #
-    # 5.5.2 (system accounts secured):
-    #   Requires SCE script execution which the assessor does not support yet.
-    #
-    # 6.1.3.1 (access to all logfiles configured):
-    #   Requires SCE script execution which the assessor does not support yet.
 
     # 1.4.x / 3.2.x: Sysctl hardening (network + ASLR)
     # Includes both IPv4 and IPv6 settings as required by the CIS benchmark.
@@ -1371,6 +1409,13 @@ Compress=yes
 JOURNALD_CIS
     sudo chmod 0644 "${root_fs_dir}/etc/systemd/journald.conf.d/cis.conf"
 
+    # tmpfiles.d: create /var/log/azure with 0750 at boot (CIS 6.1.3.1).
+    # 'd' creates the dir if missing, UMask=0027 handles file perms at runtime.
+    sudo tee "${root_fs_dir}/usr/lib/tmpfiles.d/cis-logfiles.conf" > /dev/null <<'TMPFILES_LOG'
+d /var/log/azure 0750 root root - -
+TMPFILES_LOG
+    sudo chmod 0644 "${root_fs_dir}/usr/lib/tmpfiles.d/cis-logfiles.conf"
+
     # 7.2.8: Home directory permissions
     sudo chmod 0700 "${root_fs_dir}/root"
     if [[ -d "${root_fs_dir}/home" ]]; then

sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs_rpm.sh

@@ -15,6 +15,18 @@ if [[ -f "${rootfs}/usr/lib/systemd/system/waagent.service" ]]; then
         "${rootfs}/usr/lib/systemd/system/waagent.service"
 fi
 
+# CIS 6.1.3.1: Restrict existing logs and new files created by waagent.
+if [[ -f "${rootfs}/usr/lib/systemd/system/waagent.service" ]]; then
+    mkdir -p "${rootfs}/usr/lib/systemd/system/waagent.service.d"
+    cat > "${rootfs}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf" <<'EOF'
+[Service]
+UMask=0027
+# Ignore missing paths and leave directory modes unchanged.
+ExecStartPre=-/bin/sh -c 'for path in /var/log/waagent.log /var/log/azure; do [ -e "$$path" ] || continue; /usr/bin/find "$$path" -xdev -type f -exec /usr/bin/chmod g-wx,o-rwx {} +; done'
+EOF
+    chmod 0644 "${rootfs}/usr/lib/systemd/system/waagent.service.d/cis-umask.conf"
+fi
+
 # Patch waagent service file to create symlink back to /etc/waagent.conf at ExecStartPre
 if [[ -f "${rootfs}/usr/lib/systemd/system/waagent.service" ]]; then
     # Insert ExecStartPre lines after the [Service] header