cfbs.json

{
  "name": "modules",
  "description": "Repository of modules written by the CFEngine team.",
  "type": "module",
  "provides": {
    "allow-all-hosts": {
      "description": "Allows all hosts / IP addresses to connect and fetch policy.",
      "subdirectory": "management/allow-all-hosts",
      "steps": ["json def.json def.json"]
    },
    "autorun": {
      "description": "Enable autorun functionality.",
      "subdirectory": "management/autorun",
      "steps": ["json def.json def.json"]
    },
    "autorun-bundles": {
      "description": "Enable automatic execution of bundles tagged 'autorun'.",
      "subdirectory": "management/autorun-bundles",
      "steps": ["json def.json def.json"]
    },
    "autorun-inputs": {
      "description": "Enable automatic loading of policy files in 'services/autorun/'.",
      "subdirectory": "management/autorun-inputs",
      "steps": ["json def.json def.json"]
    },
    "disable-recommendations": {
      "description": "Disable all recommendations emitted from the Masterfiles Policy Framework (MPF).",
      "subdirectory": "management/disable-recommendations",
      "steps": ["json def.json def.json"]
    },
    "client-initiated-reporting": {
      "description": "Enable client initiated reporting and disable pull collection.",
      "subdirectory": "reporting/client-initiated-reporting",
      "steps": ["json def.json def.json"]
    },
    "command-dispatcher": {
      "description": "Command dispatcher for running shell commands on schedule",
      "subdirectory": "management/command-dispatcher",
      "steps": [
        "copy main.cf services/cfbs/modules/command-dispatcher/main.cf",
        "policy_files services/cfbs/modules/command-dispatcher/main.cf",
        "bundles command_dispatcher:main",
        "input ./input.json def.json"
      ],
      "input": [
        {
          "type": "list",
          "variable": "commands_to_run",
          "namespace": "command_dispatcher",
          "bundle": "main",
          "label": "Command",
          "subtype": [
            {
              "key": "command",
              "type": "string",
              "label": "Command",
              "question": "Command to run"
            },
            {
              "key": "condition",
              "type": "string",
              "label": "Condition",
              "question": "Condition for when to run",
              "default": "any"
            },
            {
              "key": "ifelapsed",
              "type": "string",
              "label": "ifelapsed",
              "question": "Number of minutes between promise assessments",
              "default": "5"
            }
          ],
          "while": "Do you want to specify more commands to be run?"
        }
      ]
    },
    "conditional-installer": {
      "description": "Allows you to specify packages you want installed and conditions for where you want them installed, as well as a list of packages you generally want uninstalled.",
      "subdirectory": "security/conditional-installer",
      "steps": [
        "copy main.cf services/cfbs/modules/conditional-installer/main.cf",
        "input ./input.json def.json",
        "bundles conditional_installer:main",
        "policy_files services/cfbs/modules/conditional-installer/main.cf"
      ],
      "input": [
        {
          "type": "string",
          "variable": "packages_to_uninstall",
          "namespace": "conditional_installer",
          "bundle": "main",
          "label": "Uninstall",
          "question": "Which package(s) would you like to be uninstalled?"
        },
        {
          "type": "list",
          "variable": "packages_to_install",
          "namespace": "conditional_installer",
          "bundle": "main",
          "label": "Install",
          "subtype": [
            {
              "key": "packages",
              "type": "string",
              "label": "Package(s)",
              "question": "Package(s) to install"
            },
            {
              "key": "condition",
              "type": "string",
              "label": "Condition",
              "question": "Condition for where to install"
            },
            {
              "key": "why",
              "type": "string",
              "label": "Why",
              "question": "Why?",
              "default": "Unknown"
            }
          ],
          "while": "Do you want to specify more packages to be installed?"
        }
      ]
    },
    "delete-home-dotrhosts": {
      "description": "Ensure that ~/.rhosts files are not present, as they present a security risk.",
      "subdirectory": "security/delete-home-dotrhosts",
      "steps": [
        "copy policy/main.cf services/cfbs/delete-home-dotrhosts/",
        "policy_files services/cfbs/delete-home-dotrhosts/",
        "bundles delete_home_dotrhosts:main"
      ]
    },
    "delete-home-dotshosts": {
      "description": "Ensure that ~/.shosts files are not present, as they present a security risk.",
      "subdirectory": "security/delete-home-dotshots",
      "steps": [
        "copy policy/main.cf services/cfbs/delete-home-dotshots/",
        "policy_files services/cfbs/delete-home-dotshots/",
        "bundles delete_home_dotshosts:main"
      ]
    },
    "demo": {
      "description": "Enables convenient and insecure settings for demoing CFEngine.",
      "subdirectory": "management/demo",
      "dependencies": ["autorun", "every-minute"],
      "steps": ["json def.json def.json"]
    },
    "disable-automatic-key-trust": {
      "description": "Makes the hub / policy server stop accepting new keys automatically.",
      "subdirectory": "management/disable-automatic-key-trust",
      "steps": ["json def.json def.json"]
    },
    "enable-aslr": {
      "description": "Ensure that Address space layout randomization (ASLR) is enabled on the system.",
      "subdirectory": "security/enable-aslr",
      "steps": [
        "copy enable-aslr.cf services/cfbs/modules/enable-aslr/enable-aslr.cf",
        "bundles enable_aslr",
        "policy_files services/cfbs/modules/enable-aslr/enable-aslr.cf"
      ]
    },
    "every-minute": {
      "description": "Make policy fetching, evaluation, and reporting happen every minute.",
      "subdirectory": "management/every-minute",
      "steps": ["json def.json def.json"]
    },
    "inventory-unshadowed-users": {
      "description": "Adds reporting data (inventory) on local users in /etc/passwd not using /etc/shadow for their password.",
      "subdirectory": "security/inventory-unshadowed-users",
      "dependencies": ["library-parsed-local-users"],
      "steps": [
        "copy policy/main.cf services/cfbs/inventory-unshadowed-users/",
        "policy_files services/cfbs/inventory-unshadowed-users/",
        "bundles inventory_unshadowed_users:main"
      ]
    },
    "inventory-windows-services": {
      "description": "Inventory running Windows services.",
      "subdirectory": "inventory/inventory-windows-services",
      "steps": [
        "copy inventory-windows-services.cf services/cfbs/inventory-windows-services/",
        "policy_files services/cfbs/inventory-windows-services/",
        "bundles inventory_windows_services_running"
      ]
    },
    "inventory-fde": {
      "description": "Inventory full disk encryption status (LUKS, FileVault, BitLocker).",
      "tags": ["inventory", "security"],
      "subdirectory": "inventory/inventory-fde",
      "steps": [
        "copy inventory-fde.cf services/cfbs/modules/inventory-fde/inventory-fde.cf",
        "policy_files services/cfbs/modules/inventory-fde/inventory-fde.cf",
        "bundles inventory_fde:main"
      ]
    },
    "library-for-promise-types-in-bash": {
      "description": "Library enabling promise types implemented in bash.",
      "subdirectory": "libraries/bash",
      "steps": ["copy cfengine.sh modules/promises/"]
    },
    "library-for-promise-types-in-python": {
      "description": "Library enabling promise types implemented in python.",
      "subdirectory": "libraries/python",
      "steps": [
        "copy cfengine_module_library.py modules/promises/cfengine_module_library.py",
        "replace_version 2 0.0.0 modules/promises/cfengine_module_library.py",
        "copy cfengine_module_library.py modules/promises/cfengine.py",
        "replace_version 2 0.0.0 modules/promises/cfengine.py"
      ]
    },
    "maintainers-in-motd": {
      "description": "Add maintainer and purpose information from CMDB to /etc/motd",
      "subdirectory": "security/maintainers-in-motd",
      "steps": [
        "copy ./maintainers-in-motd.cf services/cfbs/modules/maintainers-in-motd.cf",
        "policy_files services/cfbs/modules/maintainers-in-motd.cf",
        "bundles maintainers_in_motd"
      ]
    },
    "powershell-execution-policy": {
      "description": "Inventory and bundle for PowerShell Execution Policy",
      "subdirectory": "management/powershell-execution-policy",
      "steps": [
        "directory ./ services/cfbs/powershell-execution-policy/",
        "policy_files services/cfbs/powershell-execution-policy/",
        "bundles powershell_execution_policy_inventory"
      ]
    },
    "package-method-ansible-galaxy-collection": {
      "description": "Package method for installing Ansible Galaxy Collections.",
      "subdirectory": "management/package-method-ansible-galaxy-collection",
      "dependencies": [],
      "steps": [
        "directory ./ services/cfbs/modules/package-method-ansible-galaxy-collection/",
        "policy_files services/cfbs/modules/package-method-ansible-galaxy-collection/"
      ]
    },
    "package-method-winget": {
      "description": "Package method for Windows winget package manager.",
      "subdirectory": "management/package-method-winget",
      "dependencies": ["powershell-execution-policy"],
      "steps": [
        "input ./input.json def.json",
        "directory ./ services/cfbs/modules/package-method-winget/",
        "policy_files services/cfbs/modules/package-method-winget/",
        "bundles package_method_winget:package_method_winget winget_installed:winget_installed"
      ],
      "input": [
        {
          "type": "string",
          "variable": "accept_source_agreements",
          "namespace": "data",
          "bundle": "package_method_winget",
          "label": "Accept Source Agreements",
          "question": "Would you like to accept source agreements for winget packages promises? [yes|no]"
        },
        {
          "type": "string",
          "variable": "accept_package_agreements",
          "namespace": "data",
          "bundle": "package_method_winget",
          "label": "Accept Package Agreements",
          "question": "Would you like to accept package agreements for winget packages promises? [yes|no]"
        },
        {
          "type": "string",
          "variable": "allow_powershell_execution_policy_change",
          "namespace": "data",
          "bundle": "winget_installed",
          "label": "Allow necessary PowerShell Execution Policy change: LocalMachine set to Unrestricted in order to install winget and cmdlets",
          "question": "Would you like to allow this module to change PowerShell Execution Policy to LocalMachine:Unrestricted? [yes|no]"
        }
      ]
    },
    "promise-type-ansible": {
      "description": "Promise type to manage systemd services.",
      "subdirectory": "promise-types/ansible",
      "dependencies": ["library-for-promise-types-in-python"],
      "steps": [
        "copy ansible_promise.py modules/promises/",
        "append enable.cf services/init.cf"
      ]
    },
    "promise-type-git": {
      "description": "Promise type to manage git repos.",
      "subdirectory": "promise-types/git",
      "dependencies": ["library-for-promise-types-in-python"],
      "steps": [
        "copy git.py modules/promises/",
        "append enable.cf services/init.cf"
      ]
    },
    "promise-type-groups": {
      "description": "Experimental promise type to manage local user groups.",
      "subdirectory": "promise-types/groups",
      "dependencies": ["library-for-promise-types-in-python"],
      "steps": [
        "copy groups.py modules/promises/",
        "append enable.cf services/init.cf"
      ]
    },
    "promise-type-systemd": {
      "description": "Promise type to manage systemd services.",
      "subdirectory": "promise-types/systemd",
      "dependencies": ["library-for-promise-types-in-python"],
      "steps": [
        "copy systemd.py modules/promises/",
        "append enable.cf services/init.cf"
      ]
    },
    "uninstall-packages": {
      "description": "Allows you to specify a list of packages you want uninstalled on your hosts.",
      "subdirectory": "security/uninstall-packages",
      "steps": [
        "copy uninstall-packages.cf services/cfbs/modules/uninstall-packages/uninstall-packages.cf",
        "input uninstall-packages/input.json def.json",
        "bundles uninstall_packages:uninstall_packages",
        "policy_files services/cfbs/modules/uninstall-packages/uninstall-packages.cf"
      ],
      "input": [
        {
          "type": "list",
          "variable": "package_names",
          "namespace": "uninstall_packages",
          "bundle": "uninstall_packages",
          "label": "Packages to uninstall",
          "subtype": [
            {
              "key": "name",
              "type": "string",
              "label": "Package name",
              "question": "Package name"
            },
            {
              "key": "why",
              "type": "string",
              "label": "Why",
              "question": "Why should this package be uninstalled?",
              "default": "Unknown"
            }
          ],
          "while": "Do you want to specify more packages to be uninstalled?"
        }
      ]
    },
    "uninstall-rsh-server": {
      "description": "Ensure the remote shell (rsh) server package is not installed on the system.",
      "subdirectory": "security/uninstall-rsh-server",
      "steps": [
        "copy uninstall-rsh-server.cf services/cfbs/modules/uninstall-rsh-server/uninstall-rsh-server.cf",
        "bundles uninstall_rsh_server",
        "policy_files services/cfbs/modules/uninstall-rsh-server/uninstall-rsh-server.cf"
      ]
    },
    "windows-capability": {
      "description": "Manage and inventory Windows Capabilities.",
      "subdirectory": "management/windows-capability",
      "steps": [
        "directory ./ services/cfbs/windows-capability/",
        "policy_files services/cfbs/windows-capability/",
        "bundles windows_capability"
      ]
    },
    "windows-openssh-server": {
      "description": "Optionally install Windows OpenSSH Server.",
      "subdirectory": "software/windows",
      "steps": [
        "copy windows-openssh-server.cf services/cfbs/software/windows/windows-openssh-server.cf",
        "policy_files services/cfbs/software/windows/windows-openssh-server.cf",
        "bundles windows_openssh_server"
      ]
    },
    "windows-optional-feature": {
      "description": "Manage and inventory Windows Optional Features.",
      "subdirectory": "management/windows-optional-feature",
      "steps": [
        "directory ./ services/cfbs/windows-optional-feature/",
        "policy_files services/cfbs/windows-optional-feature/",
        "bundles windows_optional_feature"
      ]
    }
  }
}