Package: watchmaker
WatchmakerApplied Configuration ManagementOverviewWatchmaker is a Python package that helps bootstrap a vanilla OS image and
apply an OS configuration. Watchmaker itself reads a simple YAML configuration
file, which can be hosted on the local filesystem or on a web server.Complex configuration management (CM) environments may be layered in as part of
the provisioning framework. Watchmaker includes a default configuration that
will install Salt and a handful Salt Formulas that can be used to harden a
system to DISA STIG standards, as well as integrate with common enterprise
services.DocumentationFor more information on installing and using Watchmaker, go tohttps://watchmaker.cloudarmor.io.Changelog0.28.2Released: 2023.10.31Summary:Updates Watchmaker default config to use Salt 3006.4Documents invalid finding in EL8 for remote access monitoring methodsash-linux-formulaAddresses several EL8 Cat2 findings from recent SCAP scansjoin-domain-formula(Linux) Adds cron config that refreshes AD computer object attributes0.28.1Released: 2023.10.05Summary:Fixes clobbering ofcomputer-namegrain whencomputer-name-patternis also
provided. This prevented thename-computer-formulafrom setting the name
specified by the userUpdates FAQ to include vendor guidance for EL8.8+Adds guidance on OpenSSH key signing requirements for EL8ash-linux-formulaAdds handler to address pam faillock findings on EL80.28.0Released: 2023.09.14Summary:Add watchmaker config argumentcomputer_name_pattern, and exit with error
if providedcomputer_namedoes not match. Also writes grain for use with
name-computer-formulaUpdates default watchmaker config to use salt 3006.2Documents customization options for the watchmaker salt contentDocuments workarounds for known "gotchas" when applying EL7 and EL8 STIG controlsash-linux-formulaSupports customization for mapping users to different SELinux contextsRemoves el7 and EL8 STIG handlers that are now provided by SCAP remediation
contentConsolidates all separate EL8 PAM handlers to states based on new authselect
capabilitiesjoin-domain-formulaAdds support fortriesoption that retries a failed join domain actionIntegrates with ash-linux PAM handlers to apply STIG controls, if availabletrellix-agent-formulaRefactors firewalld states around newer salt functionalityname-computer-formulaSupports reading pattern from salt grain0.27.5Released: 2023.08.07Summary:Adds doc section on troubleshooting Watchmaker, to include common errors, issues,
and relevant log filesUpdates AWS provider to support EC2 instances configured for only IMDSv2ash-linux-formulaAddresses additional STIG findings for EL7 and EL8join-domain-formulaResolves issue with collision detection when deploying a new system
with a hostname that already exists in the domainCorrects usage of StartTLS when searching for a computer object in the
domainProvides several new options for controlling whether TLS is used when
searching for a computer object in the domain, and whether an error will
be treated as fatal or not0.27.4Released: 2023.06.28Summary:Updates guidance on Linux STIG findings relating to SELinux context and sudo
privilege escalationash-linux-formulaAdds additional guidance on pillar content usageAdds additional EL7 STIG handlersRemoves duplicate EL7 STIG handlers for audit rulesforescout-secure-connector-formulaAdds state to ensure correct directory ownershipjoin-domain-formulaUpdates sssd to support a variety of conf parametersscap-formulaUpdates DISA SCAP content0.27.3Released: 2023.05.25Summary:Fixes issue with standalone binary on FIPS-enabled EL8 systems, by packaging
libcrypto and libssl libraries in the binary0.27.2Released: 2023.05.18Summary:Adds support for salt 3006Builds standalone executable using Python 3.10Documents additional expected findings for EL8 systemsUses Python 3.10 in all documentation referencesUpdates default config to use salt 3006.1Uses SCC 5.7.1 in default salt contentash-linux-formulaSimplifies logic for managing faillock.confash-windows-formulaUpdates custom modules for compatibility with Salt 3006 while remaining
backwards compatible with salt 3005 and earliersplunkforwarder-formulaSets splunk user/group on files and directories, eliminating "Changes"
when re-executing the formula0.27.1Released: 2023.05.08Summary:Fixes typo in upload of Windows standalone binary to GitHub ReleasesDocuments known/spurious EL8 findings that scanning utilities may flag
erroneouslyFixes the check that skips reinstalling salt when the correct version is
already installedPublishes EL8 scap scans as a release artifact towatchmaker.cloudarmor.io,
alongside the standalone binariesUpdates scap pillar in default salt content to run scans properly on CentOS
Stream and scap version 1.3ash-linux-formulaFixes oscap remediation on CentOS Stream 8 and Oracle Linux 8Addresses numerous additional STIG findings on EL8 systems that were not
addressed with oscap remediationAttempts to address EL8 issue with aws-cli, where fapolicyd blocks executionforescout-secure-connector-formulaEstablishes symlink so logs are written to/var/logpartitionscap-formulaUpdates openscap content to v0.1.67, using scap 1.3 datastreams. This also
addresses issues with expiry on passwordless local users0.27.0Released: 2023.03.31Summary:Releases support for EL8 platforms, to include Red Hat 8, CentOS 8 Stream, and
Oracle Linux 8. Future work may also add support for Rocky Linux 8 and Alma
Linux 8CAVEAT: With this release, on FIPS-enabled EL8 systems, please use thePyPi install or the source install methods.
Currently, the standalone method for EL8does notwork when the system
is FIPS-enabled. The problem is not yet entirely understood. Further investigation
is needed before this issue can be resolvedUPDATE: The issue with FIPS-enabled EL8 and the standalone binary is fixed
in Watchmaker 0.27.3Updates salt worker to avoid re-installing salt whensalt-call --versionmatches thesalt_versionin the Watchmaker configUpdates EL7 findings documentation to line up with latest stig versionInstallsdnspythonpackage when using default Watchmaker config, to support
the join-domainnsupdatestateash-linux-formulaAdds handlers to address findings in latest stig versions and increase coveragemcafee-agent-formulaAdds atrellix-agentsalt state to support the new name for the softwarejoin-domain-formulaLinux: Adds annsupdatesalt state that will register forward and reverse
dns recordsWindows: Updates collision handling and join actions to use the same domain
controllerWindows: Supports collision handling where an existing computer object
was created by a different service account than is now specified for the
join actionwinrepo: Adds atrellix-agentpackage definition0.26.5Released: 2023.03.10Summary:join-domain-formulaLinux: Output journald logs on join-domain failuresLinux: Re-order sssd conf file Salt states and explicitly set replace setting to falseLinux: Patch find-collision.sh script to fix computer-object search0.26.4Released: 2023.03.03Summary:Attempts to fix the release automation so the Windows standalone is published
to GitHub ReleasesValidates functionality with salt 3005.1 and updates default config to use
salt 3005.1join-domain-formulaWindows: Provides pillar options to configure DNS registration settings,
to support registration of reverse DNS records0.26.3Released: 2023.02.27Summary:Skips provider detection when provider requirements are not installedUpdates watchmaker salt log config to avoid capturing senstive data in salt logforescout-secure-connector-formulaAdds support for EL8 when FIPS is enabledname-computer-formulaSets hostname as fqdn whendns_domainis providedjoin-domain-formulaRuns fix-collision script when using sssdUpdates fix-collision to avoid capturing sensitive values in salt logUpdates sssd method to set extra os attributes only when requestedUpdates windows join script to avoid capturing sensitive values in salt log0.26.2Released: 2023.02.13Summary:Fixes publishing of Windows standalone to GitHub ReleasesdocsProvides guidance on using S3 URL feature in config referencesDescribes prerequisites for using AWS and Azure featuresRemoves references to EL6 and Python 2.6Removes references to deprecated--s3-urlargumentjoin-domain-formulaAdds support for EL8, usingsssdto perform the domain-join0.26.1Released: 2023.02.08Summary:Uses pyinstaller directly to build standalone packages, eliminating dependency
on gravitybeeUses new python apis to reference package metadata and resources, improving
support for alternative packaging methods, like in-memory runtimes (pyoxidizer)
or ziparchivesAdds PEP517 package metadata[Alpha] Allows watchmaker to run on Red Hat Enterprise Linux 8, Centos 8 Stream,
Oracle Linux 8, Alma Linux 8, and Rocky Linux 8. Currently on the ash-linux
hardening formula will work; none of the other salt formulas have yet been
updated for EL8 supportash-windowsFixes warning inlgpomodule about usingisinstead of==to compare
string-literal values0.26.0Commit Delta:Change from 0.25.0 releaseReleased: 2022.12.21Summary:Adds support for posting to a status provider. Initial capability supports
AWS and will post the Watchmaker status to an EC2 instance tag. Status values
include "Running", "Completed", or "Failed". For more information on this feature,
seehttps://watchmaker.cloudarmor.io/en/stable/configuration.html#status.[Alpha] Support posting status to Azure as a Virtual Machine tag[Alpha] Support for EL8 platforms is improving but still in development. Targeted
platforms include: Red Hat Enterprise Linux 8, Centos 8 Stream, Oracle Linux 8,
Alma Linux 8, and Rocky Linux 8ash-linux-formulaSupports EL8 platformsjoin-domain-formulaFixes hostname logic so automatic renaming works correctlyscap-formulaSupports EL8 platforms0.25.0Commit Delta:Change from 0.24.3 releaseReleased: 2022.10.05Summary:[Alpha] Begins initial preparation to support running watchmaker on EL8 platformsforescout-secure-connector-formulaFirst release that packages a formula for ForeScout Secure Connector0.24.3Commit Delta:Change from 0.24.2 releaseReleased: 2022.09.16Summary:ash-linux-formulaAdds check to ensure root account password is set to not expirejoin-domain-formulaRemoves PAM Lsass login re-configuration0.24.2Commit Delta:Change from 0.24.1 releaseReleased: 2022.08.16Summary:scap-formulaUpdates OpenSCAP and DISA STIG contentLinux: Adds EL8 contentwatchmaker-salt-contentWindows: Re-adds scap scan using public distributable SCC 5.50.24.1Commit Delta:Change from 0.24.0 releaseReleased: 2022.07.27Summary:Builds Linux standalone with python 3.8Updates default config to use Salt 3004.2Updates Windows usage docs with requirement to enforce modern TLS versionsjoin-domain-formulaWindows: Quotes path when running scripts to configure local admin groupash-linux-formulaTests if grub.cfg exists before attempting to modify it0.24.0Commit Delta:Change from 0.23.4 releaseReleased: 2022.03.09Summary:Updates default config to use Salt 3004scap-formulaFixes invalid requisite reference for scap.scan0.23.4Commit Delta:Change from 0.23.3 releaseReleased: 2021.12.20Summary:ash-windows: Adds baselineash-windows.cis_1_3_0Builds python 3.8 into standalone binary instead of python 3.6Uses SERVER_AUTH for ssl context, fixing bug resulting from incorrect use of CLIENT_AUTH previously0.23.3Commit Delta:Change from 0.23.2 releaseReleased: 2021.09.28Summary:Added publishing of SCAP reports for Linux systems with each releaseFixed CLI behavior when passing 'none' value, e.g.--salt-states noneUpdated default config to use Salt 3003.3mcafee-agent-formula(Linux) Refactored to allow install over an existing installation0.23.2Commit Delta:Change from 0.23.1 releaseReleased: 2021.08.11Summary:Patched Salt worker to be case-sensitive when processsing Salt statesRefactored Salt states handling between CLI and config.yamlStandalone packages are now based on EL7 and are no longer compatible with EL6 (EL6 hasn't been supported for a while now)0.23.1Commit Delta:Change from 0.23.0 releaseReleased: 2021.07.15Summary:ash-linux-formulaSupports managing FIPS when / and /boot are on the same partitionAllowsoscap remediateto exit non-zero on valid errorsSupports parsing extra_arguments when passed using=as the separatorE.g.--user-formulas='{"foo-formula": "https://url-to/foo-formula.zip"}'0.23.0Commit Delta:Change from 0.22.2 releaseReleased: 2021.07.08Summary:Adds capability to run extra states after highstateE.g. from cli,--salt-states highstate,foo,barE.g. in config file,salt_states: highstate,foo,barAdds capability to pass complex worker arguments on the cli as JSON or YAMLE.g.--user-formulas '{"foo-formula": "https://url-to/foo-formula.zip"}'0.22.2Commit Delta:Change from 0.22.1 releaseReleased: 2021.06.17Summary:ash-linux-formulaPatches RHEL-07-040810 to apply to only iptables-services RPM and not core-package iptables RPM0.22.1Commit Delta:Change from 0.22.0 releaseReleased: 2021.05.11Summary:ash-linux-formula/nessus-agent-formulaPatches maxdepth parameter to use integer type to support Jinja rendering in Salt 30030.22.0Commit Delta:Change from 0.21.9 releaseReleased: 2021.05.07Summary:Updates default config.yaml to use Salt 3003ash-linux-formulaAdds ability to selectively skip extra EL7 STIG handlersnessus-agent-formula(Linux) Updates nessus-agent to call install and configure states0.21.9Commit Delta:Change from 0.21.8 releaseReleased: 2021.04.26Summary:Provides support for Salt 3003ash-linux-formulaUpdates syntax to support Salt 3003RHEL-07-040160 - Ensure no (competing) attempts to set TMOUTRHEL-07-040860 - Adds ability to handle lack of /etc/sysct.conf filenessus-agent-formulaSeparate agent install and configuration to support baked-in Nessus agent installationsjoin-domain-formula(Windows) Add double-quotes to Members parameter in order for startup task state to work with Salt 30030.21.8Commit Delta:Change from 0.21.7 releaseReleased: 2021.03.11Summary:Updated CI configs to set the correct version for the Windows standalone package.
Effectively, this version is the same as 0.21.7.0.21.7Commit Delta:Change from 0.21.6 releaseReleased: 2021.03.10Summary:ash-linux-formulaCoordinatessshdservice restarts across all states that modify/etc/sshd_config,
so the service restarts only once. This avoids systemd failures when the
service restarts too frequently. Seeash-linux-formula PR #303.0.21.6Commit Delta:Change from 0.21.5 releaseReleased: 2021.03.03Summary:ash-linux-formulaAdds patch to re-enable NOPASSWD sudo for users in /etc/sudoers.d/ after oscap remediation.0.21.5Commit Delta:Change from 0.21.4 releaseReleased: 2021.02.25Summary:ash-linux-formulaReplacewatchwithlistento restart thesshdservice a single timeMake state RHEL-07-040560 more resilient when the yum group info is missingscap-formulaUpdates SCAP content from DISA (as of February 2021) and OpenSCAP (v0.1.54)Update watchmaker defaultconfig.yamlto use salt v2019.2.8Ability to browseWatchmaker Cloudarmor repo0.21.4Commit Delta:Change from 0.21.3 releaseReleased: 2020.12.04Summary:nessus-agent-formula(Linux) Switch to using Salt service state to ensure Nessus agent service is running0.21.3Commit Delta:Change from 0.21.2 releaseReleased: 2020.10.26Summary:watchmaker-salt-content(Linux) Updates scap-formula pillar to use alternative stig profile parameter for Red Hat0.21.2Commit Delta:Change from 0.21.1 releaseReleased: 2020.10.05Summary:(Windows) Removes winrepo.genrepo usage in Salt worker since it's no longer required0.21.1Commit Delta:Change from 0.21.0 releaseReleased: 2020.08.20Summary:splunkforwarder-formula(Linux) Patches splunkforwarder state to work with Splunk Universal Forwarder v7.3.60.21.0Commit Delta:Change from 0.20.5 releaseReleased: 2020.08.12Summary:Updates default watchmaker config.yaml to use salt 2019.2.50.20.5Commit Delta:Change from 0.20.4 releaseReleased: 2020.07.16Summary:splunkforwarder-formula(Linux) Patches splunkforwarder state to work with salt 2019.2.50.20.4Commit Delta:Change from 0.20.3 releaseReleased: 2020.07.15Summary:splunkforwarder-formula(Windows) Patches splunkforwarder state to work with salt 2019.2.50.20.3Commit Delta:Change from 0.20.2 releaseReleased: 2020.07.07Summary:join-domain-formula(Linux) Fixes issue with admin users not being able to sudo0.20.2Commit Delta:Change from 0.20.1 releaseReleased: 2020.07.01Summary:scap-formulaUpdates SCAP content from DISA (as of June 2020) and OpenSCAP (v0.1.50)0.20.1Commit Delta:Change from 0.20.0 releaseReleased: 2020.05.19Summary:ash-linux-formulaFixes issue with Postfix occasionally failing to start0.20.0Commit Delta:Change from 0.19.0 releaseReleased: 2020.05.06Summary:Adds capability to install Python packages using Pip in Salt's Python interpreter0.19.0Commit Delta:Change from 0.18.2 releaseReleased: 2020.05.01Summary:Updates Watchmaker file permissions and makes them more restrictiveAdds new SaltWorker optional argument--salt-content-paththat allows specifying glob pattern for
salt files located within salt archive file0.18.2Commit Delta:Change from 0.18.1 releaseReleased: 2020.04.02Summary:vault-auth-formulaRename state to vault-authAdd url keyword argument to read_secret execution module0.18.1Commit Delta:Change from 0.18.0 releaseReleased: 2020.03.23Summary:Updates version constraint in default config to allow newer versions0.18.0Commit Delta:Change from 0.17.5 releaseReleased: 2020.03.23Summary:Removes deprecatedemet-formulaanddotnet4-formulasubmodulesAdds newvault-auth-formulasubmoduleash-windows-formulaReplaces usage of Apply_LGPO_Delta.exe with native python and salt functionalityAddresses additional findings for domain-joined systemsRemoves deprecated baselines from Windows Server 2008 R2, 8.1, and IE 8, 9, and 100.17.5Commit Delta:Change from 0.17.4 releaseReleased: 2020.03.13Summary:join-domain-formulaAllow use of password with Linux join domain capability0.17.4Commit Delta:Change from 0.17.3 releaseReleased: 2020.02.28Summary:ash-linux-formulaUpdates custom STIGbyID baseline to address several scan findings.Add content for RHEL-07-040530/SV-868990.17.3Commit Delta:Change from 0.17.2 releaseReleased: 2020.02.26Summary:dotnet4-formulaFix compatibility with Windows Server 2019 by using 2019 hotfixesash-linux-formulaImprovements for STIGv2r6Fix collisions caused by cat2 IDs and DISA numbering changeUse Salt Stack version 2019.2-20.17.2Commit Delta:Change from 0.17.1 releaseReleased: 2020.02.25Summary:Documents configuration vs cli argument handling and precedenceProvides a table mapping common scan findings to an associated Finding IDRestores propagation of theNonevalue on the cli to the workersash-linux-formulaEnsures aide configuration complies with FIPS requirementsash-windows-formulaAdds missing sls to restore support for Windows 10join-domain-formulaSuppresses join-domain command in salt log output(Windows) Supports using salt-native pillar security for thepasswordvaluenessus-agent-formula(Linux) Suppresses gpg verification so the pkg can be installed from a URL0.17.1Commit Delta:Change from 0.17.0 releaseReleased: 2020.01.28Summary:Fixes release date in changelog for 0.17.0Removes salt worker special handling forsalt_statessince it is now handled
properly in theArguments()classpshelp-formulaUpdates PowerShell help content, including Windows Server 20190.17.0Commit Delta:Change from 0.16.7 releaseReleased: 2020.01.21Summary:Add support for Windows Server 2019Use native markdown processing for PyPI long descriptionDeprecate use of 'None' (string) inconfig.yamlAdd optionalwatchmaker_versionnode to configurationUse Salt 2018.3.4 in default configuration0.16.7Commit Delta:Change from 0.16.6 releaseReleased: 2020.01.06Summary:PinsPyYAMLdependency when running on Python 3.4 or earlier0.16.6Commit Delta:Change from 0.16.5 releaseReleased: 2019.12.04Summary:Uses CDN URLs for watchmaker config and content, instead of direct S3 URLsPinsbackoffdependency when running on Python 3.4 or earlier0.16.5Commit Delta:Change from 0.16.4 releaseReleased: 2019.09.23Summary:join-domain-formulaAdd support for restricting Active Directory sites that will be consulted if thead_site_namekey-value is set in the pillarash-linux-formulaFix issue with log spamming bysystemdrelated to file permissionsash-windows-formulaUpdate STIG baselines for 2019-07 SCAP contentscap-formulaRename DISA content files to reflect SCAP versionUpdate DISA SCAP content to July 2019 releasesalt-contentUpdate SCAP pillar to match filename changes in SCAP formula0.16.4Commit Delta:Change from 0.16.3 releaseReleased: 2019.08.23Summary:Updates documentation on pip usage in Linux to always usepython3 -m pip...dotnet4-formulaAdds .NET Framework 4.8 version and associated KB to lookup tablesfup-formulaNew salt formula to install packages via URLscap-formula(Windows) Adds configuration to allow scan results to be generated when using SCC v5.0.2 and higherwatchmaker-salt-content(Windows) Adds .NET Framework 4.8 info to dotnet winrepo package content0.16.3Commit Delta:Change from 0.16.2 releaseReleased: 2019.08.7Summary:join-domain-formula(Linux) Modifies method used to retrieve hostname to avoid issues withhostname -f(Linux) Improves error messaging if tooling dependencies are not installed(Linux) Modifies domain controller search mechanism to preserve compatibility with EL6(Linux) Logs the computer name in the domain-join outputmcafee-agent-formula(Linux) Adds a pillar option to pass args to the mcafee agent installer(Linux) Fixes match on OS version to ensure firewall ports are openedname-computer-formula(Linux) Updates /etc/hosts with hostname fqdn, when the domain name is provided0.16.2Commit Delta:Change from 0.16.1 releaseReleased: 2019.07.11Summary:join-domain-formulaFixes detection of running system's join state, searches for shortname, and retries joinsImproves compatibility with strict BashAdds option to skip GPG checkamazon-inspector-formulaAdds option to skip GPG checksplunkforwarder-formulaRedirects splunk log folder with symlinkAdds option to skip GPG check0.16.1Commit Delta:Change from 0.16.0 releaseReleased: 2019.06.21Summary:join-domain-formulaUpdates find-collision.sh ldap search to include uppercase and lowercase versions of provided hostnamescap-formulaAdds script to build OSCAP content with 'stig' profile included for CentOSUpdates OSCAP content to v0.1.44watchmaker-salt-contentSwitches Linux scap profile pillar settings to 'stig'0.16.0Commit Delta:Change from 0.15.2 releaseReleased: 2019.05.10Summary:Adds salt content locally as a submodule to better support Watchmaker standalone packagesdotnet4-formulaUpdates formula to support the use of Python3 versions of Saltjoin-domain-formulaAdds additional enhancements and logic to better handle the domin-join process in Linux0.15.2Commit Delta:Change from 0.15.1 releaseReleased: 2019.04.12Summary:ash-linux-formulaRemoves outdated and conflicting states to allow setting of custom banner textjoin-domain-formulaFixes issue with improper handling of admin names with spaces in Windows0.15.1Commit Delta:Change from 0.15.0 releaseReleased: 2019.04.05Summary:join-domain-formula(Linux) Avoidsuniquejinja filter to preserve compatibility for older
versions of salt0.15.0Commit Delta:Change from 0.14.2 releaseReleased: 2019.04.04Summary:Updates documentation to install pip usingensurepipmodule instead of externalget-pip.pyash-linux-formulaAdds pillar option to set content for/etc/issuelogin bannerjoin-domain-formula(Linux) Adds pillar option to pass a list of domains to add to the trust
list0.14.2Commit Delta:Change from 0.14.1 releaseReleased: 2019.03.26Summary:join-domain-formulaCorrects regression on Windows to support adding admin groups that have
spaces in the name0.14.1Commit Delta:Change from 0.14.0 releaseReleased: 2019.03.18Summary:Fixes Python 2.6 incompatibility introduced by new version of PyYAMLjoin-domain-formulaFixes issue adding admin groups/users to Windows systems with recent versions of Salt0.14.0Commit Delta:Change from 0.13.0 releaseReleased: 2019.03.06Summary:Adds additional documentation to answer common EL7 security scan findingsash-linux-formulaImplements additional Salt states to address security scan issuesCapability to manage GRUB password configurationIgnoreRhosts setting in SSH daemon configurationCIS remediation handlers ( CIS 5.2.3, CIS 5.2.5)Adds Salt state to update audit-rule changes without a system rebootscap-formulaUpdates SCAP Security Guide content to v0.1.410.13.0Commit Delta:Change from 0.12.1 releaseReleased: 2019.01.29Summary:amazon-inspector-formulaNew salt formula distributed with watchmakerInstalls amazon-inspector agentRefactor watchmakerChange naming mechanism from LinuxManager to LinuxPlatformManagerChange naming mechanism from WindowsManager to WindowsPlatformManagerChange naming mechanism from Manager to PlatformManagerAdded abstract class WorkerBase for Workers to inherit fromash-linux-formulaChange ipv6 check to use if_inet6 fileImport correct source of fopen functionConfigure Postfix to only use ipv4 when ipv6 is disabled0.12.1Commit Delta:Change from 0.12.0 releaseReleased: 2018.12.17Summary:ash-windows-formulaCorrects yaml syntax error in win2016 DC baseline0.12.0Commit Delta:Change from 0.11.0 releaseReleased: 2018.12.13Summary:Addsvalid_environmentsoption to config to allow for the restriction of environment selection0.11.0Commit Delta:Change from 0.10.3 releaseReleased: 2018.11.08Summary:Adds enhancement to ensure--admin-groupsparameters are lowercase on Linux systemsAdds additional information to the--versionflagDefault values are now shown in help outputscap-formulaIncorporates content from latest DISA SCAP benchmarksMicrosoft .Net Framework 4 STIG Benchmark - Ver 1, Rel 5Microsoft Windows 2008 R2 DC STIG Benchmark - Ver 1, Rel 5Microsoft Windows 2008 R2 MS STIG Benchmark - Ver 1, Rel 30Microsoft Windows Server 2016 STIG Benchmark - Ver 1, Rel 31Red Hat 6 STIG Benchmark - Ver 1, Rel 21Red Hat 7 STIG Benchmark - Ver 2, Rel 10.10.3Commit Delta:Change from 0.10.2 releaseReleased: 2018.10.18Summary:ash-windows-formulaUpdates Formula to Support Salt 2017.7.x and 2018.3.xRemoved admin account rename from delta state0.10.2Commit Delta:Change from 0.10.1 releaseReleased: 2018.09.27Summary:Adds a gitlab-ci pages config to build Watchmaker docsUses new hosting location to retrieve Salt packagesRestricts click version on py2.6ash-windows-forumulaNew hosting location being used for all packagespshelp-formulaRemoved byte-order-mark unicode character at beginning of init.sls file0.10.1Commit Delta:Change from 0.10.0 releaseReleased: 2018.08.09Summary:No functional changes; just patches the CI/release configuration0.10.0Commit Delta:Change from 0.9.6 releaseReleased: 2018.08.08Summary:Provides standalone packages that bundle the Python runtime together with
Watchmaker and its dependenciesSeehttps://watchmaker.cloudarmor.io/en/stable/installation.htmlash-linux-formula(el7) Ensures packages are up-to-date(el7) Ensures firewalld is installed and runningsplunk-forwarder-formula(linux) Uses a symlink to ensure logs are in the /var/log partitiondotnet4-formulaAdds support for .NET 4.7.2nessus-agent-formulaNew salt formula distributed with Watchmaker0.9.6Commit Delta:Change from 0.9.5 releaseReleased: 2018.05.16Summary:windows-update-agent-formulaSupports new windows update settings,AlwaysAutoRebootAtScheduledTimeandAlwaysAutoRebootAtScheduledTimeMinutesscap-formulaIncorporates content from OpenSCAP Security Guide v0.1.39-10.9.5Commit Delta:Change from 0.9.4 releaseReleased: 2018.04.11Summary:[PR #574] Updates Windows userdata example to execute pip usingpython -mwhen upgrading pipwindows-update-agent-formulaUses newer arguments for reg state,vnameandvdataReduces duplication in windows update data modelNests the windows update pillar options under the standardlookupkey0.9.4Commit Delta:Change from 0.9.3 releaseReleased: 2018.04.09Summary:ash-windows-formulaUpdates STIG baselines to address all findings in latest SCAP
benchmarks0.9.3Commit Delta:Change from 0.9.2 releaseReleased: 2018.03.08Summary:scap-formulaIncorporates content from OpenSCAP Security Guide v0.1.38-1Incorporates content from latest DISA SCAP benchmarksMicrosoft Internet Explorer 11 STIG Benchmark - Ver 1, Rel 11Microsoft Windows 10 STIG Benchmark - Ver 1, Rel 10Microsoft Windows 2008 R2 DC STIG Benchmark - Ver 1, Rel 27Microsoft Windows 2008 R2 MS STIG Benchmark - Ver 1, Rel 28Microsoft Windows 2012 and 2012 R2 DC STIG Benchmark - Ver 2, Rel 11Microsoft Windows 2012 and 2012 R2 MS STIG Benchmark - Ver 2, Rel 11Microsoft Windows 8/8.1 STIG Benchmark - Ver 1, Rel 21Microsoft Windows Server 2016 STIG Benchmark - Ver 1, Rel 4Red Hat 6 STIG Benchmark - Ver 1, Rel 18Red Hat 7 STIG Benchmark - Ver 1, Rel 2dotnet4-formulaSkips dotnet4 hotfix install if a newer version is already installedCreates per-OS maps for hotfix updates, since the hotfix id varies per
OS0.9.2Commit Delta:Change from 0.9.1 releaseReleased: 2018.02.20Summary:dotnet4-formulaPasses version correctly to module.run0.9.1Commit Delta:Change from 0.9.0 releaseReleased: 2018.02.17Summary:This version was effectively a no-op, as the submodule was not updated as
intendeddotnet4-formulaPasses version correctly to module.run0.9.0Commit Delta:Change from 0.8.0 releaseReleased: 2018.02.12Summary:[Issue #499][PR #513] Includes additional details about the
platform and python version in the watchmaker log[Issue #500][PR #512] Retries file retrieval up to 5 times[Issue #501][PR #507] Uses urllib handlers to retrieve all
filesDeprecates the argument--s3-source; to retrieve a file from an S3
bucket use the syntax:s3://<bucket>/<key>Local files may be specified as absolute or relative paths, and may or
may not be prefixed withfile://[PR #496] Moves CloudFormation and Terraform templates to their own
project,terraform-aws-watchmaker[PR #491] Improves compatibility of the watchmaker bootstrap.ps1
script when executed by an Azure custom script extension[Issue #430][PR #487] Writes watchmaker salt config to a
custom path:Windows:C:\Watchmaker\Salt\confLinux:/opt/watchmaker/saltscap-formulaIncorporates content from OpenSCAP Security Guide v0.1.37-10.8.0Commit Delta:Change from 0.7.2 releaseReleased: 2018.01.02Summary:[Issue #415][PR #458] Forwards watchmaker log entries from the
Windows Event Log to the EC2 System Log (Windows-only)[PR #425] Adds a log handler that writes watchmaker log entries to
the Windows Event Log (Windows-only)[Issue #434][PR #457] Updates doc build to replacerecommonmarkfunctionality entirely withm2r[PR #437] Modfies CloudFormation templates to use aws cli utility to
retrieve the appscript rather than use the functionality built-in to the
cfn bootstrap[PR #467] Sets environment variables for aws cli when executing the
appscript option in the watchmaker CloudFormation templates0.7.2Commit Delta:Change from 0.7.1 releaseReleased: 2017.12.13Summary:Installsfuturesonly on Python 2 -- no functional changes0.7.1Commit Delta:Change from 0.7.0 releaseReleased: 2017.12.04Summary:Fixes readthedocs build -- no functional changes0.7.0Commit Delta:Change from 0.6.6 releaseReleased: 2017.11.21Summary:[PR #409] Provides terraform modules that deploy the watchmaker
CloudFormation templates[Issue #418][PR #419] Adds anexclude-statesargument to
the SaltWorker; specified states will be excluded from the salt state
executionash-windows-formulaIncorporates security settings from the DISA October quarterly releasejoin-domain-formula(Windows) Adds WMI method to set DNS search suffix(Windows) Tests for the EC2Config XML settings file before modifying itscap-formula(Linux) Distributes scap content from SCAP Security Guide v0.1.36-1Distributes scap content from the DISA October quarterly releasesplunkforwarder-formulaSupports configuration of splunk log sources from pillar and grains
inputs0.6.6Commit Delta:Change from 0.6.5 releaseReleased: 2017.10.18Summary:ash-linux-formula(el7) Fixes typos in the firewalld "safety" scripts that resulted in a
failure when firewalld was reloadedmcafee-agent-formula(el7) Adds required inbound ports to all firewalld zones, to support
the event where the default zone is modified from "public"splunkforwarder-formula(el7) Adds required outbound ports to the OUTPUT chain; previously,
they were mistakenly being added as inbound rules0.6.5Commit Delta:Change from 0.6.4 releaseReleased: 2017.09.29Summary:[PR #391] Updates CloudFormation templates with a parameter that
exposes the option to use the S3 API and the instance role to retrieve the
Watchmaker content archiveash-linux-formula(el7) Updates firewalld "safety" state so that firewalld remains in the
active state; the prior approach left firewalld dead/inactive, until
the service was restarted or the system was rebooted0.6.4Commit Delta:Change from 0.6.3 releaseReleased: 2017.09.22Summary:[PR #381] Restrictswheelversion on Python 2.6 to be less than or
equal to 0.29.0, aswheel0.30.0 removed support for py26.0.6.3Commit Delta:Change from 0.6.2 releaseReleased: 2017.08.11Summary:ash-linux-formula(el7) Includes a "safety" state for firewalld that ensures SSH inbound
access will remain available, in the event the default zone is set to
"drop"0.6.2Commit Delta:Change from 0.6.1 releaseReleased: 2017.08.07Summary:ash-linux-formula(el6) Improve the method of disabling the sysctl optionip_forward,
to account for the behavior of theaws-vpc-natrpmscap-formula(elX) Updates openscap security guide content to version 0.1.34-10.6.1Commit Delta:Change from 0.6.0 releaseReleased: 2017.08.01Summary:ash-linux-formulaModified the FIPS custom execution module to discover the boot
partition and add theboot=line to the grub configuration0.6.0Commit Delta:Change from 0.5.1 releaseReleased: 2017.07.25Summary:ash-linux-formulaUpdates the EL7 stig baseline to manage the FIPS state. The state
defaults toenabledbut can be overridden via a pillar or grain,ash-linux:lookup:fips-state. The grain takes precedence over the
pillar. Valid values areenabledordisabledash-windows-formulaUpdates the STIG baselines for Windows Server 2016 member servers and
domain controllers with SCAP content from the DISA v1r1 SCAP benchmark
releasejoin-domain-formulaFixes an issue when joining Windows 2016 servers to a domain, where the
Set-DnsSearchSuffix.ps1 helper would fail because the builtin
PowerShell version does not work when$nullis used in a ValidateSet.
The equivalent value must now be passed as the string,"null"scap-formulaAdds SCAP content for the Window Server 2016 SCAP v1r1 Benchmark0.5.1Commit Delta:Change from 0.5.0 releaseReleased: 2017.07.08Summary:[Issue #341][PR #342] Manages selinux around salt state
execution. In some non-interactive execution scenarios, if selinux is
enforcing it can interfere with the execution of privileged commands (that
otherwise work fine when executed interactively). Watchmaker now detects if
selinux is enforcing and temporarily sets it to permissive for the duration
of the salt state execution0.5.0Commit Delta:Change from 0.4.4 releaseReleased: 2017.06.27Summary:[Issue #331][PR #332] Writes therolegrain to the key
expected by the ash-windows formula. Fixes usage of the--ash-roleoption
in the salt worker[Issue #329][PR #330] Outputs watchmaker version at the debug
log level[Issue #322][PR #323][PR #324] Fixes py2/py3
compatibility bug in how the yum worker handles file opening to check the
Linux distro[Issue #316][PR #320] Improves logging when salt state
execution fails due to failed a state. The salt output is now returned to
the salt worker, which processes the output, identifies the failed state,
and raises an exception with the state failurejoin-domain-formula(Linux) Reworks the pbis config states to make the logged output more
readable0.4.4Commit Delta:Change from 0.4.3 releaseReleased: 2017.05.30Summary:join-domain-formula(Linux) Ignores a bad exit code from pbis config utility. The utility
will return exit code 5 when modifying the NssEnumerationEnabled
setting, but still sets the requested value. This exit code is now
ignored0.4.3Commit Delta:Change from 0.4.2 releaseReleased: 2017.05.25Summary:name-computer-formula(Linux) Uses an alternate method of working around a bad code-path in
salt that does not handle quoted values in /etc/sysconfig/network.0.4.2Commit Delta:Change from 0.4.1 releaseReleased: 2017.05.19Summary:[PR #301] Sets the grains for admin_groups and admin_users so the
keys are named as expected by the join-domain formulaash-linux-formulaAdds a custom module that lists users from the shadow fileGets local users from the shadow file rather thanuser.list_users.
Prevents a domain-joined system from attempting to iterate over all
domain users (and potentially deadlocking on especially large domains)join-domain-formulaModifies PBIS install method to use RPMs directly, rather than the
SHAR installerUpdates approaches to checking for collisions and current join status
to better handle various scenarios: not joined, no collision; not
joined, collision; joined, computer object present; joined, computer
object missingDisables NSS enumeration to prevent PBIS from querying user info from
the domain for every call to getent (or equivalents); domain-based
user authentication still works finename-computer-formula(Linux) Does not attempt to retain network settings, to avoid a bug in
salt; will be revisited when a patched salt version has been released0.4.1Commit Delta:Change from 0.4.0 releaseReleased: 2017.05.09Summary:(EL7) Runningwatchmakeragainst EL7 systems will now pin the resulting
configuration to the watchmaker version. See the updates to the two
formulas in this version. Previously,ash-linuxalways used the content
from thescap-security-guiderpm, which was updated out-of-sync withwatchmaker, and so the resulting configuration could not be pinned by
pinning thewatchmakerversion. With this version,ash-linuxuses
content distributed bywatchmaker, viascap-formula, and so the
resulting configuration will always be same on EL7 for a given version ofwatchmaker(as has always been the case for the other supported
operating systems).ash-linux-formulaSupports getting scap content locations from pillarscap-formulaUpdates stig content with latest benchmark versionsAdds openscap ds.xml content, used to support remediate actions0.4.0Commit Delta:Change from 0.3.1 releaseReleased: 2017.05.06Summary:[PR #286] Sets the computername grain with the correct key expected
by the formula[PR #284] Converts cli argument parsing fromargparsetoclick.
This modifies thewatchmakerdepedencies, which warranted a 0.x.0 version
bump. Cli and API arguments remain the same, so the change should be
backwards-compatible.name-computer-formulaAdds support for getting the computername from pillarAdds support for validating the specified computername against a
patternpshelp-formulaAttempts to address occasional stack overflow exception when updating
powershell help0.3.1Commit Delta:Change from 0.3.0 releaseReleased: 2017.05.01Summary:[PR #280] Modifies the dynamic import of boto3 to use only absolute
imports, as the previous approach (attempt absolute and relative import)
was deprecated in Python 3.3ntp-client-windows-formula:Stops using deprecated arguments on reg.present states, which cleans up
extraneous log messages in watchmaker runs under some configurationsjoin-domain-formula:(Windows) Sets the DNS search suffix when joining the domain, including
a new pillar config option,ec2configto enable/disable the EC2Config
option that also modifies the DNS suffix list.0.3.0Commit Delta:Change from 0.2.4 releaseReleased: 2017.04.24Summary:[Issue #270] Defaults to a platform-specific log directory when
call from the CLI:Windows:${Env:SystemDrive}\Watchmaker\LogsLinux:/var/log/watchmaker[PR #271] Modifies CLI arguments to use explicit log-levels rather
than a verbosity count. Arguments have been adjusted to better accommodate
the semantics of this approach:Uses-l|--log-levelinstead of-v|--verbose-vand-Vare now both used for--version-dis now used for--log-dir0.2.4Commit Delta:Change from 0.2.3 releaseReleased: 2017.04.20Summary:Fixes a bad version string0.2.3Commit Delta:Change from 0.2.2 releaseReleased: 2017.04.20Summary:[Issue #262] Merges lists in pillar files, rather than overwriting
them[Issue #261] Manages the enabled/disabled state of the salt-minion
service, before and after the installsplunkforwarder-formula(Windows) Ignores false bad exits from Splunk clone-prep-clear-config0.2.2Commit Delta:Change from 0.2.1 releaseReleased: 2017.04.15Summary:[PR #251] Adds CloudFormation templates that integrate Watchmaker
with an EC2 instance or Autoscale Groupjoin-domain-formula(Linux) Corrects tests that determine whether the instance is already
joined to the domain0.2.1Commit Delta:Change from 0.2.0 releaseReleased: 2017.04.10Summary:ash-linux-formulaReduces spurious stderr outputRemoves notify script flagged by McAfee scanssplunkforwarder-formula(Windows) Clears system name entries from local Splunk config files0.2.0Commit Delta:Change from 0.1.7 releaseReleased: 2017.04.06Summary:[Issue #238] Captures all unhandled exceptions and logs them[Issue #234] Stops the salt service prior to managing salt formulas,
to ensure that the filesystem does not throw any errors about the files
being locked[Issue #72] Manages salt service so the service state after
watchmaker completes is the same as it was prior to running watchmaker. If
the service was running beforehand, it remains running afterwards. If the
service was stopped (or non-existent) beforehad, the service remains
stopped afterwards[Issue #163] Modifies theuser_formulasconfig option to support
a map of<formula_name>:<formula_url>[PR #235] Extracts salt content to the same targetsrvlocation
for both Window and Linux. Previously, the salt content was extracted to
different points in the filesystem hierarchy, which required different
content for Windows and Linux. Now the same salt content archive can be
used for both[PR #242] Renames salt worker paramcontent_sourcetosalt_contentsystemprep-formulaDeprecated and removed. Replaced by new salt content structure that
uses native salt capabilities to map states to a systemscc-formulaDeprecated and removed. Replaced by scap-formulascap-formulaNew bundled salt formula. Provides SCAP scans using eitheropenscaporsccpshelp-formulaNew bundled salt formula. Installs updated PowerShell help content to
Windows systems0.1.7Commit Delta:Change from 0.1.6 releaseReleased: 2017.03.23Summary:Uses threads to stream stdout and stderr to the watchmaker log when
executing a command via subproces[Issue #226] Minimizes salt output of successful states, to
make it easier to identify failed statesjoin-domain-formula(Linux) Exits with stateful failure on a bad decryption errormcafee-agent-formula(Linux) Avoids attempting to diff a binary file(Linux) Installsedas a dependency of the McAfee VSEL agentscc-formulaRetries scan up to 5 times if scc exits with an error0.1.6Commit Delta:Change from 0.1.5 releaseReleased: 2017.03.16Summary:ash-linux-formulaProvides same baseline states for both EL6 and EL70.1.5Commit Delta:Change from 0.1.4 releaseReleased: 2017.03.15Summary:ash-linux-formulaAdds policies to disable insecure Ciphers and MACs in sshd_configash-windows-formulaAddsscmandstigbaselines for Windows 10Addsscmbaseline for Windows Server 2016 (Alpha)Updates allscmandstigbaselines with latest contentmcafee-agent-formulaUses firewalld on EL7 rather than iptablesscc-formulaSkips verification of GPG key when install SCC RPMsplunkforwarder-formulaUses firewalld on EL7 rather than iptables0.1.4Commit Delta:Change from 0.1.3 releaseReleased: 2017.03.09Summary:[Issue #180] Fixes bug where file_roots did not contain formula paths0.1.3Commit Delta:Change from 0.1.2 releaseReleased: 2017.03.08Summary:[Issue #164] Aligns cli syntax for extra_arguments with other cli opts[Issue #165] Removes ash_role from default config file[Issue #173] Fixes exception when re-running watchmaker0.1.2Commit Delta:Change from 0.1.1 releaseReleased: 2017.03.07Summary:Adds a FAQ page to the docsMoves salt formulas to the correct location on the local filesystemjoin-domain-formula:(Linux) Modifies decryption routine for FIPS complianceash-linux-formula:Removes several error exits in favor of warnings(EL7-alpha) Various patches to improve support for EL7dotnet4-formula:Adds support for .NET 4.6.2Adds support for Windows Server 2016emet-formula:Adds support for EMET 5.520.1.1Commit Delta:Change from 0.1.0 releaseReleased: 2017.02.28Summary:Adds more logging messages when downloading files0.1.0Commit Delta: N/AReleased: 2017.02.22Summary:Initial release!