create prioritized list of shared components

[afeld]

There are a number of components we believe will be broadly useful right away, and that have already had some thought put into them:

• Operating system hardening - #2
• Jenkins - https://github.com/GSA/jenkins-deploy
• nginx - https://github.com/GSA/jenkins-deploy/issues/23 & https://github.com/GSA/jenkins-deploy/issues/22

While that is plenty for us to get started with, putting this issue in as a placeholder for figuring out what the next big wins would be.

[JJediny]

Operating Systems

• [ ] Ubuntu 16.04 / Debain 9
• [ ] Centos 7 / RHEL 7
• [ ] Windows 2016
• [ ] Centos 6 / RHEL 6
• [ ] Ubuntu 14.04 / Debain 8
• [ ] Windows 2012 / 2012 R2

Web/Application Servers

• [ ] Nginx
• [ ] Apache
• [ ] Tomcat
• [ ] Jboss

For Future Consideration

• [ ] Jetty?
• [ ] HAproxy?
• [ ] Varnish?

Databases

• [ ] PostgreSQL
• [ ] MySQL
• [ ] MongoDB
• [ ] Redis

*for future consideration

• [ ] InfluxDB?
• [ ] Neo4j?
• [ ] orientDB?
• [ ] rabbitMQ?

Security Agents

• [ ] Nessus
• [ ] OSSEC-HIDS
• [ ] New Relic (ARM/Infrastructure)
• [ ] fluentd (pre-registered to SecOps Elasticsearch)
• [ ] logstash (pre-registered to SecOps Elasticsearch)
• [ ] filebeat (pre-registered to SecOps Elasticsearch)
• [ ] trendmicro (soon to be deprecated)

fluentd/logstash/filebeat w/ common log parsing/re-ex templates

Jumpbox Hardening

• [ ] ssh config
• [ ] fail2ban/pam config
• [ ] Google Authenticator 2FA
• [ ] GSA Secureauth Token (No known implementation - but avoids hardware constraint of Google Authenticator)

Standard Configurations

• [ ] logrotate
• [ ] cron
• [ ] rsync
• [ ] supervisor

[afeld]

Should we close this issue in favor of https://trello.com/b/RnhmNKh0/gsa-devsecops-components-under-consideration-or-in-use?

[Vermyndax]

I think so... I was a little confused by this list when I first encountered it, because of the Trello board.