Make the baseline reapply itself

applied · 75 min · Objective 4.1

Task

Turn the settings from the previous lab into enforcement that corrects drift automatically, then prove it by breaking a setting and watching it come back. This is the maintain stage, and it is the difference between a baseline and a document.

Steps

  1. Express five of your benchmark settings declaratively — as an Ansible playbook, a shell script that is safe to re-run, or systemd units with a timer. What matters is that running it twice is harmless.
  2. Run it once and confirm the five settings are correct.
  3. Run it again and confirm it reports no changes. A configuration tool that reports changes every run cannot tell you whether anything drifted.
  4. Schedule it to run every few minutes for the duration of this lab.
  5. Now drift: change one of the five settings by hand, the way a colleague fixing something at 2am would.
  6. Wait for the next run and confirm the setting has been corrected automatically. Record in /tmp/enforce.md the time you broke it, the time it was corrected, and how long the machine was non-compliant.

Verify

sudo systemctl list-timers --no-pager 2>/dev/null | grep -ci baseline || crontab -l | grep -ci baseline
bash /tmp/baseline-apply.sh 2>&1 | grep -ciE "changed|modified" ; echo "(second run should be 0)"
python3 - <<'PY'
import subprocess,time,pathlib
f='/etc/ssh/sshd_config'
def setting():
    for l in open(f):
        if l.strip().startswith('PermitRootLogin'): return l.strip()
    return 'absent'
print('current:',setting())
PY
grep -ciE "non.compliant|corrected|window" /tmp/enforce.md

The second command is the important one and must be 0 on a repeat run — idempotence is what lets the tool report drift rather than manufacture it. The window you recorded in /tmp/enforce.md is the real output: it is how long a machine stays wrong after somebody changes it, and it is the number that decides whether a five-minute interval is worth the load.

Notes

The point the lesson makes is now measurable. A baseline applied once is a snapshot of good intentions; the difference between that and a control is the timer you just scheduled, and the window it leaves is the residual risk.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.