diff --git a/CHANGELOG.md b/CHANGELOG.md index 625a5a7..0eedafb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,7 @@ +## [2.1.0] - 2026-07-22 +### Added +- Add support for 'Domain controller: LDAP server signing requirements enforcement' and 'Network security: LDAP client encryption requirements' + ## [2.0.0] - 2026-07-21 ### Changed - **BREAKING**: Replace Puppet 6/7 support with OpenVox 8; CI now runs on Ruby 3.2 and Ruby 4.0. The Gemfile now depends on the `openvox` gem (via `voxpupuli-test`) instead of `puppet`, and `PUPPET_VERSION` replaces `PUPPET_GEM_VERSION` diff --git a/README.md b/README.md index 6188d1f..3de1539 100644 --- a/README.md +++ b/README.md @@ -124,6 +124,12 @@ local_security_policy { 'System cryptography: Use FIPS compiant algorithms for e Devices: Prevent users from installing printer drivers Devices: Restrict CD-ROM access to locally logged-on user only Devices: Restrict floppy access to locally logged-on user only + Domain controller: Allow server operators to schedule tasks + Domain controller: Allow vulnerable Netlogon secure channel connections + Domain controller: LDAP server channel binding token requirements + Domain controller: LDAP server signing requirements + Domain controller: LDAP server signing requirements enforcement + Domain controller: Refuse machine account password changes Domain member: Digitally encrypt or sign secure channel data (always) Domain member: Digitally encrypt secure channel data (when possible) Domain member: Digitally sign secure channel data (when possible) @@ -131,6 +137,7 @@ local_security_policy { 'System cryptography: Use FIPS compiant algorithms for e Domain member: Maximum machine account password age Domain member: Require strong (Windows 2000 or later) session key EnableAdminAccount + EnableGuestAccount Enable computer and user accounts to be trusted for delegation Enforce password history Force shutdown from a remote system @@ -185,13 +192,14 @@ local_security_policy { 'System cryptography: Use FIPS compiant algorithms for e Network access: Restrict clients allowed to make remote calls to SAM Network access: Shares that can be accessed anonymously Network access: Sharing and security model for local accounts - Network security: All Local System to use computer identity for NTLM + Network security: Allow Local System to use computer identity for NTLM Network security: Allow LocalSystem NULL session fallback Network security: Allow PKU2U authentication requests to this computer to use online identities Network security: Configure encryption types allowed for Kerberos Network security: Do not store LAN Manager hash value on next password change Network security: Force logoff when logon hours expire Network security: LAN Manager authentication level + Network security: LDAP client encryption requirements Network security: LDAP client signing requirements Network security: Minimum session security for NTLM SSP based (including secure RPC) clients Network security: Minimum session security for NTLM SSP based (including secure RPC) servers diff --git a/lib/puppet_x/lsp/security_policy.rb b/lib/puppet_x/lsp/security_policy.rb index e75e277..adc86e7 100644 --- a/lib/puppet_x/lsp/security_policy.rb +++ b/lib/puppet_x/lsp/security_policy.rb @@ -578,6 +578,11 @@ def self.lsp_mapping reg_type: '4', policy_type: 'Registry Values', }, + 'Domain controller: LDAP server signing requirements enforcement' => { + name: 'MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerEnforceIntegrity', + reg_type: '4', + policy_type: 'Registry Values', + }, 'Domain controller: Refuse machine account password changes' => { name: 'MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange', reg_type: '4', @@ -826,6 +831,11 @@ def self.lsp_mapping reg_type: '4', policy_type: 'Registry Values', }, + 'Network security: LDAP client encryption requirements' => { + name: 'MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientConfidentiality', + reg_type: '4', + policy_type: 'Registry Values', + }, 'Network security: LDAP client signing requirements' => { name: 'MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity', reg_type: '4', diff --git a/metadata.json b/metadata.json index e42ccfa..15c1af1 100644 --- a/metadata.json +++ b/metadata.json @@ -1,6 +1,6 @@ { "name": "ayohrling-local_security_policy", - "version": "2.0.0", + "version": "2.1.0", "author": "Paul S. Cannon, Adam Yohrling, Corey Osman, Ryan Russell-Yates, Jordan Wesolowski, Gerben Welter, Thomas Linkin, Andy Adrian, Steven Pritchard", "summary": "Windows Local Security Policy management. Forked from cannonps/local_security_policy", "license": "Apache-2.0", diff --git a/spec/unit/puppet/provider/local_security_policy/security_policy_spec.rb b/spec/unit/puppet/provider/local_security_policy/security_policy_spec.rb index 8f3c6f6..8ba4fa2 100644 --- a/spec/unit/puppet/provider/local_security_policy/security_policy_spec.rb +++ b/spec/unit/puppet/provider/local_security_policy/security_policy_spec.rb @@ -105,6 +105,8 @@ ['MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LdapEnforceChannelBinding', '4'], 'Domain controller: LDAP server signing requirements' => ['MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity', '4'], + 'Domain controller: LDAP server signing requirements enforcement' => + ['MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerEnforceIntegrity', '4'], 'Domain controller: Refuse machine account password changes' => ['MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange', '4'], }.each do |policy_desc, (reg_key, reg_type)| @@ -131,6 +133,25 @@ end end + describe 'additional policy mappings' do + { + 'Network security: LDAP client encryption requirements' => + ['MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientConfidentiality', '4'], + }.each do |policy_desc, (reg_key, reg_type)| + it "maps #{policy_desc}" do + mapping = SecurityPolicy.find_mapping_from_policy_desc(policy_desc) + expect(mapping[:name]).to eq(reg_key) + expect(mapping[:reg_type]).to eq(reg_type) + expect(mapping[:policy_type]).to eq('Registry Values') + end + + it "reverse maps #{reg_key}" do + name, = SecurityPolicy.find_mapping_from_policy_name(reg_key) + expect(name).to eq(policy_desc) + end + end + end + describe 'privilege right' do let(:resource) do Puppet::Type.type(:local_security_policy).new(