cloud-mu 1.9.0.pre.beta

data/test/mu-master-test/controls/all_in_one.rb

@@ -0,0 +1,557 @@
+require 'etc'
+require 'open-uri'
+require 'socket'
+require 'json'
+
+
+## read on master
+node_meta = JSON.parse(File.read("/tmp/MU-MASTER-INSTALL-TEST.json")) if File.exists?("/tmp/MU-MASTER-INSTALL-TEST.json")
+chef_server_url = node_meta[0]['pub_ip']
+$MU_CFG = '/opt/mu/var'
+
+
+control 'init' do
+  title 'mu-master init recipe tests'
+  node = json('/tmp/chef_node.json').params  
+  NODE_PUB_IP=node_meta[0]['pub_ip']
+  CHEF_SERVER_VERSION="12.17.15-1"
+  CHEF_CLIENT_VERSION="14.0.190"
+  KNIFE_WINDOWS="1.9.0"
+  MU_BASE="/opt/mu"
+  f = "/etc/ssh/sshd_config"
+  if File.read(f).match(/^AllowUsers\s+([^\s]+)(?:\s|$)/)
+    SSH_USER = Regexp.last_match[1].chomp
+  else
+    SSH_USER="root"
+  end
+  RUNNING_STANDALONE=node['default']['application_attributes'].nil?
+  describe service('iptables') do
+    it { should be_running }
+  end
+
+  describe directory('/var/run/postgresql') do
+    it { should exist }
+    it { should be_directory }
+    its('mode'){ should cmp '0755' }
+  end
+
+  describe file('/var/run/postgresql/.s.PGSQL.5432') do
+    it { should exist }
+    it { should be_linked_to '/tmp/.s.PGSQL.5432' }
+  end
+  
+  describe file('/etc/hosts.muinstaller') do
+    it { should exist }
+    it { should be_file }
+  end
+
+  if RUNNING_STANDALONE
+    describe file('/etc/hosts') do
+      it { should exist }
+      its('content') { should match /127.0.0.1/ }
+      its('content') { should match /localhost6.localdomain6 localhost6/}
+    end
+  end
+  
+  basepackages = []
+  removepackages = []
+  rpms = {}
+  dpkgs = {}  
+
+
+  if os[:family] == "redhat"
+    basepackages = ["git", "curl", "diffutils", "patch", "gcc", "gcc-c++", "make", "postgresql-devel", "libyaml"]
+    rpms = {
+        "epel-release" => "http://dl.fedoraproject.org/pub/epel/epel-release-latest-#{os[:release].to_i}.noarch.rpm",
+            "chef-server-core" => "https://packages.chef.io/files/stable/chef-server/#{CHEF_SERVER_VERSION.sub(/\-\d+$/, "")}/el/#{os[:release].to_i}/chef-server-core-#{CHEF_SERVER_VERSION}.el#{os[:release].to_i}.x86_64.rpm"
+    }
+
+    if os[:release].to_i < 6 or os[:release].to_i >= 8
+      raise "Mu Masters on RHEL-family hosts must be equivalent to RHEL6 or RHEL7"
+    elsif os[:release].to_i < 7
+      basepackages.concat(["mysql-devel"])
+      rpms["ruby23"] = "https://s3.amazonaws.com/cloudamatic/ruby23-2.3.1-1.el6.x86_64.rpm"
+      removepackages = ["nagios"]
+    
+    elsif os[:release].to_i < 8
+      basepackages.concat(["libX11", "tcl", "tk", "mariadb-devel"])
+      rpms["ruby23"] = "https://s3.amazonaws.com/cloudamatic/ruby23-2.3.1-1.el7.centos.x86_64.rpm"
+      removepackages = ["nagios", "firewalld"]
+    end
+  else
+    raise "Mu Masters are currently only supported on RHEL-family hosts."
+  end
+
+  basepackages.each do |pack|
+    describe package(pack) do
+      it { should be_installed }
+    end
+  end 
+
+  describe directory(MU_BASE) do
+    it { should exist }
+    it { should be_directory }
+    its('mode') { should cmp '0755'}
+  end
+
+  ["#{MU_BASE}/lib","#{MU_BASE}/lib/cookbooks", "#{MU_BASE}/lib/.git/hooks"].each do |dir|
+    describe directory(dir) do
+      it { should exist }
+      it { should be_directory }
+    end
+  end
+  
+  ["post-merge", "post-checkout", "post-rewrite", "pre-commit"].each { |hook| 
+    describe file("#{MU_BASE}/lib/.git/hooks/#{hook}") do
+      it { should exist }
+      it { should be_file }
+      its('mode'){ should cmp '0755' }
+    end
+  }
+
+
+  ["#{MU_BASE}/var", "#{MU_BASE}/deprecated-bash-library.sh"].each do |a|
+    describe directory(a) do
+      it { should exist }
+      its('mode'){should cmp '0755' }
+    end
+  end
+
+  {"#{MU_BASE}/var/mu-chef-client-version"=> CHEF_CLIENT_VERSION, "#{MU_BASE}/var/mu-chef-server-version"=>CHEF_SERVER_VERSION}.each do |f,c|
+    describe file(f) do
+      its('content') {should match /#{c}/}
+      its('mode'){ should cmp '0644'}
+    end
+  end
+
+  describe directory('/opt/opscode.upgrading.backup') do
+    it { should_not exist }
+  end
+
+  if RUNNING_STANDALONE
+    rpms.each_pair do |pkg,src|
+      describe command("rpm -q #{pkg}") do
+        its('exit_status'){should eq 0 }
+      end
+    end
+  end
+
+  describe package('jq') do
+    it { should be_installed }
+  end
+
+  removepackages.each do |rm|
+    describe package(rm) do
+      it { should_not be_installed }
+    end
+  end
+
+  describe directory('/opt/rubies/ruby-2.1.6') do
+    it { should_not exist }
+  end
+
+  describe file('/etc/opscode/chef-server.rb') do
+    it { should exist }
+    it { should be_file }
+    its('content'){should match /api_fqdn server_name/ } 
+  end
+
+  describe parse_config_file('/etc/opscode/chef-server.rb') do
+    params = {
+     'server_name' => "'#{chef_server_url}'","nginx['server_name']" => "server_name",
+     "nginx['enable_non_ssl']" => "false","nginx['non_ssl_port']"=>"81",
+     "nginx['ssl_port']"=>"7443","nginx['ssl_protocols']"=>"'TLSv1.2'","bookshelf['external_url']"=>"'https://'+server_name+':7443'","bookshelf['vip_port']"=>"7443"
+    }
+    if ::File.size?("/etc/opscode/chef-server.rb") 
+      params.each do |var,val|
+        its(var){should eq val}
+      end
+    end
+  end
+
+  ["bin", "etc", "lib", "var/users/mu", "var/deployments", "var/orgs/mu"].each { |mudir|
+    describe directory("#{MU_BASE}/#{mudir}") do
+      it { should exist }
+      its('mode') { should cmp mudir.match(/^var\//) ? '0700' : '0755'}
+      its('owner') { should eq 'root'}
+    end
+  }
+  
+  {"#{MU_BASE}/var/users/mu/email"=>"root@example.com","#{MU_BASE}/var/users/mu/realname"=>
+  "Mu Administrator"}.each do |file,content|
+    describe file(file) do
+      it { should exist }
+      its('content') { should match /#{content}/}
+    end
+  end
+
+  ["mu-aws-setup", "mu-cleanup", "mu-configure", "mu-deploy", "mu-firewall-allow-clients", "mu-gen-docs", "mu-load-config.rb", "mu-node-manage", "mu-tunnel-nagios", "mu-upload-chef-artifacts", "mu-user-manage", "mu-ssh"].each { |exe|
+    describe file("#{MU_BASE}/bin/#{exe}") do
+      it { should exist }
+      it { should be_linked_to "#{MU_BASE}/lib/bin/#{exe}" }
+      its('mode'){should cmp '0755'}
+    end
+  }
+
+  describe directory("/root/.chef") do
+    it { should exist }
+  end
+ 
+  ["/opt/opscode/bin/chef-server-ctl org-list | grep '^mu$'", "/opt/opscode/bin/chef-server-ctl user-list | grep '^mu$'"].each do |cmd|
+    describe command(cmd) do
+      its('exit_status'){ should eq 0 }
+      its('stdout'){ should eq "mu\n"}
+    end
+  end
+
+  describe file("/root/.chef/knife.rb") do
+    chef_server_url = node_meta[0]['pub_ip']
+    it { should exist }
+    its('content'){should match /node_name\s*'mu'/}
+    its('content'){should match /validation_client_name\s*'mu-validator'/}
+    its('content'){should match /validation_key\s*'#{MU_BASE}\/var\/orgs\/mu\/mu.org.key'/}
+    its('content'){should match /client_key\s*'#{MU_BASE}\/var\/users\/mu\/mu.user.key'/}
+    its('content'){should match /chef_server_url\s*'https:\/\/#{chef_server_url}:7443\/organizations\/mu'/}
+    its('content'){should match /chef_server_root\s*'https:\/\/#{chef_server_url}:7443\/organizations\/mu'/}
+    its('content'){should match /syntax_check_cache_path\s*'\/root\/.chef\/syntax_check_cache'/}
+    its('content'){should match /cookbook_path \[ '\/root\/.chef\/cookbooks', '\/root\/.chef\/site_cookbooks' \]/}
+    its('content'){should match /knife\[:vault_mode\] = 'client'/}
+    its('content'){should match /knife\[:vault_admins\] = \['mu'\]/}
+  end
+
+=begin
+  ruby code is executed on host machine not on target
+  
+  SSH_DIR = "#{Etc.getpwnam(SSH_USER).dir}/.ssh"
+  ROOT_SSH_DIR = "#{Etc.getpwuid(0).dir}/.ssh"
+
+  describe command("cat #{SSH_DIR}/authorized_keys | grep $(cat #{ROOT_SSH_DIR}/id_rsa.pub)") do
+      its('exit_status'){should eq 0 }
+  end
+=end
+
+  %w(/etc/chef/client.pem /etc/chef/validation.pem).each do |fi| 
+    describe file(fi) do
+      it { should_not exist }
+    end
+  end
+  
+  describe file("#{MU_BASE}/etc/mu.rc") do
+    it { should exist }
+    its('content'){should match /export MU_INSTALLDIR="#{MU_BASE}"/}
+    its('content'){should match /export MU_DATADIR="#{MU_BASE}\/var/}
+    its('content'){should match /export PATH="#{MU_BASE}\/bin:\/usr\/local\/ruby-current\/bin:\${PATH}:\/opt\/opscode\/embedded\/bin"/}
+    its('mode'){should cmp '0644' }
+  end 
+  
+  describe command("chef-server-ctl status") do
+    its('exit_status'){should eq 0 }
+    services = ["run: nginx", "run: bookshelf", "run: oc_bifrost", "run: oc_id:","run: opscode-erchef",
+    "run: opscode-expander","run: opscode-solr4","run: postgresql","run: rabbitmq","run: redis_lb"]
+    services.each do |ser|
+      its('stdout'){should match /#{ser}/}
+    end
+  end
+
+end ## end init control
+
+
+control "basepackages" do
+  title "mu-master basepackages recipe test"
+  node = json('/tmp/chef_node.json').params
+
+  basepackages = []
+  removepackages = []
+  rpms = {}
+  dpkgs = {}
+
+  if os[:family] == 'redhat'
+    basepackages = ["vim-enhanced", "zip", "unzip", "java-1.8.0-openjdk", "libxml2-devel", "libxslt-devel", "cryptsetup-luks", "python-pip", "lsof", "mlocate", "strace", "nmap", "openssl-devel", "readline-devel", "python-devel", "diffutils", "patch", "bind-utils", "httpd-tools", "mailx", "openssl", "libyaml", "graphviz", "ImageMagick-devel", "graphviz-devel", "jq", "vim"]
+
+    if os[:release].to_i < 6 or os[:release].to_i >= 8
+      raise "Mu Masters on RHEL-family hosts must be equivalent to RHEL6 or RHEL7"
+    
+    elsif os[:release].to_i < 7
+      basepackages.concat(["java-1.5.0-gcj", "mysql-server", "autoconf"])
+      basepackages << "gecode-devel" if node[:platform] == "amazon"
+    
+    elsif os[:release].to_i < 8
+      basepackages.concat(["gecode-devel", "mariadb", "qt", "qt-x11", "iptables-services"])
+    end
+  else
+    raise "Mu Masters are currently only supported on RHEL-family hosts."
+  end
+
+
+  basepackages.each do |pack|
+    describe package(pack) do
+      it { should be_installed }
+    end
+  end
+
+  rpms.each_pair { |pkg, src|
+    describe command("rpm -q #{pkg}") do
+      its('exit_status'){ should eq 0 }
+    end
+  }
+end
+
+
+
+
+control 'firewall-holes' do
+  title 'mu-master firewall-holes recipe test'
+
+
+  [2260, 7443, 8443, 9443, 10514, 443, 80, 25].each do |port|
+    describe command("netstat -ant | grep #{port}") do
+      its('exit_status'){should eq 0 }
+    end
+  end
+
+end
+
+
+control 'ssl-certs' do
+  title 'mu-master ssl-certs recipe test'
+    
+  service_certs = ["rsyslog", "mommacat", "ldap", "consul", "vault"]
+  
+  describe directory("#{$MU_CFG}/ssl") do
+    it { should exist }
+  end
+
+  describe file("#{$MU_CFG}/ssl/Mu_CA.key") do
+    it { should exist }
+    its('mode') { should cmp '0400'}
+  end
+
+  describe file("#{$MU_CFG}/ssl/openssl.cnf") do
+    it { should exist }
+    it { should be_file }
+    its('content'){should match /dir\s*=\s*#{$MU_CFG}\/ssl/ }
+    its('content'){should match /certs\s*=\s*\$dir/}
+    its('content'){should match /certificate\s*=\s*\$dir\/Mu_CA.pem/}
+    its('content'){should match /private_key\s*= \$dir\/Mu_CA.key/}
+  end
+
+  service_certs.each do |cert|
+    
+    describe file("#{$MU_CFG}/ssl/#{cert}.crt") do
+      it { should exist }
+      its('mode') { should cmp '0444' }
+    end
+    
+    describe file("#{$MU_CFG}/ssl/#{cert}.key") do
+      it { should exist }
+      its('mode'){should cmp '0400' }
+    end
+
+    describe file("#{$MU_CFG}/ssl/#{cert}.p12") do
+      it { should exist }
+      its('mode') { should cmp '0444' }
+    end
+
+    describe file("#{$MU_CFG}/ssl/#{cert}.csr") do
+      it { should_not exist }
+    end
+    
+  end
+
+ describe file("#{$MU_CFG}/ssl/CA-command.txt") do
+  it { should exist }
+  its('content') { should match /openssl req -subj/ }
+  its('content') { should match /-x509 -new -nodes -key Mu_CA.key -days 1024 -out Mu_CA.pem -sha512 -extensions v3_ca -config/}
+ end
+  
+  describe file("#{$MU_CFG}/ssl/Mu_CA.pem") do
+    it { should exist }
+    its('mode') { should cmp '0444' }
+  end
+  
+  describe file("/etc/pki/ca-trust/source/anchors/Mu_CA.pem") do
+    it { should exist }
+  end
+
+  describe file("/opt/mu/lib/cookbooks/mu-tools/files/default/Mu_CA.pem") do
+    it { should exist }
+  end
+
+end
+
+
+control 'vault' do
+  title 'mu-master ssl-certs recipe test'
+  node = json('/tmp/chef_node.json').params
+  
+
+  ["consul", "vault"].each { |cert|
+    describe directory("/opt/#{cert}") do
+      it { should exist }
+      its('mode') { should cmp '0755' }
+    end
+
+    describe file("#{$MU_CFG}/ssl/#{cert}.key") do
+      its('owner') { should eq cert }
+    end
+
+    describe file("#{$MU_CFG}/ssl/#{cert}.key") do
+      its('owner') { should eq cert }
+    end
+
+    describe service(cert) do
+      it { should be_enabled }
+      it { should be_running }
+    end
+  
+  }
+
+  describe directory("/etc/consul/ssl") do
+    it { should exist }
+    its('owner'){should eq 'consul'}
+    its('group'){should eq 'consul'}
+    its('mode'){should cmp '0755'}
+  end
+
+  %w(/etc/vault /etc/vault/ssl /etc/consul/ssl/CA).each do |dir|
+    describe directory(dir) do
+      it { should exist }
+      its('owner'){should eq 'root'}
+      its('mode'){should cmp '0755'}
+    end
+  end
+
+  describe file("/etc/consul/ssl/CA/ca.crt") do
+    it { should exist }
+    its('mode'){should cmp '0644'}
+  end
+end
+
+
+control 'default' do
+  title 'mu-master default recipe tests'
+ 
+  node = json('/tmp/chef_node.json').params
+  
+  describe sys_info do
+    its('hostname') { should eq 'mu-master' }
+  end
+  
+  describe file('/root/.vimrc') do
+    it { should exist }
+  end
+
+  describe file('/etc/profile.d/usr_local_bin.sh') do
+    it { should exist }
+    its('content') { should match /export PATH="\${PATH}:\/usr\/local\/bin"/}
+    its('mode'){should cmp '0644'}
+  end
+
+  describe file('/var/www/html/cloudamatic.png') do
+    it { should exist }
+    its('mode'){should cmp '0644'}
+  end
+  
+  
+  describe package('nagios') do
+    it { should_not be_installed }
+  end
+
+  only_if do
+    !node['default']['update_nagios_only']
+    
+    describe package('nagios-plugins-all') do
+      it { should be_installed }
+    end
+  
+    %w(/home/nagios /home/nagios/.ssh).each do |dir|
+      describe directory(dir) do
+        it { should exist }
+        its('owner') { should eq 'nagios'}
+        its('mode') { should cmp '0711' }
+      end 
+    end
+    
+    describe file("/home/nagios/.ssh/config") do
+      it { should exist }
+      its('mode') { should cmp '0600' }
+      its('owner'){ should cmp 'nagios' }
+    end
+
+    describe file('/etc/dhcp/dhclient-eth0.conf') do
+      it { should exist }
+      ins_id = node_meta[0]['ins_id']
+      its('content') { should match /interface\s*"eth0"\s*{/ }
+      its('content') { should match /#\s*ec2.internal,\s*server.#{ins_id}.platform-mu,\s*platform-mu/ }
+      its('content') { should match /supersede\s*domain-search\s*"ec2.internal",\s*"server.#{ins_id}.platform-mu",\s*"platform-mu"/ }
+      its('mode'){should cmp '0644' }
+    end
+
+    describe command("/usr/sbin/getsebool httpd_can_network_connect | grep -cim1 ^.*on$") do
+      its('exit_status'){should eq 0 }
+    end
+    
+    %w(mu_docs https_proxy).each do |conf|
+      describe file("/etc/httpd/sites-enabled/#{conf}.conf") do
+        it { should exist }
+      end
+    end
+
+    describe file('/usr/lib64/nagios/cgi-bin') do
+      it { should exist }
+      it { should be_linked_to "/usr/lib/cgi-bin"}
+    end
+
+    describe directory("/var/www/html/docs") do
+      it { should exist }
+      its('owner'){ should eq 'apache' }
+      its('owner'){ should eq 'apache' }
+    end 
+
+    describe file('/var/www/html/index.html') do
+      it { should exist }
+      its('owner'){ should eq 'apache' }
+      its('owner'){ should eq 'apache' }
+      its('content') { should match /<a href='http:\/\/#{chef_server_url}\/docs\/frames.html'>Mu API documentation<\/a>/ }
+    end
+    
+    describe directory('/Mu_Logs') do
+      it { should exist }
+    end
+
+    describe file('/etc/rsyslog.d/0-mu-log-server.conf') do
+      it { should exist }
+      its('content'){ should match /\$DefaultNetstreamDriver gtls/}
+      its('content'){ should match /\$InputTCPServerStreamDriverMode 1/ }
+    end
+   
+    describe file("/etc/rsyslog.d/0-mu-log-client.conf") do
+      it { should_not exist }
+    end
+
+    ["grep ^/opt/chef/bin/chef-client /etc/rc.d/rc.local","grep '^/sbin/restorecon -r /home' /etc/rc.d/rc.local"].each do |cmd|
+      describe command(cmd) do
+        its('exit_status'){should eq 0}
+      end
+    end
+
+    describe directory("/etc/pki/rsyslog") do
+      it { should exist }
+    end
+    
+    describe package('logrotate') do
+      it { should be_installed }
+    end
+   
+    describe service('mu-momma-cat') do
+      it { should be_running }
+      it { should be_enabled }
+    end
+
+    describe service('nagios') do
+      it { should be_running }
+    end
+  end # end only_if
+
+
+end

data/test/mu-master-test/inspec.lock

@@ -0,0 +1,3 @@
+---
+lockfile_version: 1
+depends: []

data/test/mu-master-test/inspec.yml

@@ -0,0 +1,11 @@
+name: mu-master-test
+title: InSpec Profile
+maintainer: The Authors
+copyright: The Authors
+copyright_email: you@example.com
+license: Apache-2.0
+summary: An InSpec Compliance Profile
+version: 0.1.0
+#depends:
+#- name: mu-tools-test
+#  path: ../mu-tools-test

data/test/mu-tools-test/README.md

@@ -0,0 +1,3 @@
+# Example InSpec Profile
+
+This example shows the implementation of an InSpec profile.