chef-infra-client.mql.yaml

policies:
  - uid: chef-infra-client
    name: Chef Infra Client Policy
    version: 1.0.1
    license: MPL-2.0
    tags:
      mondoo.com/category: security
      mondoo.com/platform: linux,unix
    authors:
      - name: Tim Smith
        email: tim@mondoo.com
    docs:
      desc: "Chef Infra Client Policy identifies insecure Chef Infra Client installations that could expose node credentials, as well as end of life client releases that no longer receive security updates per the [Chef Supported Versions documentation](https://docs.chef.io/versions/).\n  \nIf you have questions, comments, or have identified ways to improve this policy, please write me at tim@mondoo.com, or reach out in the [Mondoo Slack Community](https://mondoo.link/slack)."
    groups:
      - filters: |
          platform.family.contains(_ == 'unix')
          file("/opt/chef").exists
        checks:
          - uid: avoid-reporting-tokens-in-config
          - uid: client-pem-permissions
          - uid: client-rb-permissions
          - uid: disable-legacy-encrypted-data-bags
          - uid: etc-chef-directory-permissions
          - uid: non-eol-infra-client
          - uid: validation-pem-not-present
          - uid: var-chef-directory-permissions
          - uid: var-log-chef-directory-permissions
queries:
  - uid: etc-chef-directory-permissions
    title: Ensure /etc/chef/ is owned by root with 750 permissions
    impact: 80
    mql: |
      if (file("/etc/chef").exists) {
        file("/etc/chef") {
          user.name == 'root'
          permissions.user_readable == true
          permissions.user_writeable == true
          permissions.user_executable == true
          permissions.group_readable == true
          permissions.group_writeable == false
          permissions.group_executable == true
          permissions.other_readable == false
          permissions.other_writeable == false
          permissions.other_executable == false
        }
      }
    docs:
      desc: |
        The /etc/chef directory contains sensitive files configuring Chef Infra Client and should only be writeable by root and readable by root and the root group.
      remediation: |
        Run the following commands to set proper permissions on your /etc/chef directory:

        ```
        chown root:root /etc/chef
        chmod 700 /etc/chef
        ```
  - uid: var-chef-directory-permissions
    title: Ensure /var/chef/ is owned by root with 750 permissions
    impact: 80
    mql: |
      if (file("/var/chef").exists) {
        file("/var/chef") {
          user.name == 'root'
          permissions.user_readable == true
          permissions.user_writeable == true
          permissions.user_executable == true
          permissions.group_readable == true
          permissions.group_writeable == false
          permissions.group_executable == true
          permissions.other_readable == false
          permissions.other_writeable == false
          permissions.other_executable == false
        }
      }
    docs:
      desc: |
        The /var/chef directory contains sensitive system configuration backup files and cached remote_file downloads. It should only be writeable by root and readable by root and the root group.
      remediation: |
        Run the following commands to set proper permissions on your /var/chef directory:

        ```
        chown root:root /var/chef
        chmod 700 /var/chef
        ```
  - uid: var-log-chef-directory-permissions
    title: Ensure /var/log/chef/ is owned by root with 750 permissions
    mql: |
      if (file("/var/log/chef").exists) {
        file("/var/log/chef") {
          user.name == 'root'
          permissions.user_readable == true
          permissions.user_writeable == true
          permissions.user_executable == true
          permissions.group_readable == true
          permissions.group_writeable == false
          permissions.group_executable == true
          permissions.other_readable == false
          permissions.other_writeable == false
          permissions.other_executable == false
        }
      }
    docs:
      desc: |
        The /var/log/chef directory contains sensitive log files and should only be writeable by root and readable by root and the root group.
      remediation: |
        Run the following commands to set proper permissions on your /var/log/chef directory:

        ```
        chown root:root /var/log/chef
        chmod 700 /var/log/chef
        ```
  - uid: client-rb-permissions
    title: Ensure /etc/chef/client.rb is owned by root with 640 permissions
    impact: 100
    mql: |
      if (file("/etc/chef/client.rb").exists) {
        file("/etc/chef/client.rb") {
          user.name == 'root'
          permissions.user_readable == true
          permissions.user_writeable == true
          permissions.user_executable == false
          permissions.group_readable == true
          permissions.group_writeable == false
          permissions.group_executable == false
          permissions.other_readable == false
          permissions.other_writeable == false
          permissions.other_executable == false
        }
      }
    docs:
      desc: The /etc/chef/client.rb configuration file contains sensitive Infra Client configuration information. It should be owned by root and permissions should be set to 640.
      remediation: |
        Run the following commands to set proper permissions on your /etc/chef/client.rb file:

        ```
        chown root:root /etc/chef/client.rb
        chmod 640 /etc/chef/client.rb
        ```
  - uid: client-pem-permissions
    title: Ensure /etc/chef/client.pem is owned by root with 640 permissions
    impact: 100
    mql: |
      if (file("/etc/chef/client.pem").exists) {
        file("/etc/chef/client.pem") {
          user.name == 'root'
          permissions.user_readable == true
          permissions.user_writeable == true
          permissions.user_executable == false
          permissions.group_readable == true
          permissions.group_writeable == false
          permissions.group_executable == false
          permissions.other_readable == false
          permissions.other_writeable == false
          permissions.other_executable == false
        }
      }
    docs:
      desc: The /etc/chef/client.pem key file contains the key used to communicate with Chef Infra Server. It should be owned by root and permissions should be set to 640.
      remediation: |
        Run the following commands to set proper permissions on your /etc/chef/client.pem file:

        ```
        chown root:root /etc/chef/client.pem
        chmod 640 /etc/chef/client.pem
        ```
  - uid: validation-pem-not-present
    title: Ensure /etc/chef/validation.pem is not present
    impact: 100
    mql: |
      file("/etc/chef/validation.pem").exists == "false"
    docs:
      desc: The /etc/chef/validation.pem file can be used to register any system with Chef Infra Server and should not be left on system after they are bootstrapped into the Chef Infra organization.
      remediation: |
        Run the following command to remove the validation.pem file:

        ```
        rm /etc/chef/validation.pem
        ```
  - uid: non-eol-infra-client
    title: Ensure a non-EOL Chef Infra Client release is used
    impact: 70
    mql: |
      command("chef-client -v") {
        stdout == /^Chef Infra Client: (16|17|18|19|20|21).*/
      }
    docs:
      desc: Chef Infra Client is released once a year in April and 2 major versions are supported at any time (N-1). Prior releases do not receive security updates and should not be used in production environments. See the [Chef Supported Versions documentation](https://docs.chef.io/versions/) for an up-to-date list of supported Infra Client releases.
      remediation: Upgrade to a non-EOL release of Chef Infra Client. Note that this will require validation of cookbook content for compatibility as newer major version releases introduce breaking changes.
  - uid: disable-legacy-encrypted-data-bags
    title: Disable support for less secure Encrypted Data Bag versions
    impact: 80
    mql: |
      if (file("/etc/chef/client.rb").exists) {
        file("/etc/chef/client.rb").content.contains("data_bag_decrypt_minimum_version 3")
      }
    docs:
      desc: Encrypted Data Bags v0, v1, and v2 are less secure than v3 and should not be used. See https://docs.chef.io/data_bags/#encryption-versions for more details on the encryption versions.
      remediation: To set the Infra Client to only accept encrypted data bags v3 or above set `data_bag_decrypt_minimum_version 3` in the `client.rb` file.
  - uid: avoid-reporting-tokens-in-config
    title: Avoid storing Automate tokens in the client.rb config
    impact: 70
    mql: |
      if (file("/etc/chef/client.rb").exists) {
        file("/etc/chef/client.rb").content.contains("data_collector.token") == false
      }
    docs:
      desc: When sending reporting data directly to Automate an Automate API token must be stored in the `client.rb` configuration file. Instead of setting the token, proxy Infra Client report data through the Infra Server so that the Automate API token only needs to be stored in the Infra Server.
      remediation: See https://docs.chef.io/server/config_rb_server_optional_settings/#data_collector-14 for more information on configuring the Infra Server to proxy reporting data. Once the Infra Server has been configured for proxying you can set `data_collector.server_url` in client.rb to the URL of the Infra Server and remove the `data_collector.token` configuration.