baseline-rb 0.1.0

data/lib/baseline/policy.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require "yaml"
+require "digest"
+require "json"
+
+module Baseline
+  # 按主机、型号、站点、角色或厂商选择批准值；缺少批准值时不回退到当前配置。
+  class Policy
+    SCOPES = Rule::CONTEXT_FIELDS
+    SELECTORS = Baseline.immutable(SCOPES.map { |scope| "by_#{scope}" } + [ "default" ])
+    Resolution = Data.define(:value, :reason, :path) do
+      # 冻结解析后的批准值、原因及策略选择路径。
+      def initialize(value:, reason:, path:)
+        super(value: Baseline.immutable(value), reason: Baseline.immutable(reason), path: Baseline.immutable(path))
+      end
+    end
+    attr_reader :rules, :sha256
+
+    # 加载 gem 内附带的默认策略。
+    def self.default = load(File.expand_path("../../policy.yml", __dir__))
+
+    # 读取并校验策略文档，禁止实例化任意 YAML 对象。
+    def self.load(path)
+      text = File.binread(path)
+      raise ArgumentError, "Baseline policy is too large" if text.bytesize > 1_048_576
+      stream = Psych.parse_stream(text)
+      raise ArgumentError, "One baseline YAML document is required" unless stream.children.one?
+      validate_yaml!(stream)
+      new(YAML.safe_load(text, permitted_classes: [], permitted_symbols: [], aliases: false))
+    rescue Psych::Exception
+      raise ArgumentError, "Invalid baseline YAML", cause: nil
+    end
+
+    # 反序列化前拒绝不安全或嵌套过深的 YAML 结构。
+    def self.validate_yaml!(node, depth = 0)
+      raise ArgumentError, "Baseline YAML nesting is too deep" if depth > 32
+      if node.is_a?(Psych::Nodes::Alias)
+        raise ArgumentError, "Baseline YAML aliases are not allowed"
+      elsif node.is_a?(Psych::Nodes::Mapping)
+        keys = node.children.each_slice(2).map(&:first)
+        unless keys.all? { |key| key.is_a?(Psych::Nodes::Scalar) } && keys.map(&:value).uniq.size == keys.size
+          raise ArgumentError, "Duplicate or complex baseline YAML keys"
+        end
+      end
+      Array(node.children).each { |child| validate_yaml!(child, depth + 1) }
+    end
+    private_class_method :validate_yaml!
+
+    # 在设备评估前校验并冻结策略定义。
+    def initialize(definition)
+      unless definition.is_a?(Hash) && (definition.keys - %w[version checks]).empty? &&
+          definition["version"].is_a?(Integer) && definition["version"] == 1 &&
+          definition["checks"].is_a?(Hash) && !definition["checks"].empty?
+        raise ArgumentError, "Invalid baseline policy"
+      end
+      @rules = definition["checks"].map { |id, options| Rule.new(id, options) }.freeze
+      rules.each { |rule| validate_selection!(rule, rule.expected) }
+      @sha256 = Digest::SHA256.hexdigest(JSON.generate(definition)).freeze
+      freeze
+    end
+
+    # 解析上下文对应的策略值，并保留选择路径。
+    def resolve(rule, context)
+      resolution = resolve_with_source(rule, context)
+      [ resolution.value, resolution.reason ]
+    end
+
+    # 保留相对于 expected 的命中范围、默认分支或未解析选择器路径。
+    def resolve_with_source(rule, context)
+      value = rule.expected
+      path = []
+      while selector?(value)
+        selected = false
+        SCOPES.each do |scope|
+          selector = "by_#{scope}"
+          mapping = value[selector]
+          next unless mapping
+          return Resolution.new(value: nil, reason: :scope_unknown, path: path + [ selector ]) unless context.key?(scope)
+          next unless mapping.key?(context[scope])
+          path.concat([ selector, context[scope] ])
+          value, selected = mapping[context[scope]], true
+          break
+        end
+        unless selected
+          path << "default" if value.key?("default")
+          value = value["default"]
+        end
+      end
+      Resolution.new(value: value, reason: value.nil? ? :policy_missing : nil, path: path)
+    end
+
+    # 展示对象身份与状态，避免泄露原始回显或凭据。
+    def inspect = "#<#{self.class} rules=#{rules.size}>"
+
+    private
+
+    # 识别依赖上下文的策略选择器，避免当作普通值处理。
+    def selector?(value) = value.is_a?(Hash) && (value.keys & SELECTORS).any?
+
+    # 校验嵌套策略选择及其最终规则值。
+    def validate_selection!(rule, value, depth = 0)
+      raise ArgumentError, "Baseline scope nesting is too deep" if depth > 8
+      return if value.nil?
+      unless selector?(value)
+        rule.validate_expected!(value)
+        return
+      end
+      raise ArgumentError, "Invalid baseline selector" unless (value.keys - SELECTORS).empty?
+      value.each do |key, selection|
+        if key == "default"
+          validate_selection!(rule, selection, depth + 1)
+        else
+          unless selection.is_a?(Hash) && !selection.empty? && selection.keys.all? { |name| name.is_a?(String) && !name.strip.empty? }
+            raise ArgumentError, "Invalid baseline scope"
+          end
+          selection.each_value { |item| validate_selection!(rule, item, depth + 1) }
+        end
+      end
+    end
+  end
+end

data/lib/baseline/quoted_document.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative "document"
+
+module Baseline
+  # 多行引号内容始终作为数据处理，即使正文看起来像全局命令。
+  class QuotedDocument < Document
+    protected
+
+    # 区分配置结构行与引号、横幅中的文本内容。
+    def classify(line)
+      was_quoted = !@quote.nil?
+      # 注释和横幅具有独立语法，其中的单引号不能开启配置值。
+      unless was_quoted
+        kind = super
+        return kind unless kind == :entry && line.text.match?(/["']/)
+      end
+      escaped = false
+      line.text.each_char do |character|
+        if escaped
+          escaped = false
+        elsif character == "\\"
+          escaped = true
+        elsif @quote
+          @quote = nil if character == @quote
+        elsif character == '"' || character == "'"
+          @quote = character
+        end
+      end
+      if !was_quoted && @quote && multiline_fact?(line.text)
+        issues << { code: :multiline_fact_value, line: line.number }
+      end
+      return :ignored if was_quoted || @quote
+
+      kind
+    end
+
+    # 由领域文档识别不能安全跨行的已建模语句。
+    def multiline_fact?(_text) = false
+
+    # 保留父级词法诊断，并报告未闭合的引号值。
+    def finish
+      super
+      issues << { code: :incomplete_quoted_value } if @quote
+    end
+  end
+end

data/lib/baseline/report.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+module Baseline
+  # 分别报告评估结果与输入覆盖率；未知项不计分，也不视为合规。
+  class Report
+    REASONS = {
+      input_incomplete: "配置不完整，需提供完整备份后重查", unsupported_platform: "尚未支持此平台的配置语法",
+      scope_mismatch: "不在策略适用范围内", scope_unknown: "缺少判断适用范围或选择批准值所需的上下文",
+      policy_missing: "未定义当前范围的批准值，请完善基线策略", fact_unavailable: "配置事实缺失或包含尚未支持的语法，请查看解析诊断",
+      fact_type_mismatch: "解析事实类型与检查要求不一致", unnecessary_service_enabled: "存在策略要求关闭的服务",
+      service_state_unknown: "配置未明确声明部分服务状态，不能推断厂商默认值", deviation: "实际配置偏离批准值",
+      unsupported_address_family: "地址格式超出当前 IPv4 检查能力", weak_password: "发现未满足强度要求的明文凭据",
+      password_strength_unobservable: "加密或散列凭据无法从备份验证原始口令强度"
+    }.freeze
+
+    Finding = Data.define(:id, :title, :severity, :status, :reason, :actual, :expected, :lines, :policy_path, :diagnostics, :details) do
+      # 冻结单条检查结果的策略路径、诊断和支持细节。
+      def initialize(policy_path: [], diagnostics: [], details: {}, **attributes)
+        super(**Baseline.immutable(attributes.merge(policy_path: policy_path, diagnostics: diagnostics, details: details)))
+      end
+
+      # 将稳定的结果原因代码转换为易读说明。
+      def explanation = reason ? Report::REASONS.fetch(reason, reason.to_s) : "满足基线要求"
+      # 返回公开的数据结构，并保留状态与诊断信息。
+      def to_h = super.merge(explanation: explanation)
+
+      # 生成紧凑的评估与策略路径元数据，不内嵌大量事实或诊断数组。
+      def summary
+        { id: id, title: title, severity: severity, status: status, reason: reason, policy_path: policy_path }
+      end
+    end
+    attr_reader :configuration, :policy_sha256, :findings, :context, :counts, :applicable
+
+    # 冻结报告证据与检查结果，便于复现评估。
+    def initialize(configuration:, policy_sha256:, findings:, context:)
+      @configuration, @policy_sha256 = configuration, policy_sha256
+      @findings = findings.dup.freeze
+      @context = Baseline.immutable(context)
+      @counts = @findings.map(&:status).tally.freeze
+      @applicable = @findings.reject { |finding| finding.status == :not_applicable }.freeze
+      freeze
+    end
+
+    # 判断所有已选事实是否都有完整证据支持。
+    def complete? = configuration.complete? && applicable.any? && counts.fetch(:pass, 0) + counts.fetch(:fail, 0) == applicable.size
+    # 仅在证据完整且检查通过时声明合规。
+    def compliant? = complete? && counts.fetch(:pass, 0) == applicable.size
+
+    # 推导汇总状态，避免将证据缺失当作成功。
+    def status
+      return :fail if counts.fetch(:fail, 0).positive?
+      return :pass if compliant?
+      :unknown
+    end
+
+    # 独立衡量已评估证据的覆盖情况，不与设备是否通过混淆。
+    def coverage
+      return 0.0 if applicable.empty?
+      (100.0 * (counts.fetch(:pass, 0) + counts.fetch(:fail, 0)) / applicable.size).round(1)
+    end
+
+    # 计算适用规则中证据完整且检查通过的占比。
+    def score
+      return 0.0 if applicable.empty?
+      (100.0 * counts.fetch(:pass, 0) / applicable.size).round(1)
+    end
+
+    # 返回公开的数据结构，并保留状态与诊断信息。
+    def to_h
+      metadata.merge(configuration: configuration.to_h, findings: findings.map(&:to_h))
+    end
+
+    # 限制摘要大小；完整事实由 to_h 提供，避免 ACL 或账号数量膨胀元数据。
+    def summary
+      metadata.merge(configuration: { platform: configuration.platform, sha256: configuration.sha256, status: configuration.status,
+        issue_counts: configuration.issues.map { |issue| issue[:code] }.tally },
+        findings: findings.map(&:summary))
+    end
+
+    # 以有长度限制且经过转义的文本展示运维证据；完整结构仍保留在 JSON 中。
+    def to_text
+      output = [ "baseline: #{status}, coverage=#{coverage}%, score=#{score}, #{counts.map { |name, count| "#{name}=#{count}" }.join(', ')}",
+        "配置: #{display(configuration.platform)}, #{configuration.status}; SHA256: #{configuration.sha256}",
+        "策略 SHA256: #{policy_sha256}; 上下文: #{display(context)}" ]
+      findings.each do |finding|
+        output << "  [#{finding.status}] #{finding.id} | #{finding.title} | #{finding.severity}"
+        output << "    #{finding.explanation}#{finding.reason ? " (#{finding.reason})" : ''}"
+        output << "    策略分支: #{display(finding.policy_path)}" if finding.policy_path.any?
+        if %i[pass fail].include?(finding.status)
+          output << "    预期: #{display(finding.expected)}; 实际: #{display(finding.actual)}"
+        end
+        output << "    差异: #{display(finding.details)}" if finding.details.any?
+        if finding.lines.any?
+          output << "    行号: #{finding.lines.first(20).join(', ')}#{finding.lines.size > 20 ? "… (共 #{finding.lines.size} 行，详见 JSON 报告)" : ''}"
+        end
+        finding.diagnostics.first(10).each { |issue| output << "    解析诊断: #{display(issue)}" }
+        output << "    另有 #{finding.diagnostics.size - 10} 条诊断，详见 JSON 报告" if finding.diagnostics.size > 10
+      end
+      output.join("\n")
+    end
+
+    # 展示对象身份与状态，避免泄露原始回显或凭据。
+    def inspect = "#<#{self.class} status=#{status} coverage=#{coverage} findings=#{findings.size}>"
+
+    private
+
+    # 提供来源与策略身份，便于复现并追溯报告。
+    def metadata
+      { status: status, complete: complete?, compliant: compliant?, score: score, coverage: coverage, counts: counts,
+        policy_sha256: policy_sha256, context: context }
+    end
+
+    # 格式化报告值，不改变序列化后的评估契约。
+    def display(value)
+      text = JSON.generate(value)
+      text.length > 500 ? "#{text[0, 500]}… (详见 JSON 报告)" : text
+    end
+  end
+end

data/lib/baseline/rule.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+module Baseline
+  # 规则声明事实、比较方式和批准值类型；厂商语法仅由解析器负责。
+  class Rule
+    # 校验与规则目录共用具名字段，避免从名称或元组位置猜测类型。
+    Definition = Data.define(:title, :fact, :operator, :value_type, :allowed_values) do
+      # 冻结规则目录条目的事实、比较方式及批准值类型。
+      def initialize(title:, fact:, operator:, value_type:, allowed_values: nil)
+        super(title: Baseline.immutable(title), fact: Baseline.immutable(fact), operator: Baseline.immutable(operator),
+          value_type: Baseline.immutable(value_type), allowed_values: Baseline.immutable(allowed_values))
+      end
+    end
+
+    DEFINITIONS = {
+      "snmp.enabled" => Definition.new(title: "SNMP 配置", fact: "snmp.enabled", operator: :equals, value_type: :boolean),
+      "snmp.versions" => Definition.new(title: "SNMP 允许版本", fact: "snmp.versions", operator: :subset, value_type: :enum_set, allowed_values: %w[v1 v2c v3]),
+      "snmp.read_only" => Definition.new(title: "SNMP 禁止写权限", fact: "snmp.write_enabled", operator: :equals, value_type: :boolean),
+      "snmp.auth_priv" => Definition.new(title: "SNMPv3 认证与加密", fact: "snmp.v3_auth_priv", operator: :equals, value_type: :boolean),
+      "snmp.acl_bound" => Definition.new(title: "SNMP 来源 ACL 引用", fact: "snmp.acl.bound", operator: :equals, value_type: :boolean),
+      "snmp.acl_restricted" => Definition.new(title: "SNMP 来源 ACL 限制", fact: "snmp.acl.restricted", operator: :equals, value_type: :boolean),
+      "snmp.sources" => Definition.new(title: "SNMP 批准来源", fact: "snmp.acl.sources", operator: :networks_within, value_type: :network_set),
+      "ntp.minimum_servers" => Definition.new(title: "NTP 服务器数量", fact: "ntp.servers", operator: :count_at_least, value_type: :positive_integer),
+      "ntp.servers" => Definition.new(title: "NTP 批准服务器", fact: "ntp.servers", operator: :set_equals, value_type: :string_set),
+      "ntp.authentication" => Definition.new(title: "NTP 认证开关", fact: "ntp.authentication", operator: :equals, value_type: :boolean),
+      "ntp.source" => Definition.new(title: "NTP 源接口", fact: "ntp.source", operator: :equals, value_type: :string),
+      "syslog.minimum_servers" => Definition.new(title: "Syslog 服务器数量", fact: "syslog.servers", operator: :count_at_least, value_type: :positive_integer),
+      "syslog.servers" => Definition.new(title: "Syslog 批准服务器", fact: "syslog.servers", operator: :set_equals, value_type: :string_set),
+      "syslog.source" => Definition.new(title: "Syslog 源接口", fact: "syslog.source", operator: :equals, value_type: :string),
+      "ssh.enabled" => Definition.new(title: "SSH 配置", fact: "ssh.enabled", operator: :equals, value_type: :boolean),
+      "ssh.versions" => Definition.new(title: "SSH 允许版本", fact: "ssh.versions", operator: :subset, value_type: :enum_set, allowed_values: %w[1 2]),
+      "ssh.vty_ssh_only" => Definition.new(title: "VTY 只允许 SSH", fact: "ssh.vty_ssh_only", operator: :equals, value_type: :boolean),
+      "ssh.vty_aaa" => Definition.new(title: "VTY 使用账户认证", fact: "ssh.vty_aaa", operator: :equals, value_type: :boolean),
+      "management.acl_bound" => Definition.new(title: "管理来源 ACL 引用", fact: "management.acl.bound", operator: :equals, value_type: :boolean),
+      "management.acl_restricted" => Definition.new(title: "管理来源 ACL 限制", fact: "management.acl.restricted", operator: :equals, value_type: :boolean),
+      "management.sources" => Definition.new(title: "管理批准来源", fact: "management.acl.sources", operator: :networks_within, value_type: :network_set),
+      "services.disabled" => Definition.new(title: "关闭非必要服务", fact: "services", operator: :all_disabled, value_type: :enum_set, allowed_values: %w[telnet http https ftp tftp finger]),
+      "credentials.storage" => Definition.new(title: "凭据存储方式", fact: "credentials.storage_safe", operator: :equals, value_type: :boolean),
+      "credentials.strength" => Definition.new(title: "可观察口令强度", fact: "credentials.records", operator: :password_strength, value_type: :password_strength),
+      "tacacs.minimum_servers" => Definition.new(title: "TACACS 服务器数量", fact: "tacacs.servers", operator: :count_at_least, value_type: :positive_integer),
+      "tacacs.servers" => Definition.new(title: "TACACS 批准服务器", fact: "tacacs.servers", operator: :set_equals, value_type: :string_set),
+      "tacacs.login" => Definition.new(title: "管理认证引用 TACACS", fact: "tacacs.login", operator: :equals, value_type: :boolean),
+      "tacacs.authorization" => Definition.new(title: "管理授权引用 TACACS", fact: "tacacs.authorization", operator: :equals, value_type: :boolean),
+      "tacacs.accounting" => Definition.new(title: "管理审计引用 TACACS", fact: "tacacs.accounting", operator: :equals, value_type: :boolean),
+      "tacacs.keys" => Definition.new(title: "TACACS 密钥配置", fact: "tacacs.keys_present", operator: :equals, value_type: :boolean)
+    }.freeze
+    CONTEXT_FIELDS = %w[host model site role vendor].freeze
+    # 适用条件采用标量相等或备选值匹配；集合事实不隐含成员比较语义。
+    APPLICABILITY_FACTS = DEFINITIONS.values.each_with_object({}) do |definition, facts|
+      facts[definition.fact] = definition.value_type if %i[boolean string].include?(definition.value_type)
+    end.merge("hostname" => :string, "snmp.community_present" => :boolean, "credentials.present" => :boolean).freeze
+
+    attr_reader :id, :definition, :title, :fact, :operator, :value_type, :allowed_values, :expected, :severity, :applies_to
+
+    # 校验规则定义，并冻结比较契约。
+    def initialize(id, options)
+      @definition = DEFINITIONS.fetch(id) { raise ArgumentError, "Unknown baseline rule" }
+      unless options.is_a?(Hash) && (options.keys - %w[enabled expected severity applies_to]).empty? &&
+          [ true, false ].include?(options.fetch("enabled", true)) &&
+          %w[low medium high critical].include?(options.fetch("severity", "medium"))
+        raise ArgumentError, "Invalid baseline rule options"
+      end
+      @id = Baseline.immutable(id)
+      @title, @fact, @operator = definition.title, definition.fact, definition.operator
+      @value_type, @allowed_values = definition.value_type, definition.allowed_values
+      @expected = Baseline.immutable(options["expected"])
+      @enabled, @severity = options.fetch("enabled", true), Baseline.immutable(options.fetch("severity", "medium"))
+      @applies_to = Baseline.immutable(options.fetch("applies_to", {}))
+      validate_applicability!
+      freeze
+    end
+
+    # 判断策略规则是否已启用评估。
+    def enabled? = @enabled
+
+    # 将 nil 保留为批准值缺失；具体值则按规则目录声明的领域类型校验。
+    def validate_expected!(value)
+      valid = case value_type
+      when :boolean, :string then scalar?(value, value_type)
+      when :positive_integer then value.is_a?(Integer) && value.positive?
+      when :password_strength
+        value.is_a?(Hash) && value.size == 2 && (value.keys - %w[min_classes min_length]).empty? &&
+          value["min_length"].is_a?(Integer) && value["min_length"].between?(1, 1024) &&
+          value["min_classes"].is_a?(Integer) && value["min_classes"].between?(1, 4)
+      when :enum_set then string_set?(value) && !value.empty? && (value - allowed_values).empty?
+      when :string_set, :network_set then string_set?(value)
+      end
+      raise ArgumentError, "Invalid baseline expected value for #{id}" unless valid
+      value.each { |network| Acl.range(network) } if value_type == :network_set
+    end
+
+    # 展示对象身份与状态，避免泄露原始回显或凭据。
+    def inspect = "#<#{self.class} id=#{id} enabled=#{enabled?}>"
+
+    private
+
+    # 拒绝拼错的事实名和空条件，避免将应失败的检查静默排除为不适用。
+    def validate_applicability!
+      unless applies_to.is_a?(Hash) && (applies_to.keys - CONTEXT_FIELDS - [ "facts" ]).empty?
+        raise ArgumentError, "Invalid baseline applicability for #{id}"
+      end
+      applies_to.each do |key, value|
+        if key == "facts"
+          unless value.is_a?(Hash) && !value.empty?
+            raise ArgumentError, "Invalid baseline applicability facts for #{id}"
+          end
+          value.each do |name, criterion|
+            type = APPLICABILITY_FACTS.fetch(name) { raise ArgumentError, "Unknown baseline applicability fact for #{id}" }
+            validate_criterion!(criterion, type)
+          end
+        else
+          validate_criterion!(value, :string)
+        end
+      end
+    end
+
+    # 按声明的值类型校验策略比较操作数。
+    def validate_criterion!(criterion, type)
+      values = criterion.is_a?(Array) ? criterion : [ criterion ]
+      unless !values.empty? && values.all? { |value| scalar?(value, type) }
+        raise ArgumentError, "Invalid baseline applicability value for #{id}"
+      end
+    end
+
+    # 按声明类型校验标量策略值。
+    def scalar?(value, type)
+      case type
+      when :string then value.is_a?(String) && !value.strip.empty?
+      when :boolean then [ true, false ].include?(value)
+      end
+    end
+
+    # 要求策略值为内容有效且不重复的文本数组。
+    def string_set?(value)
+      value.is_a?(Array) && value.all? { |item| scalar?(item, :string) } && value.uniq == value
+    end
+  end
+end

data/lib/baseline/version.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module Baseline
+  # 公开包版本，供 RubyGems 元数据和运行时调用方共用。
+  VERSION = "0.1.0"
+end

data/lib/baseline.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require_relative "baseline/version"
+
+require "ctx_parser/immutable"
+
+module Baseline
+  # 复制并冻结可序列化的基线事实，避免调用方修改策略或报告状态。
+  def self.immutable(value)
+    CtxParser::Immutable.copy(value)
+  rescue ArgumentError
+    raise ArgumentError, "Baseline values must be plain data"
+  end
+end
+
+require_relative "baseline/configuration"
+require_relative "baseline/document"
+require_relative "baseline/acl"
+require_relative "baseline/credential"
+require_relative "baseline/facts"
+require_relative "baseline/parsers/base"
+require_relative "baseline/parsers/comware"
+require_relative "baseline/parsers/h3c"
+require_relative "baseline/parsers/huawei"
+require_relative "baseline/parsers/cisco"
+require_relative "baseline/parsers/cisco_ios"
+require_relative "baseline/parsers/cisco_nxos"
+require_relative "baseline/parsers/hillstone"
+require_relative "baseline/parsers/palo_alto"
+require_relative "baseline/rule"
+require_relative "baseline/policy"
+require_relative "baseline/report"
+require_relative "baseline/evaluator"
+require_relative "baseline/audit"

data/policy.yml

@@ -0,0 +1,47 @@
+# 参考基线：组织批准的服务器、网段和源接口缺失时保持未知。
+# expected 可使用 by_host > by_model > by_site > by_role > by_vendor > default。
+# 此策略仅评估证据，不生成或执行设备配置。
+version: 1
+checks:
+  snmp.enabled: {expected: true}
+  snmp.versions: {expected: [v3], severity: high}
+  snmp.read_only:
+    expected: false
+    severity: high
+    applies_to: {facts: {snmp.enabled: true}}
+  snmp.auth_priv:
+    expected: true
+    severity: high
+    applies_to: {facts: {snmp.enabled: true}}
+  snmp.acl_bound: {expected: true, severity: high}
+  snmp.acl_restricted: {expected: true, severity: high}
+  snmp.sources: {expected: null, severity: high}
+  ntp.minimum_servers: {expected: 2}
+  ntp.servers: {expected: null}
+  ntp.authentication: {expected: true}
+  ntp.source: {expected: null}
+  syslog.minimum_servers: {expected: 2}
+  syslog.servers: {expected: null}
+  syslog.source: {expected: null}
+  ssh.enabled: {expected: true, severity: high}
+  ssh.versions: {expected: ['2'], severity: high}
+  ssh.vty_ssh_only: {expected: true, severity: high}
+  ssh.vty_aaa: {expected: true, severity: high}
+  management.acl_bound: {expected: true, severity: high}
+  management.acl_restricted: {expected: true, severity: high}
+  management.sources: {expected: null, severity: high}
+  services.disabled: {expected: [telnet, http, ftp, tftp], severity: high}
+  credentials.storage:
+    expected: true
+    severity: high
+    applies_to: {facts: {credentials.present: true}}
+  credentials.strength:
+    expected: {min_length: 12, min_classes: 3}
+    severity: high
+    applies_to: {facts: {credentials.present: true}}
+  tacacs.minimum_servers: {expected: 2}
+  tacacs.servers: {expected: null}
+  tacacs.login: {expected: true, severity: high}
+  tacacs.authorization: {expected: true}
+  tacacs.accounting: {expected: true}
+  tacacs.keys: {expected: true, severity: high}