#########################################################################
#
#   win_emergency.cf - Emergency Policy To Close Potential Security Holes
#
#   NOTE: The class "emergency" may be set automatically by Cfengine
#         based on some criteria, or it may be explicitly set by a remote
#         execution of cf-agent through cf-runagent (if this is allowed
#         by the server control policy).
#
#########################################################################
body common control
{
  bundlesequence => { "win_emergency" };
  inputs => { "$(sys.libdir)/stdlib.cf" };
}

bundle agent win_emergency
{
  vars:
    "disable_services"
      slist => {
        "RemoteRegistry", # Windows Remote Management
      };

    "secure_files" slist => { "C:\Secret", "$(sys.workdir)\secret.txt" };
    "close_ports" slist => { "6510", "9300" };

  commands:
    emergency::
      "\"$(sys.winsysdir)\netsh.exe\""
        args => "firewall add portopening ALL $(close_ports) \"Port $(close_ports)\" DISABLE",
        comment => "Close firewall ports on emergency";

  databases:
    emergency::
      "HKEY_LOCAL_MACHINE\SOFTWARE\Northern.tech AS\Cfengine"
        database_operation => "create",
        database_rows => { "emergency,REG_SZ,This is an emergency!" },
        database_type => "ms_registry",
        comment => "Create emergency policy registry settings";

  files:
    emergency::
      "$(secure_files)"
        acl => strict,
        comment => "Secure important file access on emergency";

  services:
    emergency::
      "$(disable_services)"
        service_policy => "disable",
        comment => "Disable security-relevant services on emergency";
}
