pentest-stig

name	pentest-stig
description	DISA STIG (Security Technical Implementation Guide) audit + GPO remediation + keep-open justification advisory. Triggers on STIG, DISA, SCAP, OpenSCAP, Compliance Master, GPO, group policy hardening, keep-open justification, CKL.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents stig-analyst"}

pentest-stig

DISA STIG audit + remediation advisory. Devlet, finans, kritik altyapi engagement'lerinde standart.

Triggers

• "STIG audit"
• "SCAP / OpenSCAP tarama"
• "GPO hardening"
• "keep-open justification"
• "CKL file analizi"
• "compliance baseline"

STIG Nedir

US Department of Defense Defense Information Systems Agency (DISA) tarafindan yayinlanan security configuration baseline. Linux, Windows, web server, network device, database, application icin spesifik kurallar.

Format:

• STIG ID (Group_ID + Rule_ID): GENERIC-NIST-800-53'e map
• Severity: CAT I (kritik), CAT II (yuksek), CAT III (orta)
• Vulnerability discussion: niye onemli
• Check Text: nasil kontrol edilir
• Fix Text: nasil duzeltilir

SCAP Tarama

# OpenSCAP (Linux audit)
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig \
  --results scan-results.xml \
  --report scan-report.html \
  --datastream-id ds-rhel8.xml \
  ssg-rhel8-ds.xml

# Windows: SCC Tool (DISA) veya OpenSCAP Windows port
# Web: scap-security-guide / OpenSCAP web UI

CKL (Checklist) Format

DISA STIG Viewer ile acilan XML format. Her STIG ID icin:

• NotAFinding — uygun
• Open — bulgu var
• Not_Applicable — kapsam disi
• Not_Reviewed — henuz bakilmadi

Common STIG Categories (Linux RHEL 8)

ID	Title	CAT
RHEL-08-010020	Crypto Policy = FIPS	I
RHEL-08-010049	Banner login warn message	III
RHEL-08-010130	SSH PermitRootLogin no	II
RHEL-08-010140	Disable USB mass storage	II
RHEL-08-010210	/tmp nosuid mount	II
RHEL-08-010370	sudo logging	II
RHEL-08-010460	password complexity (pwquality)	II
RHEL-08-010620	session timeout 15min	III
RHEL-08-020220	account lockout 3 try	II
RHEL-08-040340	firewalld enabled	II

Common STIG Categories (Windows Server 2022)

ID	Title	CAT
WN22-00-000010	Inactive accounts disable	III
WN22-AC-000010	Lockout duration	II
WN22-AC-000020	Lockout threshold	II
WN22-AU-000010	Audit Account Logon	II
WN22-SO-000020	Anonymous SID lookup	I
WN22-SO-000080	LM hash storage off	I
WN22-SO-000100	LMCompat Level 5	I

Keep-Open Justification

Bazi STIG kurallari business-spesifik nedenle uygulanmaz. Justification yazimi:

## STIG ID: RHEL-08-010130 (SSH PermitRootLogin)

### Status: Open (Mitigated)

### Justification
- **Risk**: Direct root SSH allows offline brute force, lateral movement
- **Compensating Control 1**: SSH bind only to management VLAN (192.168.99.0/24)
- **Compensating Control 2**: PubkeyAuth only (PasswordAuth off)
- **Compensating Control 3**: All sudo + root commands logged to remote syslog
- **Compensating Control 4**: 2FA via FreeIPA (TOTP)
- **Compensating Control 5**: Bastion host required (jump server with session record)
- **Business Need**: Legacy application requires root for service init
- **Remediation Roadmap**: Application refactor to sudo-only by Q4 2026
- **Approval**: Security Manager <name>, <date>
- **Review Frequency**: Every 6 months

GPO Remediation Mapping

# STIG WN22-SO-000080 (LM hash storage off)
# Manual GPO yolu:
# Computer Config -> Policies -> Windows Settings -> Security Settings
# -> Local Policies -> Security Options
# -> "Network security: Do not store LAN Manager hash value on next password change"
# Enable

# Komut ile (LGPO.exe veya ADMX):
ntfrsutl ds                           # AD baglanti var mi
# Group Policy Object icine ekle:
# HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NoLMHash = 1

STIG Audit Otomasyon

# Tum sistemde STIG check (cron / Ansible)
oscap xccdf eval --profile stig \
  --results-arf /var/log/stig-arf.xml \
  --report /var/log/stig-report.html \
  ssg-rhel8-ds.xml

# Ansible STIG playbook
ansible-playbook -i inventory stig-rhel8-playbook.yml --check

# Sonuc -> CKL'e convert
sscap-to-checklist --input stig-arf.xml --output system.ckl

Output Sablonu

## STIG Audit — <system>

### Compliance Score
- Total: 250 STIG rules
- NotAFinding: 195 (78%)
- Open: 38 (15.2%)
- Not_Applicable: 12 (4.8%)
- Not_Reviewed: 5 (2%)

### CAT I Open (Kritik — 5)
1. RHEL-08-010210 /tmp nosuid eksik (remediation: 1 satir mount opt)
2. WN22-SO-000080 LM hash storage acik (GPO update)
3. ... (3 more)

### Keep-Open Justified (Mitigated)
1. RHEL-08-010130 SSH root login (5 compensating control)
2. ...

### Remediation Plan
| Priority | Count | Effort | Timeline |
|----------|-------|--------|----------|
| CAT I | 5 | 8h | 1 hafta |
| CAT II | 28 | 32h | 1 ay |
| CAT III | 5 | 8h | 3 ay |

Out-of-Scope

• Production hardening uygulamasi (musteri sysadmin yapar)
• STIG yazma (DISA resmi)
• Non-DISA framework (CIS Benchmark, NIST 800-53 — ayri skill)