Using PowerSTIG with Hashicorp Packer

[shannonfelice]

Does anyone in the community have experience with running PoweSTIG during a VM image deployment using Packer? Particularly with the Azure plugin that requires WinRM to communicate between Packer and the build VM during the image build process. I am having to track down which rules specifically interrupt WinRM and skip them but am also finding myself having to hack PowerSTIG slightly during the build to keep the DSC resources that perform the various group policy and system refreshes from happening as to not kill the image build completely while I troubleshoot exactly all the rules for each OS and product being STIG'd which need to be skipped. If anyone has a list of V-ID's that should be skipped or some instructions\lessons learned that would be great. Also, if anyone is having any of the same issues with Packer or building Windows images and interested in having me share any of my instructions or lessons learned, please feel free to reach out.

[shannonfelice]

Not sure if anyone has viewed this but to update things here is my current progress. I stopped using WinRM for the communicator service Packer uses to talk with the build VM during provisioning and switched to SSH but only used during the image build. It all gets stripped after serving its purpose. After getting through some of the nuances with SSH and Packer communication I must say its the way to go for sure. Packer runs cleaner and faster with output thats readable but the good news is with just a couple minor tweaks there I am completing a full PowerSTIG run with a fairly heavily stacked DSC Config at that. It STIGs just about everything a Win11 Client might have to get STIG'd but it does a little too good maybe because sort of like what was happening with WinRM there is a rule applied affecting SSH that takes out its legs with something being set. Still doing some troubleshooting but if anyone already has a robust list of known rules to skip for this I would be very frateful. Thanks

[MrasmussenGit]

Hi Shannon, this is a common issue when applying STIGs. The way we usually troubleshoot is if you aren't sure which rule, skip 1/2 of the rules and then try again. If it was fixed, you know the issue is in that 1/2. The cut that 1/2 in 1/2 again.
or
Look for rules affecting SSH and skip those. If you need help on how to skip rules, see this page in the wiki
https://github.com/Microsoft/PowerStig/wiki/CustomizingRules