STIG-Partitioned Enterprise Linux (spel) is a project that helps create and
publish Enterprise Linux images that are partitioned according to the
DISA STIG. The resulting images also use LVM to simplify volume management.
The images are configured with help from the scripts and packages in the
AMIgen7, and AMIgen8 projects.
VMs' root filesystems are generally not live-repartitionable once launced from
their images. As a result, if a STIG-scan is performed against most of the
community-published images for Red Hat and CentOS, those scans will note
failures for each of the various "${DIRECTORY} is on its own filesystem"
tests. The images produced through this project are designed to ensure that
these particular scan-failures do not occur.
Aside from addressing the previously-noted partitioning findings, spel does not apply any STIG-related hardening. The spel-produced images are expected to act as a better starting-point in a larger hardening process.
If your organization does not already have an automated hardening process, please see our tool, Watchmaker. This tool is meant to help spel-users (and users of other Enterprise Linux images) by performing launch-time hardening activities.
We've added an FAQ to the project. Hopefully, your questions are answered there. If they aren't, please feel free to submit an issue requesting an appropriate FAQ entry.
SPEL AMIs are published monthly. The AMI table below contains links to the AWS Console that search by AMI Name and sort the result by creation date. The most recent AMI of each build will be at the top when viewed in the AWS Console.
RPM Manifests for published images are available in the manifests directory.
| Vagrant Cloud Name | Vagrant Provider |
|---|---|
| plus3it/spel-minimal-centos-7 | virtualbox |
With the move from CentOS 8 to CentOS Stream 8, the CentOS 8 images are deprecated. While they remain public for the moment, they are no longer updated and the CentOS org may remove the yum repos at their discretion.
| AWS Region | Builder Name / Link |
|---|---|
| us-east-1 | spel-minimal-centos-8-hvm |
| us-east-2 | spel-minimal-centos-8-hvm |
| us-west-1 | spel-minimal-centos-8-hvm |
| us-west-2 | spel-minimal-centos-8-hvm |
| us-gov-west-1 | spel-minimal-centos-8-hvm |
| us-gov-east-1 | spel-minimal-centos-8-hvm |
The default username for all spel images is maintuser.
If you wish to change the default username at launch, you can do so via cloud-init
with userdata something like the following. Change <USERNAME> to your desired
value.
#cloud-config
system_info:
default_user:
name: <USERNAME>
gecos: spel default user
lock_passwd: true
sudo: ["ALL=(root) NOPASSWD:ALL"]Packer by Hashicorp is used to manage the process of building
images.
-
Download and extract
packerfor your platform. Add it to your PATH, if you like. On Linux, watch out for otherpackerexecutables with the same name... -
If building AMIs for Amazon Web Services, ensure your AWS credentials are configured. You do not really need the
awscli utility, but it is a convenient way to configure the credential file. You can also export the environment variables. Or, if runningpackerin an EC2 instance, an instance role with the requisite permissions will also work. See thepackerdocs for details on the necessary permissions.NOTE: No packer templates in this project will contain variables for AWS credentials; this is intentional, to avoid mistakes where credentials get committed to the repository. Instead,
packerknows to read the credentials from the credential file or from the environment variables, or to retrieve them from the instance role. See the docs. -
If building VirtualBox image(s), you will need to install VirtualBox and Vagrant.
-
If building VMware image(s), depending on your platform, you will need to install either VMware Fusion, VMware Workstation Pro, or VMware Player. For all platforms, you will also need Vagrant.
-
The template(s) push the Vagrant boxes for the VirtualBox and VMware images to Hashicorp Vagrant Cloud, which requires a Vagrant Cloud account.
-
If building a VHD or Image for Azure, ensure you have authorized access to ARM. The creation of destination objects and a Service Principal can either be done manually or via script. If not building in Public region, use of device login is not possible and a Service Principal is required.
NOTE: In all steps below, the examples use syntax that works on Linux. If you
are running packer from a Windows system, simply use the appropriate syntax
for the relative path to the packer template. Most important, for Windows,
use .\ preceding the path to the template. E.g.
.\spel\minimal-linux.json.
-
Clone the repository:
git clone https://github.com/plus3it/spel && cd spel
-
Validate the template (Optional):
packer validate spel/minimal-linux.pkr.hcl
-
Begin the build. This requires at least two variables,
spel_identifierandspel_version. See the section Packer Variables for more details.packer build \ -var 'spel_identifier=unique-project-id' \ -var 'spel_version=dev001' \ -var 'virtualbox_vagrantcloud_username=myvagrantclouduser' \ spel/minimal-linux.pkr.hclNOTE: This will build images for all the builders defined in the template. Use
packer build --helpto see how to restrict the build to to a subset of the builders using the-onlyor-exceptarguments.If building the VirtualBox or VMware images for use with Vagrant, the template is configured to host the resulting images with Hashicorp Vagrant Cloud. This requires passing the variable
virtualbox_vagrantcloud_usernameand exporting the environment variableVAGRANT_CLOUD_TOKEN.
The Minimal Linux template builds STIG-partitioned images with a set of packages that correspond to the "Minimal" install option in Anaconda. Further, the AWS images include a handful of additional packages that are intended to increase functionality in EC2 and make the images more comparable with Amazon Linux.
- Template Path:
spel/minimal-linux.pkr.hcl
For all inputs to the template, see spel/README.md
The Minimal Linux packer template includes the following builders:
| Builder Name | Description |
|---|---|
amazon-ebs.minimal-centos-8stream-hvm |
amazon-ebs builder for a minimal CentOS Stream 8 HVM AMI |
amazon-ebs.minimal-ol-8-hvm |
amazon-ebs builder for a minimal Oracle Linux 8 HVM AMI |
amazon-ebs.minimal-rhel-8-hvm |
amazon-ebs builder for a minimal RHEL 8 HVM AMI |
amazon-ebs.minimal-centos-7-hvm |
amazon-ebs builder for a minimal CentOS 7 HVM AMI |
amazon-ebs.minimal-rhel-7-hvm |
amazon-ebs builder for a minimal RHEL 7 HVM AMI |
azure-arm.minimal-centos-7-image |
azure-arm builder for a minimal CentOS 7 Image |
azure-arm.minimal-rhel-7-image |
azure-arm builder for a minimal RHEL 7 Image |
openstack.minimal-centos-7-image |
openstack builder for a minimal CentOS 7 Image |
virtualbox-iso.minimal-centos-7-image |
virtualbox-iso builder for a minimal CentOS 7 Vagrant Box |
The Minimal Linux packer template includes the following post-provisioners:
-
vagrant: The vagrant post-provisioner creates vagrant boxes from on thevirtualboxandvmwareimages. -
vagrant-cloud: The vagrant-cloud post-provisioners upload the vagrant boxes to Hashicorp Vagrant Cloud.
To build images for the AWS US GovCloud regions, us-gov-west-1 or us-gov-east-1,
it is necessary to pass several variables that are specific to the region. The
AMI filters below have been tested and/or created in us-gov-west-1 to work with the
spel template(s). Also, the builders should be restricted so as not to build
the Vagrant images.
packer build \
-var 'spel_identifier=unique-project-id' \
-var 'spel_version=dev001' \
-var 'aws_region=us-gov-west-1' \
-var 'aws_source_ami_filter_centos7_hvm={name = "*-Recovery (No-LVM)-ACB-CentOS7-HVM-SRIOV_ENA", owners = ["039368651566"]}' \
-var 'aws_source_ami_filter_centos8stream_hvm={name = "spel-bootstrap-centos-8stream-hvm-*.x86_64-gp2", owners = ["039368651566"]}' \
-exclude 'virtualbox-iso.*' \
spel/minimal-linux.pkr.hclA source Marketplace Image Offer or Custom Image Name and Resource Group are required from which to start the SPEL Azure build.
The resultant SPEL Image will be configured to use the Azure Linux agent, WALinuxAgent
per recommended configurations. Currently, the use of cloud-init exclusively
does not enable execution/installation of Azure VM Extensions. The below
variables also disable FIPS mode in the resultant SPEL VHD or Image. Currently,
the Azure Linux agent does not support FIPS mode when utilizing Azure VM
Extensions. If no plans exist to utilize Azure VM Extensions on VMs provisioned
from SPEL VHDs or Images, FIPS mode can be enabled, but the waagent configuration
must also be modified accordingly.
The variables referenced in the packer builds below should be modified with appropriate parameters for your environment. Any content between and including the < and > characters should be replaced.
Login to azure using the az cli. Packer will use the session setup by the az cli.
packer build \
-var 'spel_identifier=unique-project-id' \
-var 'spel_version=0.0.1' \
-var 'amigen_extra_rpms=["WALinuxAgent"]' \
-var 'amigen_fips_disable=true' \
-var 'amigen7_repo_names=["rhui-microsoft-azure-rhel7"]' \
-var 'azure_image_offer=rhel-raw' \
-var 'azure_image_publisher=RedHat' \
-var 'azure_image_sku=7-raw' \
-var 'azure_managed_image_resource_group_name=<resource group short name>' \
-only 'azure-arm.minimal-rhel-7-image' \
spel/minimal-linux.pkr.hclTo build images for an OpenStack environment, it is necessary to pass several variables that are specific to the environment. The CentOS 7 Generic Cloud image has been tested to work with the spel template(s). Also, the builders should be restricted so as not to build the Vagrant images.
source your_openstack_credentials_file.sh
packer build \
-var 'spel_identifier=spel' \
-var 'spel_version=0.0.1' \
-var 'openstack_insecure=false' \
-var 'openstack_flavor=your_flavor_name_for_temporary_instance' \
-var 'openstack_floating_ip_network=your_provider_network_name' \
-var 'openstack_networks=your_network_id_for_temporary_instance,second_network_id,etc.' \
-var 'openstack_security_groups=your_security_group_name_for_temporary_instance,second_sg_name,etc.' \
-var 'openstack_source_image_name=your_source_image_name' \
-only 'openstack.*' \
spel/minimal-linux.pkr.hclFor expected values, see links below:
- openstack_allow_insecure (true|false)
- openstack_flavor_name (string)
- openstack_floating_ip_network_name (string)
- openstack_network_ids (comma-separated list of strings)
- openstack_security_group_names (comma-separated list of strings)
- openstack_source_image_name (string)
The spel automation leverages the AMIgen7 project as a build-helper for creation of Amazon Machine Images. Due to the closely-coupled nature of the two projects, it's recommended that any changes made to AMIgen7 be tested with spel prior to merging changes to the AMIgen master branch.
To facilitate this testing, the runtime-variable amigen7_source_branch was added
to spel. Using this runtime-variable, in combination with the amigen7_source_url
runtime-variable, allows one to point spel to a fork/branch of AMIgen7 during a
integration-test build. To test, update your packer invocation by adding elements
like:
packer build \
-var 'amigen7_source_url=https://github.com/<FORK_USER>/AMIgen7.git' \
-var 'amigen7_source_branch=IssueNN' \
...
minimal-linux.pkr.hcl