default['os-hardening']['pwquality_conf'] = [
  'minlen=14',
  'dcredit=-1',
  'ucredit=-1',
  'ocredit=-1',
  'lcredit=-1',
].join("\n")
default['os-hardening']['auth']['retries'] = 5
default['os-hardening']['auth']['lockout_time'] = 900
default['os-hardening']['auth']['pw_max_age'] = 90
override['os-hardening']['components']['pam'] = false
default['os-hardening']['aide_enabled'] = true
default['os-hardening']['restricted_packages'] = %w(
  telnet
  mcstrans
)
default['os-hardening']['centos_extra_restricted_packages'] = %w(telnet-server)
default['os-hardening']['bootloader_path'] = {
  'redhat' => {
    '6' => '/boot/grub/grub.cfg',
    '7' => '/boot/grub2/grub.cfg',
  },
  'centos' => {
    '6' => '/boot/grub/grub.cfg',
    '7' => '/boot/grub2/grub.cfg',
  },
  'ubuntu' => {
    '12' => '/boot/grub/grub.cfg',
  },
}
default['os-hardening']['auth']['pw_max_age'] = 30
default['os-hardening']['auth']['pw_min_age'] = 7
default['os-hardening']['auth']['pw_warn_age'] = 7
default['os-hardening']['env']['umask'] = '027'
default['auditd']['ruleset'] = 'cis'
default['auditd']['admin_space_left'] = 250
default['auditd']['space_left'] = 500
default['auditd']['enable_local_events'] = true
default['auditd']['freq'] = 50
default['auditd']['max_log_file'] = 8
default['auditd']['num_logs'] = 5
default['auditd']['priority_boost'] = 4
default['auditd']['log_file'] = '/var/log/audit/audit.log'
default['auditd']['max_log_file_action'] = 'keep_logs'
default['auditd']['space_left_action'] = 'email'
default['auditd']['action_mail_acct'] = 'root'
default['auditd']['admin_space_left_action'] = 'rotate'
default['auditd']['log_group'] = 'root'
default['auditd']['log_format'] = 'RAW'
default['auditd']['flush'] = 'INCREMENTAL_ASYNC'
default['auditd']['disp_qos'] = 'lossy'
default['auditd']['name_format'] = 'NONE'
default['auditd']['disk_full_action'] = 'SUSPEND'
default['auditd']['disk_error_action'] = 'SUSPEND'
default['auditd']['use_libwrap'] = 'yes'
default['auditd']['tcp_listen_queue'] = 5
default['auditd']['tcp_max_per_addr'] = 1
default['auditd']['tcp_client_max_idle'] = 0
default['auditd']['enable_krb5'] = 'no'
default['auditd']['krb5_principal'] = 'auditd'
default['auditd']['distribute_network'] = 'no'