Skip to content

Commit 30c3af2

Browse files
LordHepipudLordHepipud
committed
Adds security hardening to JEA profiles by always prohibit certain cmdlets
1 parent 117d20f commit 30c3af2

File tree

6 files changed

+112
-11
lines changed

6 files changed

+112
-11
lines changed

‎doc/100-General/10-Changelog.md

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,15 @@ documentation before upgrading to a new release.
77

88
Released closed milestones can be found on [GitHub](https://github.com/Icinga/icinga-powershell-framework/milestones?state=closed).
99

10-
## 1.12.0 (tbd)
10+
## 1.12.0 (2024-03-26)
1111

1212
[Issues and PRs](https://github.com/Icinga/icinga-powershell-framework/milestone/28)
1313

1414
### Bugfixes
1515

16+
* [#673](https://github.com/Icinga/icinga-powershell-framework/pull/673) Fixes a memory leak while fetching Windows EventLog information by using CLI tools and inside the Hyper-V provide
17+
* [#678](https://github.com/Icinga/icinga-powershell-framework/pull/678) Fixes various memory leaks in Icinga for Windows API core and check handler
18+
* [#680](https://github.com/Icinga/icinga-powershell-framework/pull/680) Fixes exception in some cases, when provider or metrics return values as `null` instead of `0` while units are being used for check objects
1619
* [#683](https://github.com/Icinga/icinga-powershell-framework/pull/683) Fixes JEA installer to exclude domain from user name length check, which can easily exceed the Windows 20 digits username limit
1720
* [#685](https://github.com/Icinga/icinga-powershell-framework/pull/685) Fixes an issue while trying to stop the JEA process in certain cases, which results in an error during installation but has no other effect on the environment
1821
* [#686](https://github.com/Icinga/icinga-powershell-framework/pull/686) Fixes certutil error handling and message output in case the icingaforwindows.pfx could not be created
@@ -30,16 +33,7 @@ Released closed milestones can be found on [GitHub](https://github.com/Icinga/ic
3033
* [#692](https://github.com/Icinga/icinga-powershell-framework/pull/692) Renames `Restart-IcingaWindowsService` to `Restart-IcingaForWindows` and adds alias for backwards compatibility to start unifying the Icinga for Windows cmdlets
3134
* [#693](https://github.com/Icinga/icinga-powershell-framework/pull/693) Adds new command `Restart-Icinga` to restart both, the Icinga Agent and Icinga for Windows
3235
* [#694](https://github.com/Icinga/icinga-powershell-framework/pull/694) Adds support for check objects not being added to summary header
33-
34-
## 1.11.2 (tbd)
35-
36-
[Issues and PRs](https://github.com/Icinga/icinga-powershell-framework/milestone/30)
37-
38-
### Bugfixes
39-
40-
* [#673](https://github.com/Icinga/icinga-powershell-framework/pull/673) Fixes a memory leak while fetching Windows EventLog information by using CLI tools and inside the Hyper-V provide
41-
* [#678](https://github.com/Icinga/icinga-powershell-framework/pull/678) Fixes various memory leaks in Icinga for Windows API core and check handler
42-
* [#680](https://github.com/Icinga/icinga-powershell-framework/pull/680) Fixes exception in some cases, when provider or metrics return values as `null` instead of `0` while units are being used for check objects
36+
* [#695](https://github.com/Icinga/icinga-powershell-framework/pull/695) Adds security hardening to JEA profiles by always prohibit certain cmdlets
4337

4438
## 1.11.1 (2023-11-07)
4539

‎lib/core/jea/Deny-IcingaJEACommand.psm1

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
function Deny-IcingaJEACommand()
2+
{
3+
param (
4+
[string]$Command = $null,
5+
[string]$FileComments = $null
6+
);
7+
8+
if ([string]::IsNullOrEmpty($Command) -eq $FALSE) {
9+
# Ensure certain commands are not added to the JEA profile
10+
switch ($Command.ToLower()) {
11+
'Register-ScheduledTask'.ToLower() {
12+
return $TRUE;
13+
};
14+
'Start-ScheduledTask'.ToLower() {
15+
return $TRUE;
16+
};
17+
'Unregister-ScheduledTask'.ToLower() {
18+
return $TRUE;
19+
};
20+
'New-ScheduledTaskAction'.ToLower() {
21+
return $TRUE;
22+
};
23+
'Invoke-IcingaWindowsScheduledTask'.ToLower() {
24+
return $TRUE;
25+
};
26+
'Start-IcingaWindowsScheduledTaskRenewCertificate'.ToLower() {
27+
return $TRUE;
28+
};
29+
'Register-IcingaWindowsScheduledTaskRenewCertificate'.ToLower() {
30+
return $TRUE;
31+
};
32+
'Stop-Process'.ToLower() {
33+
return $TRUE;
34+
};
35+
'Remove-EventLog'.ToLower() {
36+
return $TRUE;
37+
};
38+
'Unregister-IcingaEventLog'.ToLower() {
39+
return $TRUE;
40+
};
41+
'Remove-Item'.ToLower() {
42+
return $TRUE;
43+
};
44+
'Remove-ItemSecure'.ToLower() {
45+
return $TRUE;
46+
};
47+
'Stop-Service'.ToLower() {
48+
return $TRUE;
49+
};
50+
'Restart-Service'.ToLower() {
51+
return $TRUE;
52+
};
53+
'Copy-ItemSecure'.ToLower() {
54+
return $TRUE;
55+
};
56+
'Copy-Item'.ToLower() {
57+
return $TRUE;
58+
};
59+
'Move-Item'.ToLower() {
60+
return $TRUE;
61+
};
62+
'Restart-IcingaService'.ToLower() {
63+
return $TRUE;
64+
};
65+
'Restart-IcingaForWindows'.ToLower() {
66+
return $TRUE;
67+
};
68+
'Stop-IcingaWindowsService'.ToLower() {
69+
return $TRUE;
70+
};
71+
'Stop-IcingaService'.ToLower() {
72+
return $TRUE;
73+
};
74+
'Restart-IcingaService'.ToLower() {
75+
return $TRUE;
76+
};
77+
'Restart-IcingaForWindows'.ToLower() {
78+
return $TRUE;
79+
};
80+
}
81+
}
82+
83+
if ([string]::IsNullOrEmpty($FileComments) -eq $FALSE) {
84+
if ($FileComments.ToLower().Contains('ignorejea')) {
85+
return $TRUE;
86+
}
87+
}
88+
89+
return $FALSE;
90+
}

‎lib/core/jea/Get-IcingaCommandDependency.psm1

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ function Get-IcingaCommandDependency()
1212
return $CompiledList;
1313
}
1414

15+
if (Deny-IcingaJEACommand -Command $CmdName) {
16+
return $CompiledList;
17+
}
18+
1519
# Create the list container for our object type if not existing
1620
# => Function, Cmdlet, Alias, Modules, Application
1721
if ($CompiledList.ContainsKey($CmdType) -eq $FALSE) {

‎lib/core/jea/Get-IcingaFrameworkDependency.psm1

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ function Get-IcingaFrameworkDependency()
1616
$DeserializedFile = Read-IcingaPowerShellModuleFile -FileContent $ModuleContent;
1717
[array]$CheckCmd = $DeserializedFile.CommandList + $DeserializedFile.FunctionList;
1818

19+
if (Deny-IcingaJEACommand -Command $Command -FileComment $DeserializedFile.Comment) {
20+
return $DependencyList;
21+
}
22+
1923
foreach ($cmd in $CheckCmd) {
2024
if ($cmd -eq $Command) {
2125
continue;

‎lib/core/jea/Get-IcingaJEAConfiguration.psm1

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,10 @@ function Get-IcingaJEAConfiguration()
102102

103103
$DeserializedFile = Read-IcingaPowerShellModuleFile -File $ModuleFile.FullName;
104104

105+
if (Deny-IcingaJEACommand -FileComments $DeserializedFile.Comments) {
106+
continue;
107+
}
108+
105109
foreach ($FoundFunction in $DeserializedFile.FunctionList) {
106110
$DependencyList = Get-IcingaFrameworkDependency `
107111
-Command $FoundFunction `
@@ -187,6 +191,10 @@ function Get-IcingaJEAConfiguration()
187191

188192
$CommandType = ([string]$CmdData.CommandType).Replace(' ', '');
189193

194+
if (Deny-IcingaJEACommand -Command $cmd) {
195+
continue;
196+
}
197+
190198
$UsedCmdlets = Get-IcingaCommandDependency `
191199
-DependencyList $DependencyList `
192200
-CompiledList $UsedCmdlets `

‎lib/core/jea/Read-IcingaPowerShellModuleFile.psm1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,5 +177,6 @@ function Read-IcingaPowerShellModuleFile()
177177
'AliasList' = $AliasList;
178178
'ExportFunction' = $ExportFunctionList;
179179
'ExportCmdlet' = $ExportCmdletList;
180+
'Comments' = $Comments;
180181
};
181182
}

0 commit comments

Comments
 (0)