From dbac9683b64b0d2dc9fefc6f7d6dee1801988a2e Mon Sep 17 00:00:00 2001
From: karthickaliappa <karthic.kaliappa@broadcom.com>
Date: Mon, 3 Aug 2026 10:37:00 +0530
Subject: [PATCH 1/9] Add CIS/STIG compliance hardening for sshd, sudo, and
 shell timeout

- Set MaxStartups 10:30:100 in sshd_config (CIS 5.1.18)
- Enable use_pty and logfile=/var/log/sudo.log in sudoers (CIS 5.2.2, 5.2.3)
- Configure TMOUT=900 shell timeout in /etc/profile.d/01-tmout.sh (CIS 5.4.3.2)
- Add corresponding rspec tests in os_image_shared_examples
---
 .../spec/support/os_image_shared_examples.rb        | 13 +++++++++++++
 stemcell_builder/stages/base_ssh/apply.sh           |  3 +++
 stemcell_builder/stages/bosh_users/apply.sh         |  7 +++++++
 stemcell_builder/stages/bosh_users/assets/sudoers   |  2 ++
 4 files changed, 25 insertions(+)

diff --git a/bosh-stemcell/spec/support/os_image_shared_examples.rb b/bosh-stemcell/spec/support/os_image_shared_examples.rb
index 665b290ed4..6e60e0503d 100644
--- a/bosh-stemcell/spec/support/os_image_shared_examples.rb
+++ b/bosh-stemcell/spec/support/os_image_shared_examples.rb
@@ -26,6 +26,8 @@
       it { should be_file }
       its(:content) { should match(/%bosh_sudoers ALL=\(ALL\) NOPASSWD: ALL/m) }
       its(:content) { should match "#includedir /etc/sudoers.d" }
+      its(:content) { should match(/^Defaults\s+use_pty$/) }
+      its(:content) { should match(%r{^Defaults\s+logfile=/var/log/sudo\.log$}) }
     end
   end
 
@@ -69,6 +71,13 @@
       it { should be_file }
     end
 
+    describe file("/etc/profile.d/01-tmout.sh") do
+      it { should be_file }
+      it { should be_mode(0o644) }
+      its(:content) { should match(/^readonly TMOUT=900$/) }
+      its(:content) { should match(/^export TMOUT$/) }
+    end
+
     describe command("grep -q .bashrc /root/.profile") do
       it("has exit status of 0") { expect(subject.exit_status).to eq 0 }
     end
@@ -229,6 +238,10 @@
       expect(sshd_config.content).to match(/^MaxAuthTries 3$/)
     end
 
+    it "sets MaxStartups to 10:30:100" do
+      expect(sshd_config.content).to match(/^MaxStartups 10:30:100$/)
+    end
+
     it "sets PermitEmptyPasswords to no (stig: V-38614)" do
       expect(sshd_config.content).to match(/^PermitEmptyPasswords no$/)
     end
diff --git a/stemcell_builder/stages/base_ssh/apply.sh b/stemcell_builder/stages/base_ssh/apply.sh
index c6573274db..dbc49c57cc 100755
--- a/stemcell_builder/stages/base_ssh/apply.sh
+++ b/stemcell_builder/stages/base_ssh/apply.sh
@@ -24,6 +24,9 @@ echo 'X11Forwarding no' >> $chroot/etc/ssh/sshd_config
 sed "/^ *MaxAuthTries/d" -i $chroot/etc/ssh/sshd_config
 echo 'MaxAuthTries 3' >> $chroot/etc/ssh/sshd_config
 
+sed "/^ *MaxStartups/d" -i $chroot/etc/ssh/sshd_config
+echo 'MaxStartups 10:30:100' >> $chroot/etc/ssh/sshd_config
+
 sed "/^ *PermitEmptyPasswords/d" -i $chroot/etc/ssh/sshd_config
 echo 'PermitEmptyPasswords no' >> $chroot/etc/ssh/sshd_config
 
diff --git a/stemcell_builder/stages/bosh_users/apply.sh b/stemcell_builder/stages/bosh_users/apply.sh
index 6afe426c05..bc24ec37b3 100755
--- a/stemcell_builder/stages/bosh_users/apply.sh
+++ b/stemcell_builder/stages/bosh_users/apply.sh
@@ -36,3 +36,10 @@ cp $assets_dir/ps1.sh $chroot/etc/profile.d/00-bosh-ps1
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/root/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/home/vcap/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/etc/skel/.bashrc
+
+# configure idle session shell timeout
+cat << 'EOF' > $chroot/etc/profile.d/01-tmout.sh
+readonly TMOUT=900
+export TMOUT
+EOF
+chmod 0644 $chroot/etc/profile.d/01-tmout.sh
diff --git a/stemcell_builder/stages/bosh_users/assets/sudoers b/stemcell_builder/stages/bosh_users/assets/sudoers
index d2f7795cc6..e63cead93f 100644
--- a/stemcell_builder/stages/bosh_users/assets/sudoers
+++ b/stemcell_builder/stages/bosh_users/assets/sudoers
@@ -4,6 +4,8 @@
 # Defaults
 
 Defaults        !lecture,tty_tickets,!fqdn
+Defaults        use_pty
+Defaults        logfile=/var/log/sudo.log
 
 # Uncomment to allow members of group sudo to not need a password
 # %sudo ALL=NOPASSWD: ALL

From 602c2ec47e028a4d6537020a26db0ed90d43e616 Mon Sep 17 00:00:00 2001
From: karthickaliappa <karthic.kaliappa@broadcom.com>
Date: Mon, 3 Aug 2026 10:46:22 +0530
Subject: [PATCH 2/9] Update MaxStartups to 10:30:60 per CIS 5.1.18 benchmark
 recommendation

- Change MaxStartups from default 10:30:100 to 10:30:60 in sshd_config
- Update corresponding rspec test assertion
---
 bosh-stemcell/spec/support/os_image_shared_examples.rb | 4 ++--
 stemcell_builder/stages/base_ssh/apply.sh              | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bosh-stemcell/spec/support/os_image_shared_examples.rb b/bosh-stemcell/spec/support/os_image_shared_examples.rb
index 6e60e0503d..02ea73160d 100644
--- a/bosh-stemcell/spec/support/os_image_shared_examples.rb
+++ b/bosh-stemcell/spec/support/os_image_shared_examples.rb
@@ -238,8 +238,8 @@
       expect(sshd_config.content).to match(/^MaxAuthTries 3$/)
     end
 
-    it "sets MaxStartups to 10:30:100" do
-      expect(sshd_config.content).to match(/^MaxStartups 10:30:100$/)
+    it "sets MaxStartups to 10:30:60" do
+      expect(sshd_config.content).to match(/^MaxStartups 10:30:60$/)
     end
 
     it "sets PermitEmptyPasswords to no (stig: V-38614)" do
diff --git a/stemcell_builder/stages/base_ssh/apply.sh b/stemcell_builder/stages/base_ssh/apply.sh
index dbc49c57cc..720a74b168 100755
--- a/stemcell_builder/stages/base_ssh/apply.sh
+++ b/stemcell_builder/stages/base_ssh/apply.sh
@@ -25,7 +25,7 @@ sed "/^ *MaxAuthTries/d" -i $chroot/etc/ssh/sshd_config
 echo 'MaxAuthTries 3' >> $chroot/etc/ssh/sshd_config
 
 sed "/^ *MaxStartups/d" -i $chroot/etc/ssh/sshd_config
-echo 'MaxStartups 10:30:100' >> $chroot/etc/ssh/sshd_config
+echo 'MaxStartups 10:30:60' >> $chroot/etc/ssh/sshd_config
 
 sed "/^ *PermitEmptyPasswords/d" -i $chroot/etc/ssh/sshd_config
 echo 'PermitEmptyPasswords no' >> $chroot/etc/ssh/sshd_config

From 7936f44797db8037793d2c37ff407319eeda0093 Mon Sep 17 00:00:00 2001
From: karthickaliappa <karthic.kaliappa@broadcom.com>
Date: Mon, 3 Aug 2026 10:57:00 +0530
Subject: [PATCH 3/9] Address automated CodeRabbit review feedback

- Assert root ownership and group for /etc/profile.d/01-tmout.sh in rspec tests
- Ensure MaxStartups scan validates single directive in sshd_config
- Normalize MaxStartups sed pattern to match tab/space indentations and quote chroot paths
- Quote chroot path expansions in TMOUT profile script creation
---
 bosh-stemcell/spec/support/os_image_shared_examples.rb | 4 +++-
 stemcell_builder/stages/base_ssh/apply.sh              | 4 ++--
 stemcell_builder/stages/bosh_users/apply.sh            | 4 ++--
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/bosh-stemcell/spec/support/os_image_shared_examples.rb b/bosh-stemcell/spec/support/os_image_shared_examples.rb
index 02ea73160d..a55fb08282 100644
--- a/bosh-stemcell/spec/support/os_image_shared_examples.rb
+++ b/bosh-stemcell/spec/support/os_image_shared_examples.rb
@@ -74,6 +74,8 @@
     describe file("/etc/profile.d/01-tmout.sh") do
       it { should be_file }
       it { should be_mode(0o644) }
+      it { should be_owned_by("root") }
+      its(:group) { should eq("root") }
       its(:content) { should match(/^readonly TMOUT=900$/) }
       its(:content) { should match(/^export TMOUT$/) }
     end
@@ -239,7 +241,7 @@
     end
 
     it "sets MaxStartups to 10:30:60" do
-      expect(sshd_config.content).to match(/^MaxStartups 10:30:60$/)
+      expect(sshd_config.content.scan(/^[ \t]*MaxStartups\s+\S+$/)).to contain_exactly("MaxStartups 10:30:60")
     end
 
     it "sets PermitEmptyPasswords to no (stig: V-38614)" do
diff --git a/stemcell_builder/stages/base_ssh/apply.sh b/stemcell_builder/stages/base_ssh/apply.sh
index 720a74b168..52d3aa01e1 100755
--- a/stemcell_builder/stages/base_ssh/apply.sh
+++ b/stemcell_builder/stages/base_ssh/apply.sh
@@ -24,8 +24,8 @@ echo 'X11Forwarding no' >> $chroot/etc/ssh/sshd_config
 sed "/^ *MaxAuthTries/d" -i $chroot/etc/ssh/sshd_config
 echo 'MaxAuthTries 3' >> $chroot/etc/ssh/sshd_config
 
-sed "/^ *MaxStartups/d" -i $chroot/etc/ssh/sshd_config
-echo 'MaxStartups 10:30:60' >> $chroot/etc/ssh/sshd_config
+sed "/^[ \t]*MaxStartups/d" -i "$chroot/etc/ssh/sshd_config"
+echo 'MaxStartups 10:30:60' >> "$chroot/etc/ssh/sshd_config"
 
 sed "/^ *PermitEmptyPasswords/d" -i $chroot/etc/ssh/sshd_config
 echo 'PermitEmptyPasswords no' >> $chroot/etc/ssh/sshd_config
diff --git a/stemcell_builder/stages/bosh_users/apply.sh b/stemcell_builder/stages/bosh_users/apply.sh
index bc24ec37b3..e0ffe4fd68 100755
--- a/stemcell_builder/stages/bosh_users/apply.sh
+++ b/stemcell_builder/stages/bosh_users/apply.sh
@@ -38,8 +38,8 @@ echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/home/vcap/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/etc/skel/.bashrc
 
 # configure idle session shell timeout
-cat << 'EOF' > $chroot/etc/profile.d/01-tmout.sh
+cat << 'EOF' > "$chroot/etc/profile.d/01-tmout.sh"
 readonly TMOUT=900
 export TMOUT
 EOF
-chmod 0644 $chroot/etc/profile.d/01-tmout.sh
+chmod 0644 "$chroot/etc/profile.d/01-tmout.sh"

From a38f56b9fde2c03d1933e2b86ddac57b8149f290 Mon Sep 17 00:00:00 2001
From: karthickaliappa <karthic.kaliappa@broadcom.com>
Date: Thu, 6 Aug 2026 09:49:54 +0530
Subject: [PATCH 4/9] Address CodeRabbit review feedback for sudoers and spec
 tests

---
 bosh-stemcell/spec/support/os_image_shared_examples.rb | 4 ++++
 stemcell_builder/stages/bosh_sudoers/apply.sh          | 4 ++--
 stemcell_builder/stages/bosh_users/assets/sudoers      | 2 ++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/bosh-stemcell/spec/support/os_image_shared_examples.rb b/bosh-stemcell/spec/support/os_image_shared_examples.rb
index a55fb08282..4afd95132a 100644
--- a/bosh-stemcell/spec/support/os_image_shared_examples.rb
+++ b/bosh-stemcell/spec/support/os_image_shared_examples.rb
@@ -29,6 +29,10 @@
       its(:content) { should match(/^Defaults\s+use_pty$/) }
       its(:content) { should match(%r{^Defaults\s+logfile=/var/log/sudo\.log$}) }
     end
+
+    describe command("egrep -sh '!use_pty' /etc/sudoers /etc/sudoers.d/* | egrep -v '^#' --") do
+      its(:stdout) { should eq("") }
+    end
   end
 
   context "effective GID for UID vcap" do
diff --git a/stemcell_builder/stages/bosh_sudoers/apply.sh b/stemcell_builder/stages/bosh_sudoers/apply.sh
index b9c29692fe..e452d5b7ff 100755
--- a/stemcell_builder/stages/bosh_sudoers/apply.sh
+++ b/stemcell_builder/stages/bosh_sudoers/apply.sh
@@ -7,8 +7,8 @@ source $base_dir/lib/prelude_apply.bash
 source $base_dir/lib/prelude_bosh.bash
 
 # setup sudoers to use includedir, and make sure we don't break anything
-cp -p $chroot/etc/sudoers $chroot/etc/sudoers.save
-echo '#includedir /etc/sudoers.d' >> $chroot/etc/sudoers
+cp -p "$chroot/etc/sudoers" "$chroot/etc/sudoers.save"
+grep -q '#includedir /etc/sudoers.d' "$chroot/etc/sudoers" || echo '#includedir /etc/sudoers.d' >> "$chroot/etc/sudoers"
 run_in_bosh_chroot $chroot "visudo -c"
 if [ $? -ne 0 ]; then
   echo "ERROR: bad sudoers file"
diff --git a/stemcell_builder/stages/bosh_users/assets/sudoers b/stemcell_builder/stages/bosh_users/assets/sudoers
index e63cead93f..22c8baf690 100644
--- a/stemcell_builder/stages/bosh_users/assets/sudoers
+++ b/stemcell_builder/stages/bosh_users/assets/sudoers
@@ -24,3 +24,5 @@ root    ALL=(ALL) ALL
 
 # Members of bosh_sudoers do not require password to run sudo commands
 %bosh_sudoers ALL=(ALL) NOPASSWD: ALL
+
+#includedir /etc/sudoers.d

From a43a7d52558e1684ccb9bff8474fd6e096463b6c Mon Sep 17 00:00:00 2001
From: karthickaliappa <karthic.kaliappa@broadcom.com>
Date: Thu, 6 Aug 2026 12:18:02 +0530
Subject: [PATCH 5/9] Add CIS benchmark rule annotations to stemcell hardening
 stages and specs

Annotate SSH MaxStartups (CIS-5.1.18), sudo use_pty (CIS-5.2.2), sudo logfile
(CIS-5.2.3), and TMOUT idle timeout (CIS-5.4.3.2) in build scripts, assets,
and RSpec shared examples.
---
 .../spec/support/os_image_shared_examples.rb  | 20 ++++++++++---------
 stemcell_builder/stages/base_ssh/apply.sh     |  1 +
 stemcell_builder/stages/bosh_sudoers/apply.sh |  2 +-
 stemcell_builder/stages/bosh_users/apply.sh   |  2 +-
 .../stages/bosh_users/assets/sudoers          |  2 ++
 5 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/bosh-stemcell/spec/support/os_image_shared_examples.rb b/bosh-stemcell/spec/support/os_image_shared_examples.rb
index 4afd95132a..e9958ac455 100644
--- a/bosh-stemcell/spec/support/os_image_shared_examples.rb
+++ b/bosh-stemcell/spec/support/os_image_shared_examples.rb
@@ -21,7 +21,7 @@
     end
   end
 
-  context "installed by bosh_sudoers" do
+  context "installed by bosh_sudoers (CIS-5.2.2, CIS-5.2.3)" do
     describe file("/etc/sudoers") do
       it { should be_file }
       its(:content) { should match(/%bosh_sudoers ALL=\(ALL\) NOPASSWD: ALL/m) }
@@ -75,13 +75,15 @@
       it { should be_file }
     end
 
-    describe file("/etc/profile.d/01-tmout.sh") do
-      it { should be_file }
-      it { should be_mode(0o644) }
-      it { should be_owned_by("root") }
-      its(:group) { should eq("root") }
-      its(:content) { should match(/^readonly TMOUT=900$/) }
-      its(:content) { should match(/^export TMOUT$/) }
+    context "idle session timeout (CIS-5.4.3.2)" do
+      describe file("/etc/profile.d/01-tmout.sh") do
+        it { should be_file }
+        it { should be_mode(0o644) }
+        it { should be_owned_by("root") }
+        its(:group) { should eq("root") }
+        its(:content) { should match(/^readonly TMOUT=900$/) }
+        its(:content) { should match(/^export TMOUT$/) }
+      end
     end
 
     describe command("grep -q .bashrc /root/.profile") do
@@ -244,7 +246,7 @@
       expect(sshd_config.content).to match(/^MaxAuthTries 3$/)
     end
 
-    it "sets MaxStartups to 10:30:60" do
+    it "sets MaxStartups to 10:30:60 (CIS-5.1.18)" do
       expect(sshd_config.content.scan(/^[ \t]*MaxStartups\s+\S+$/)).to contain_exactly("MaxStartups 10:30:60")
     end
 
diff --git a/stemcell_builder/stages/base_ssh/apply.sh b/stemcell_builder/stages/base_ssh/apply.sh
index 52d3aa01e1..6d4b252542 100755
--- a/stemcell_builder/stages/base_ssh/apply.sh
+++ b/stemcell_builder/stages/base_ssh/apply.sh
@@ -24,6 +24,7 @@ echo 'X11Forwarding no' >> $chroot/etc/ssh/sshd_config
 sed "/^ *MaxAuthTries/d" -i $chroot/etc/ssh/sshd_config
 echo 'MaxAuthTries 3' >> $chroot/etc/ssh/sshd_config
 
+# CIS 5.1.18 - Ensure SSH MaxStartups is configured
 sed "/^[ \t]*MaxStartups/d" -i "$chroot/etc/ssh/sshd_config"
 echo 'MaxStartups 10:30:60' >> "$chroot/etc/ssh/sshd_config"
 
diff --git a/stemcell_builder/stages/bosh_sudoers/apply.sh b/stemcell_builder/stages/bosh_sudoers/apply.sh
index e452d5b7ff..2fbb913922 100755
--- a/stemcell_builder/stages/bosh_sudoers/apply.sh
+++ b/stemcell_builder/stages/bosh_sudoers/apply.sh
@@ -6,7 +6,7 @@ base_dir=$(readlink -nf $(dirname $0)/../..)
 source $base_dir/lib/prelude_apply.bash
 source $base_dir/lib/prelude_bosh.bash
 
-# setup sudoers to use includedir, and make sure we don't break anything
+# enable sudoers.d drop-in support (used by CIS 5.2.2/5.2.3 hardening applied via bosh_users), and make sure we don't break anything
 cp -p "$chroot/etc/sudoers" "$chroot/etc/sudoers.save"
 grep -q '#includedir /etc/sudoers.d' "$chroot/etc/sudoers" || echo '#includedir /etc/sudoers.d' >> "$chroot/etc/sudoers"
 run_in_bosh_chroot $chroot "visudo -c"
diff --git a/stemcell_builder/stages/bosh_users/apply.sh b/stemcell_builder/stages/bosh_users/apply.sh
index e0ffe4fd68..a639c13bc7 100755
--- a/stemcell_builder/stages/bosh_users/apply.sh
+++ b/stemcell_builder/stages/bosh_users/apply.sh
@@ -37,7 +37,7 @@ echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/root/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/home/vcap/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/etc/skel/.bashrc
 
-# configure idle session shell timeout
+# configure idle session shell timeout (CIS 5.4.3.2)
 cat << 'EOF' > "$chroot/etc/profile.d/01-tmout.sh"
 readonly TMOUT=900
 export TMOUT
diff --git a/stemcell_builder/stages/bosh_users/assets/sudoers b/stemcell_builder/stages/bosh_users/assets/sudoers
index 22c8baf690..d6e0c52036 100644
--- a/stemcell_builder/stages/bosh_users/assets/sudoers
+++ b/stemcell_builder/stages/bosh_users/assets/sudoers
@@ -4,7 +4,9 @@
 # Defaults
 
 Defaults        !lecture,tty_tickets,!fqdn
+# CIS 5.2.2
 Defaults        use_pty
+# CIS 5.2.3
 Defaults        logfile=/var/log/sudo.log
 
 # Uncomment to allow members of group sudo to not need a password

From 6b93fb98cad0e3e7abfa18dd2af9038fbecdfcc7 Mon Sep 17 00:00:00 2001
From: karthickaliappa <karthic.kaliappa@broadcom.com>
Date: Thu, 6 Aug 2026 13:31:56 +0530
Subject: [PATCH 6/9] Ignore whitespace-prefixed comments in !use_pty spec
 check

Update egrep pattern to '^[[:space:]]*#' so commented-out !use_pty lines
with leading spaces or tabs are properly ignored in the spec assertion.
---
 bosh-stemcell/spec/support/os_image_shared_examples.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bosh-stemcell/spec/support/os_image_shared_examples.rb b/bosh-stemcell/spec/support/os_image_shared_examples.rb
index e9958ac455..ab4c5be95e 100644
--- a/bosh-stemcell/spec/support/os_image_shared_examples.rb
+++ b/bosh-stemcell/spec/support/os_image_shared_examples.rb
@@ -30,7 +30,7 @@
       its(:content) { should match(%r{^Defaults\s+logfile=/var/log/sudo\.log$}) }
     end
 
-    describe command("egrep -sh '!use_pty' /etc/sudoers /etc/sudoers.d/* | egrep -v '^#' --") do
+    describe command("egrep -sh '!use_pty' /etc/sudoers /etc/sudoers.d/* | egrep -v '^[[:space:]]*#' --") do
       its(:stdout) { should eq("") }
     end
   end

From bb4de498e24815d9399b39893c9ba969cb64a09f Mon Sep 17 00:00:00 2001
From: karthickaliappa <karthic.kaliappa@broadcom.com>
Date: Thu, 6 Aug 2026 13:50:27 +0530
Subject: [PATCH 7/9] Normalize scanned MaxStartups SSH lines with strip in
 spec assertion

Strip leading/trailing whitespace from scanned MaxStartups directives
before checking contain_exactly in os_image_shared_examples.rb.
---
 bosh-stemcell/spec/support/os_image_shared_examples.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bosh-stemcell/spec/support/os_image_shared_examples.rb b/bosh-stemcell/spec/support/os_image_shared_examples.rb
index ab4c5be95e..4a068a0810 100644
--- a/bosh-stemcell/spec/support/os_image_shared_examples.rb
+++ b/bosh-stemcell/spec/support/os_image_shared_examples.rb
@@ -247,7 +247,7 @@
     end
 
     it "sets MaxStartups to 10:30:60 (CIS-5.1.18)" do
-      expect(sshd_config.content.scan(/^[ \t]*MaxStartups\s+\S+$/)).to contain_exactly("MaxStartups 10:30:60")
+      expect(sshd_config.content.scan(/^[ \t]*MaxStartups\s+\S+$/).map(&:strip)).to contain_exactly("MaxStartups 10:30:60")
     end
 
     it "sets PermitEmptyPasswords to no (stig: V-38614)" do

From 9f524a225f5901d88d93a8f4c8d87b05e7eb3224 Mon Sep 17 00:00:00 2001
From: karthickaliappa <karthic.kaliappa@broadcom.com>
Date: Fri, 7 Aug 2026 12:26:45 +0530
Subject: [PATCH 8/9] Address reviewer feedback on stage comments and sudoers
 setup

---
 stemcell_builder/stages/base_ssh/apply.sh         | 1 -
 stemcell_builder/stages/bosh_sudoers/apply.sh     | 4 ++--
 stemcell_builder/stages/bosh_users/apply.sh       | 2 +-
 stemcell_builder/stages/bosh_users/assets/sudoers | 6 ++----
 4 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/stemcell_builder/stages/base_ssh/apply.sh b/stemcell_builder/stages/base_ssh/apply.sh
index 6d4b252542..52d3aa01e1 100755
--- a/stemcell_builder/stages/base_ssh/apply.sh
+++ b/stemcell_builder/stages/base_ssh/apply.sh
@@ -24,7 +24,6 @@ echo 'X11Forwarding no' >> $chroot/etc/ssh/sshd_config
 sed "/^ *MaxAuthTries/d" -i $chroot/etc/ssh/sshd_config
 echo 'MaxAuthTries 3' >> $chroot/etc/ssh/sshd_config
 
-# CIS 5.1.18 - Ensure SSH MaxStartups is configured
 sed "/^[ \t]*MaxStartups/d" -i "$chroot/etc/ssh/sshd_config"
 echo 'MaxStartups 10:30:60' >> "$chroot/etc/ssh/sshd_config"
 
diff --git a/stemcell_builder/stages/bosh_sudoers/apply.sh b/stemcell_builder/stages/bosh_sudoers/apply.sh
index 2fbb913922..15fa93a70b 100755
--- a/stemcell_builder/stages/bosh_sudoers/apply.sh
+++ b/stemcell_builder/stages/bosh_sudoers/apply.sh
@@ -6,9 +6,9 @@ base_dir=$(readlink -nf $(dirname $0)/../..)
 source $base_dir/lib/prelude_apply.bash
 source $base_dir/lib/prelude_bosh.bash
 
-# enable sudoers.d drop-in support (used by CIS 5.2.2/5.2.3 hardening applied via bosh_users), and make sure we don't break anything
+# enable sudoers.d drop-in support, and make sure we don't break anything
 cp -p "$chroot/etc/sudoers" "$chroot/etc/sudoers.save"
-grep -q '#includedir /etc/sudoers.d' "$chroot/etc/sudoers" || echo '#includedir /etc/sudoers.d' >> "$chroot/etc/sudoers"
+echo '#includedir /etc/sudoers.d' >> "$chroot/etc/sudoers"
 run_in_bosh_chroot $chroot "visudo -c"
 if [ $? -ne 0 ]; then
   echo "ERROR: bad sudoers file"
diff --git a/stemcell_builder/stages/bosh_users/apply.sh b/stemcell_builder/stages/bosh_users/apply.sh
index a639c13bc7..e0ffe4fd68 100755
--- a/stemcell_builder/stages/bosh_users/apply.sh
+++ b/stemcell_builder/stages/bosh_users/apply.sh
@@ -37,7 +37,7 @@ echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/root/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/home/vcap/.bashrc
 echo "source /etc/profile.d/00-bosh-ps1" >> $chroot/etc/skel/.bashrc
 
-# configure idle session shell timeout (CIS 5.4.3.2)
+# configure idle session shell timeout
 cat << 'EOF' > "$chroot/etc/profile.d/01-tmout.sh"
 readonly TMOUT=900
 export TMOUT
diff --git a/stemcell_builder/stages/bosh_users/assets/sudoers b/stemcell_builder/stages/bosh_users/assets/sudoers
index d6e0c52036..e64a91ef67 100644
--- a/stemcell_builder/stages/bosh_users/assets/sudoers
+++ b/stemcell_builder/stages/bosh_users/assets/sudoers
@@ -4,9 +4,9 @@
 # Defaults
 
 Defaults        !lecture,tty_tickets,!fqdn
-# CIS 5.2.2
+# Run sudo commands in a dedicated pseudo-terminal
 Defaults        use_pty
-# CIS 5.2.3
+# Log sudo activity to a dedicated log file
 Defaults        logfile=/var/log/sudo.log
 
 # Uncomment to allow members of group sudo to not need a password
@@ -26,5 +26,3 @@ root    ALL=(ALL) ALL
 
 # Members of bosh_sudoers do not require password to run sudo commands
 %bosh_sudoers ALL=(ALL) NOPASSWD: ALL
-
-#includedir /etc/sudoers.d

From df4787e88b0356bbde0cfdc0f2d9791acf671355 Mon Sep 17 00:00:00 2001
From: karthickaliappa <karthic.kaliappa@broadcom.com>
Date: Fri, 7 Aug 2026 12:44:55 +0530
Subject: [PATCH 9/9] Revert changes to bosh_sudoers/apply.sh to keep file in
 original state

---
 stemcell_builder/stages/bosh_sudoers/apply.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stemcell_builder/stages/bosh_sudoers/apply.sh b/stemcell_builder/stages/bosh_sudoers/apply.sh
index 15fa93a70b..b9c29692fe 100755
--- a/stemcell_builder/stages/bosh_sudoers/apply.sh
+++ b/stemcell_builder/stages/bosh_sudoers/apply.sh
@@ -6,9 +6,9 @@ base_dir=$(readlink -nf $(dirname $0)/../..)
 source $base_dir/lib/prelude_apply.bash
 source $base_dir/lib/prelude_bosh.bash
 
-# enable sudoers.d drop-in support, and make sure we don't break anything
-cp -p "$chroot/etc/sudoers" "$chroot/etc/sudoers.save"
-echo '#includedir /etc/sudoers.d' >> "$chroot/etc/sudoers"
+# setup sudoers to use includedir, and make sure we don't break anything
+cp -p $chroot/etc/sudoers $chroot/etc/sudoers.save
+echo '#includedir /etc/sudoers.d' >> $chroot/etc/sudoers
 run_in_bosh_chroot $chroot "visudo -c"
 if [ $? -ne 0 ]; then
   echo "ERROR: bad sudoers file"