Commit Graph

123 Commits

Author SHA1 Message Date
Martin Angers
33f33163a9
Add macos custom profiles support via fleetctl apply (#9824) 2023-02-15 13:01:44 -05:00
Sharon Katz
4c22fbffd6
rename cis label to win10-stand-alone (#9816) 2023-02-14 14:52:15 -05:00
Sharon Katz
9125263c14
add details to CIS label (#9811) 2023-02-14 10:05:44 -05:00
Sharon Katz
0ddd0d64f7
CIS_fix_desc_errors (#9789) 2023-02-10 12:48:44 -05:00
Artemis Tosini
d36e89a0ef
Add macOS CIS 6.3.3 (Safari Safe Browsing) (#9778) 2023-02-09 13:46:42 -05:00
Lucas Manuel Rodriguez
4a5ce51d49
CIS yaml fixes (#9775) 2023-02-09 15:28:47 -03:00
Sharon Katz
1fc799577d
CIS 6.4.1 (#9773) 2023-02-09 13:22:36 -05:00
Sharon Katz
c7827cf5b1
CIS 6.3.7 (#9767) 2023-02-09 13:15:21 -05:00
Artemis Tosini
6b50914500
Add macOS CIS 2.3.3.10 (Media Sharing) (#9666) 2023-02-09 12:55:22 -05:00
Lucas Manuel Rodriguez
9fa2be0a86
Add check for CIS 5.10 (#9755)
#9260

- ~[ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.~
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- ~[ ] Added/updated tests~
- [X] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-02-09 14:28:22 -03:00
Lucas Manuel Rodriguez
399a6f53e7
Add check for CIS 6.3.4 (#9766)
#9261
2023-02-09 14:28:02 -03:00
Lucas Manuel Rodriguez
4638e8564f
Add check for CIS 5.6 (#9756)
#9260

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-02-09 14:27:40 -03:00
Lucas Manuel Rodriguez
8af2b56cd5
Add check for macOS CIS 5.9 (#9765)
#9260

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- ~[ ] Added/updated tests~
- [X] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-02-09 14:05:55 -03:00
Artemis Tosini
a92b311030
Add macOS CIS 6.3.1 (Safari Automatic Opening) (#9759) 2023-02-09 11:41:18 -05:00
Artemis Tosini
6d82515b02
Add macOS CIS 2.3.3.8 (Internet Sharing) (#9663) 2023-02-09 11:15:40 -05:00
Lucas Manuel Rodriguez
c6e1447084
Add check for CIS 6.3.6 (#9768)
#9261
2023-02-09 12:36:40 -03:00
Lucas Manuel Rodriguez
7fc3613dc5
Add CIS checks for 5.4 and 5.5 (#9747)
#9260

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-02-09 12:35:43 -03:00
Sharon Katz
c248968ba3
CIS 2.3.3.9 (#9752) 2023-02-08 15:43:03 -05:00
Artemis Tosini
9fd70ee9e0
Add macOS CIS 2.3.3.7 (Remote Apple Events) (#9751) 2023-02-08 14:13:11 -05:00
Lucas Manuel Rodriguez
2265c84b2a
Add CIS check for 5.8 (#9750)
#9260

- ~[ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.~
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- ~[ ] Added/updated tests~
- [X] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-02-08 13:38:17 -03:00
Lucas Manuel Rodriguez
d4a1b4d218
Add CIS checks for 2.9.X and add pmset table to fleetd (#9470)
#9253

- ~[ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.~
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~

---------

Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com>
2023-02-08 13:08:17 -03:00
Artemis Tosini
b6968892b0
Add macOS CIS 6.1.1 (Show All Filename Extensions) (#9740)
This adds CIS 6.1.1
---------
Co-authored-by: Sharon Katz <sharon@fleetdm.com>
Approved by: Sharon Katz <sharon@fleetdm.com>
2023-02-08 10:51:42 -05:00
Lucas Manuel Rodriguez
086ec05ca7
Add CIS check for 5.7 (#9748)
#9260

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
2023-02-08 12:30:55 -03:00
Sharon Katz
9672f03d37
CIS 5.1.5/5.1.6/5.1.7 (#9726) 2023-02-08 10:11:20 -05:00
Sharon Katz
84fcee9130
CIS 5.1.3+5.1.4 (#9642) 2023-02-07 13:26:05 -05:00
Artemis Tosini
61da4d3331
Add macOS CIS 2.3.3.4 (Printer Sharing) (#9665)
This makes sure printer sharing is disabled on macOS using the CUPS
configuration file. This script makes a change that both works and is
reflected in the macOS UI, unlike many of the scripts
2023-02-06 17:12:17 -05:00
Artemis Tosini
857e6830d8
Add macOS CIS 2.3.3.11 (Bluetooth Sharing) (#9688)
This adds a test for 2.3.3.11, which verifies that all users have
Bluetooth sharing disabled.

It's not possible to create a profile and it's challenging to write a
script, so testing must be done manually.
As with all sharing tests, the machine will be compliant out of the box.
For QA you should open the sharing preference pane (System Settings >
General > Sharing) and then enable Bluetooth sharing and this test
should fail. Switching bluetooth sharing back off will fix it.
2023-02-06 15:29:47 -05:00
Artemis Tosini
21428cb6a6
Add the first queries of CIS 2.3.3 looking at launchd overrides (#9619)
This adds all the CIS 2.3.3.x queries that are nearly identical and
based on launch agent overrides
2023-02-06 15:27:42 -05:00
Artemis Tosini
985c051ebb
Add macOS CIS 2.3.3.6 (Remote Management) (#9664)
I can't find any way of adding a policy to remove ARD but this uses an
officially documented script to disable it which works on my mac.
2023-02-06 13:13:38 -05:00
Sharon Katz
7aefd5c73b
Cis 3.4 (#9554) 2023-02-06 13:13:11 -05:00
Marcos Oviedo
18592d17ad
Adding CIS checks for for Win10 benchmark - Password policies 1.1.x (#9634)
This relates to #9581
2023-02-03 14:11:22 -03:00
Sharon Katz
aae824804b
Cis 3.3 (#9578) 2023-02-02 13:16:45 -05:00
Sharon Katz
d33b8e6e05
CIS 3.5 (#9592) 2023-02-02 13:13:20 -05:00
Sharon Katz
16d7091600
CIS_3.2 (#9522) 2023-02-02 13:08:02 -05:00
Sharon Katz
647c15a909
CIS 5.1.1 (#9617) 2023-02-02 12:50:01 -05:00
Sharon Katz
2957ea9bf4
CIS 5.1.2 (#9623) 2023-02-02 10:22:22 -05:00
Sharon Katz
b60f063e09
CIS 3.6 (#9582) 2023-02-01 17:35:50 -05:00
Martin Angers
c805ea2154
Record activity when the macos minimum version requirement is edited (#9594) 2023-01-31 16:36:18 -06:00
Roberto Dip
4c4c114e96
add mocks + tests and move things around (#9574)
#8948

- Add more go:generate commands for MDM mocks
- Add unit and integration tests for MDM code
- Move interfaces from their PoC location to match existing patterns
2023-01-31 11:46:01 -03:00
Zach Wasserman
7531ac20db
Use stricter file permissions in fleetctl updates add (#9516)
This resolves an issue with adding updates on a macOS 13 machine. It
seems like macOS may have changed the default directory permissions and
these new stricter permissions are compatible with that default.

This is the error that was encountered before these changes:

```
Error: create dst dir for copy: Path staged/targets already exists with
mode 20000000700 instead of the expected 20000000755
```

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Manual QA for all new/changed functionality
2023-01-30 17:28:56 -08:00
Sharon Katz
ed314592c3
CIS 5.2 fixes (#9549) 2023-01-30 12:52:33 -05:00
Lucas Manuel Rodriguez
bfe27475c1
Fix cis yaml (#9531)
The PR fixes the broken yaml in main and adds checks so that it doesn't
happen again.
2023-01-27 14:58:00 -03:00
Sharon Katz
218f10eefe
Cis 2.12.2 (#9525) 2023-01-27 11:16:41 -05:00
Sharon Katz
aa513e722c
CIS 3.1 (#9510) 2023-01-26 16:53:58 -05:00
Sharon Katz
3aa2a607e7
CIS 5.2.x queries (#9501) 2023-01-26 16:22:21 -05:00
Lucas Manuel Rodriguez
91c93285d8
Add WIP macOS 13 CIS policy queries (#9497)
#9429
2023-01-25 16:15:12 -03:00
Roberto Dip
2d25a3f48d
add mdm root key and macos_updates to app and team configs (#9442)
Related to https://github.com/fleetdm/fleet/issues/9345,
https://github.com/fleetdm/fleet/issues/9358 and
https://github.com/fleetdm/fleet/issues/9346 this adds:

1. The ability to configure `mdm.macos_updates` via `PATCH /config` and
`PATCH /teams/{id}`
3. The ability to configure `mdm.macos_updates` by using `fleetctl apply
-f` for teams and global config.
2023-01-24 13:20:02 -03:00
Martin Angers
656e5bfc70
Flag when the Apple BM terms have expired (#9091)
#8862 

Co-authored-by: Roberto Dip <dip.jesusr@gmail.com>
Co-authored-by: gillespi314 <73313222+gillespi314@users.noreply.github.com>
2023-01-06 17:44:20 -03:00
Zach Wasserman
d5e4a9a66f
Signing tool for MDM Push CSRs (#8884)
This PR provides the tooling that fleetdm.com will use to sign MDM Push
CSRs.

This was tested against the output of #8812, and the resulting requests
were validated to be accepted by Apple.

Co-authored-by: Roberto Dip <me@roperzh.com>
Co-authored-by: Roberto Dip <dip.jesusr@gmail.com>
2023-01-06 08:25:54 -08:00
Frank Sievertsen
91c90b4caa
Add new configuration option to set default team for Apple Business Manager (#9062) 2023-01-03 16:14:18 -06:00