| [Unit] |
| Description=Check for CIS Compliance up to level-2 by using CIS Scanner |
| After=chronyd.service |
| Requires=chronyd.service |
| |
| [Service] |
| Type=oneshot |
| RemainAfterExit=True |
| ExecStart=/usr/share/google/security/cis-compliance/scripts/configure.sh |
| # fluentd logging agent was deprecated so checking for |
| # stackdriver-correct-container is no longer required. |
| # Opt out of the benchmark until the upstream catches up. |
| ExecStart=/usr/bin/cis_scanner \ |
| --config=/usr/share/google/security/cis-compliance/cis_config.textproto \ |
| --result=/var/lib/google/cis_scanner_scan_result.textproto \ |
| --show-compliant-benchmarks=true \ |
| --benchmark-opt-out-ids=stackdriver-correct-container,logging-service-running \ |
| --max-cis-profile-level=2 |
| |
| [Install] |
| WantedBy=multi-user.target |
