Fix threatstack user homedir to comply with CIS benchmark guidelines

[pkaeding]

added tasks to ensure the threatstack user homedirectory is owned by that user, and is mode 0750, per CIS hardening guidelines

I have tested this against Ubuntu 18.04. I'm having trouble figuring out how to run the test-kitchen tests. I haven't done much with test-kitchen, so if you can provide any further instructions on how to do it, I can run the tests.

Or, if there is CI to run the tests, I'm happy to rely on those results.

[pkaeding]

Looks like the CI build failed when it got a 500 response trying to register:

TASK [threatstack-ansible : Agent setup] ***************************************
FAILED - RETRYING: Agent setup (3 retries left).
FAILED - RETRYING: Agent setup (2 retries left).
FAILED - RETRYING: Agent setup (1 retries left).
fatal: [localhost]: FAILED! => {"attempts": 3, "changed": false, "cmd": ["tsagent", "setup", "--url", "https://app.threatstack.com", "--deploy-key", "--ruleset", "Travis Rule Set", "--hostname", "TravisCI_20210409"], "delta": "0:00:00.337697", "end": "2021-04-09 13:15:06.253015", "msg": "non-zero return code", "rc": 1, "start": "2021-04-09 13:15:05.915318", "stderr": "", "stderr_lines": [], "stdout": "agent registration failed: 500 Internal Server Error", "stdout_lines": ["agent registration failed: 500 Internal Server Error"]}

Can anyone at Threatstack help me figure this out? Is this just an ephemeral error? I know we often get agents failing to register; I assume it is due to some intermittent issues in the Threatstack service. I'm not sure if that is what is going on here, or if there is an issue I introduced with my change (like something in the homedir can't be read by the agent, or something).

[olhado]

Hi @pkaeding !

Thanks for the PR!

The easiest way to test is to have ruby and docker installed locally and run bundle install && bundle exec kitchen test <test-suite>, where test suite options are default and custom.

Note that if you have the experimental feature enabled for docker, the command should be bundle install && DOCKER_BUILDKIT=0 bundle exec kitchen test <test-suite>

[olhado]

As far as the CI job, we have seen issues with Travis jobs from forks. I wouldn’t worry about it too much. I plan to check out your change but moving it to the upstream repo as a branch in the next couple of days

[olhado]

Closing