SaltStack Comply configuration

Overview

SaltStack Comply is an add-on that provides automated compliance detection and remediation for your infrastructure. Its content library consists of industry best-practice security and compliance content, such as CIS.

The content library updates regularly as security standards change. You can configure content to download (or ingest) automatically as security standards change, which is recommended for most standard systems. As an alternative, the library includes the option to download content manually.

Prerequisites

Configuring SaltStack Comply is one post-installation step in a series of several steps that should be followed in a specific order. First, complete one of the installation scenarios and then read the following post-installation topics:

Automatic content ingestion for standard systems

For non-air-gapped RaaS systems, SaltStack Comply content is downloaded and ingested on a periodic basis as determined by the settings in the configuration file.

To configure automatic SaltStack Comply content ingestion:

  1. Add the following to the Raas configuration file /etc/raas/raas in the sec section, adapting it as necessary:

    sec:
      stats_snapshot_interval: 3600
      username: secops
      content_url: https://enterprise.saltstack.com/secops_downloads
      ingest_saltstack_override: true
      ingest_custom_override: true
      locke_dir: locke
      post_ingest_cleanup: true
      download_enabled: true
      download_frequency: 86400
      compile_stats_interval: 10
      archive_interval: 300
      old_policy_file_lifespan: 2
      delete_old_policy_files_interval: 86400
      ingest_on_boot: true
      content_lock_timeout: 60
      content_lock_block_timeout: 120
    

    For more information about these configuration settings, see Configuration options.

  2. Save the file.

  3. Restart RaaS.

    systemctl restart raas
    

    After the service restarts, SaltStack Comply content begins to download. This may take up to five minutes, depending on your internet connection.

Manual content ingestion

Air-gapped systems must update SaltStack Comply content from one of the RaaS nodes. Air-gapped systems are defined by a configuration setting of sec/download_enabled = False.

To configure ingestion for air-gapped systems:

  1. Download the SaltStack Comply content from the Downloads page.

  2. Log in to a RaaS node.

  3. Copy the SaltStack Comply content tarball to the RaaS node (tmp is recommended).

    This content could be delivered by email or any other means.

  4. Ingest the tarball contents.

    su - raas -c "raas ingest /path/to/locke.tar.gz.e"
    

    This returns:

    Extracting: /tmp/locke.tar.gz -> /tmp/extracted-1551290468.5497127
    
    Cleaning up: /tmp/extracted-1551290468.5497127
    
    Results:
    
    {'errors': [], 'success': True}
    

Configuration options

The following table describes the configuration options available for SaltStack Comply:

Option Description
stats_snapshot_interval How often (in seconds) SaltStack Comply stats will be collected
compile_stats_interval How often (in seconds) SaltStack Comply stats will be compiled
username Username to use when connecting to SaltStack Enterprise to download the most recent SaltStack Comply content (default: secops)
content_url URL used to download SaltStack Comply content (default: enterprise.saltstack.com/docs/downloads.html#saltstack-comply-and-protect-content)
ingest_override When ingesting new content, overwrite existing benchmarks and checks (default: True)
locke_dir Path where ingestion expects to find new content (default: locke). If you use a relative path (no leading /), then it is relative to the Raas cache dir /var/lib/raas/cache
post_ingest_cleanup Remove the expanded content from the file system after ingestion (default: True)
download_enabled Whether SaltStack Comply content downloads are allowed (default: True). Set this to False for air gapped systems.
download_frequency How often in seconds will RaaS attempt to download SaltStack Comply content (default: 86400 for 24 hours)
ingest_on_boot Should RaaS attempt to download SaltStack Comply content on boot? (default: True)
content_lock_timeout How long in seconds will content download locks last (default: 60)
content_lock_block_timeout How long in seconds will content download locks block before failing (default: 120)

Next steps

After configuring SaltStack Comply, there may be additional post-installation steps. Check the list of post-installation steps to ensure you have completed all the necessary steps.