Watchmaker support for Amazon Linux 2 and Amazon Linux 2023

[brianhatchl]

Has anyone attempted to add Watchmaker support for AL2 and AL2023 AMIs?

[lorengordon]

Hi @brianhatchl, it's been a while since any of us looked seriously at using any of the Amazon Linux distros with Watchmaker... Going waaaay back to the original amazonlinux, we did try, but it failed to support FIPS or SELinux, so we set it aside. There are essentially three things we need first, before it makes sense to put the time to it:

• FIPS Support (done in AL2023)
• SELinux Support (done in AL2023)
• An OpenSCAP Profile with remediation support, preferably distributed via ComplianceAsCode (Done recently-ish in v0.1.74)

So, in theory we could get things going, at this point. Which does highlight a 4th thing, a client or other business development project to cover the time. Or a really motivated user, submitting pull requests!

(Beyond the basic hardening, another roadblock to using AL2023 in an enterprise would likely also require support from all the various security agents used by the enterprise, e.g. splunk, nessus, forescout, etc... But that wouldn't stop Watchmaker from claiming support for the hardening function...)

[brianhatchl]

Hi @lorengordon, that sounds like good news. I anticipate we may end up needing this feature to get ATO for a program that uses AWS Elastic MapReduce (EMR). The nodes in those clusters only support Amazon Linux flavors of OS.

I have had luck installing OpenSCAP on AL2/AL2023, and it had a profile for amazon linux and I was able to generate a STIG Report (pretty low score in the 60s 😬 out of the box). I'm not sure if this profile is one with remediation support. I was also able to install Nessus agent and get a vulnerability scan for it. Have not tried installing Splunk yet, but 🤞 it may just work.

We have some python developers on the program, so will probably see if we could add AL support and submit a PR. If we end up stuck or end up with less time than money I'll reach out about funding the effort.

Thanks!

[lorengordon]

I can offer some coaching on where to add support... Watchmaker source is a submodule wrapper around a number of salt formulas, so the PR contributions are a little spread out. Check .gitmodules for complete list, but here's a few that definitely need updating:

• watchmaker-salt-content
  • Default salt pillar content with per-platform logic
• scap-formula
  • Builds SCAP content for distribution by Watchmaker
  • Contains logic for running scap scans against a given platform for a given profile
• ash-linux-formula
  • Contains logic for platform remediation using openscap profiles and also applying "extra" salt states to improve coverage of findings
• join-domain-formula, splunkforwarder-formula, trellix-agent-formula, nessus-agent-formula, forescout-secure-connector-formula
  • Enterprise integrations that may or may not have platform-specific logic

In watchmaker source itself, the main updates I'd expect would be under the yum.py and salt.py workers...

• https://github.com/plus3it/watchmaker/tree/main/src/watchmaker/workers

[ferricoxide]

Looks like Amazon finally submitted a STIG package to DISA (on September 4^th, 2029):

Will need hours allocated in order to evaluate the new content for updates to the ash-linux-formula project before we can attack this.