#
# Cookbook:: irrigate-orchard_base
# Recipe:: os-hardening
#
# Copyright: The Orchard
#

include_recipe 'auditd'
recipes = %w(
  packages
  limits
  login_defs
  minimize_access
  pam
  profile
  securetty
)

recipes.each do |cp|
  node.default['os-hardening']['components'][cp] = true
end

node['os-hardening']['components'].each do |component, state|
  include_recipe "os-hardening::#{component}" if state
end

# 1.3 Filesystem Integrity Checking
if node['os-hardening']['aide_enabled'] == true
  package 'aide'

  bash 'init_database' do
    not_if { ::File.exist?('/var/lib/aide/aide.db') }
    code <<-EOF
    set -euo pipefail
    IFS=$'\n\t'

    aide --init --config /etc/aide/aide.conf
    mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
    EOF
  end

  cron 'aide' do
    action :create
    hour '5'
    minute '30'
    user 'root'
    command '/usr/bin/nice -n 19 /usr/sbin/aide --check'
  end

end

restricted_packages = value_for_platform_family(
  'debian' => node['os-hardening']['restricted_packages'],
  'default' => node['os-hardening']['restricted_packages']
)

restricted_packages.each do |item|
  package item do
    action :remove
  end
end