inspec-core 2.1.67

data/docs/resources/pip.md.erb

@@ -0,0 +1,67 @@
+---
+title: About the pip Resource
+platform: os
+---
+
+# pip
+
+Use the `pip` InSpec audit resource to test packages that are installed using the Python PIP installer.
+
+<br>
+
+## Syntax
+
+A `pip` resource block declares a package and (optionally) a package version:
+
+    describe pip('package_name') do
+      it { should be_installed }
+    end
+
+where
+
+* `'package_name'` is the name of the package, such as `'Jinja2'`
+* `be_installed` tests to see if the package described above is installed
+
+<br>
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test if Jinja2 is installed on the system
+
+    describe pip('Jinja2') do
+      it { should be_installed }
+    end
+
+### Test if Jinja2 2.8 is installed on the system
+
+    describe pip('Jinja2') do
+      it { should be_installed }
+      its('version') { should eq '2.8' }
+    end
+
+### Test packages installed into a non-default location (e.g. virtualenv) by passing a custom path to pip executable
+
+    describe pip('Jinja2', '/path/to/bin/pip') do
+      it { should be_installed }
+      its('version') { should eq '2.8' }
+    end
+
+<br>
+
+## Matchers
+
+For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### be_installed
+
+The `be_installed` matcher tests if the named package is installed on the system:
+
+    it { should be_installed }
+
+### version
+
+The `version` matcher tests if the named package version is on the system:
+
+    its('version') { should eq '1.2.3' }

data/docs/resources/port.md.erb

@@ -0,0 +1,137 @@
+---
+title: About the port Resource
+platform: os
+---
+
+# port
+
+Use the `port` InSpec audit resource to test basic port properties, such as port, process, if it's listening.
+
+<br>
+
+## Syntax
+
+A `port` resource block declares a port, and then depending on what needs to be tested, a process, protocol, process identifier, and its state (is it listening?):
+
+    describe port(514) do
+      it { should be_listening }
+      its('processes') {should include 'syslog'}
+    end
+
+where the `processes` returns the processes listening on port 514.
+
+A filter may specify an attribute:
+
+    describe port.where { protocol =~ /tcp/ && port > 22 && port < 80 } do
+      it { should_not be_listening }
+    end
+
+where
+
+* `.where{}` specifies a block in which one (or more) attributes---`port`, `address`, `protocol`, `process`, `pid`, or `listening?`----scope the test to ports that match those attributes
+
+For example, to test if the SSH daemon is available on a Linux machine via the default port (22):
+
+    describe port(22) do
+      its('processes') { should include 'sshd' }
+      its('protocols') { should include 'tcp' }
+      its('addresses') { should include '0.0.0.0' }
+    end
+
+<br>
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test port 80, listening with the TCP protocol
+
+    describe port(80) do
+      it { should be_listening }
+      its('protocols') { should cmp 'tcp' }
+    end
+
+### Test port 80, on a specific address
+
+A specific port address may be checked using either of the following examples:
+
+    describe port(80) do
+      it { should be_listening }
+      its('addresses') {should include '0.0.0.0'}
+    end
+
+or:
+
+    describe port('0.0.0.0', 80) do
+      it { should be_listening }
+    end
+
+### Test port 80, listening with TCP version IPv6 protocol
+
+    describe port(80) do
+      it { should be_listening }
+      its('protocols') { should cmp 'tcp6' }
+    end
+
+### Test that only secure ports accept requests
+
+    describe port(80) do
+      it { should_not be_listening }
+    end
+
+    describe port(443) do
+      it { should be_listening }
+      its('protocols') { should cmp 'tcp' }
+    end
+
+### Verify port 65432 is not listening
+
+    describe port(22) do
+      it { should be_listening }
+      its('protocols') { should include('tcp') }
+      its('protocols') { should_not include('udp') }
+    end
+
+    describe port(65432) do
+      it { should_not be_listening }
+    end
+
+<br>
+
+## Matchers
+
+For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### address
+
+The `addresses` matcher tests if the specified address is associated with a port:
+
+    its('addresses') { should include '0.0.0.0' }
+
+### be_listening
+
+The `be_listening` matcher tests if the port is listening for traffic:
+
+    it { should be_listening }
+
+### pids
+
+The `pids` matcher tests the process identifiers (PIDs):
+
+    its('pids') { should cmp 27808 }
+
+### processes
+
+The `processes` matcher tests if the named process is running on the system:
+
+    its('processes') { should cmp 'syslog' }
+
+### protocols
+
+The `protocols` matcher tests the Internet protocol: ICMP (`'icmp'`), TCP (`'tcp'` or `'tcp6'`), or UDP (`'udp'` or `'udp6'`):
+
+    its('protocols') { should include 'tcp' }
+
+or for the IPv6 protocol:
+
+    its('protocols') { should include 'tcp6' }

data/docs/resources/postgres_conf.md.erb

@@ -0,0 +1,79 @@
+---
+title: About the postgres_conf Resource
+platform: os
+---
+
+# postgres_conf
+
+Use the `postgres_conf` InSpec audit resource to test the contents of the configuration file for PostgreSQL, typically located at `/etc/postgresql/<version>/main/postgresql.conf` or `/var/lib/postgres/data/postgresql.conf`, depending on the platform.
+
+<br>
+
+## Syntax
+
+A `postgres_conf` resource block declares one (or more) settings in the `postgresql.conf` file, and then compares the setting in the configuration file to the value stated in the test:
+
+    describe postgres_conf('path') do
+      its('setting') { should eq 'value' }
+    end
+
+
+where
+
+* `'setting'` specifies a setting in the `postgresql.conf` file
+* `('path')` is the non-default path to the `postgresql.conf` file (optional)
+* `should eq 'value'` is the value that is expected
+
+<br>
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test the maximum number of allowed client connections
+
+    describe postgres_conf do
+      its('max_connections') { should eq '5' }
+    end
+
+### Test system logging
+
+    describe postgres_conf do
+      its('logging_collector') { should eq 'on' }
+      its('log_connections') { should eq 'on' }
+      its('log_disconnections') { should eq 'on' }
+      its('log_duration') { should eq 'on' }
+      its('log_hostname') { should eq 'on' }
+      its('log_line_prefix') { should eq '%t %u %d %h' }
+      its(['pgaudit.log_parameter']) { should cmp 'on' }
+    end
+
+### Test the port on which PostgreSQL listens
+
+    describe postgres_conf do
+      its('port') { should eq '5432' }
+    end
+
+### Test the Unix socket settings
+
+    describe postgres_conf do
+      its('unix_socket_directories') { should eq '.s.PGSQL.5432' }
+      its('unix_socket_group') { should eq nil }
+      its('unix_socket_permissions') { should eq '0770' }
+    end
+
+where `unix_socket_group` is set to the PostgreSQL default setting (the group to which the server user belongs).
+
+<br>
+
+## Matchers
+
+For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### setting
+
+The `setting` matcher tests specific, named settings in the `postgresql.conf` file:
+
+    its('setting') { should eq 'value' }
+
+Use a `setting` matcher for each setting to be tested.

data/docs/resources/postgres_hba_conf.md.erb

@@ -0,0 +1,93 @@
+---
+title: About the postgres_hba_conf Resource
+platform: linux
+---
+
+# postgres\_hba\_conf
+
+Use the `postgres_hba_conf` InSpec audit resource to test the client authentication data defined in the pg_hba.conf file.
+
+<br>
+
+## Syntax
+
+An `postgres_hba_conf` InSpec audit resource block declares client authentication data that should be tested:
+
+    describe postgres_hba_conf.where { type == 'local' } do
+     its('auth_method') { should eq ['peer'] }
+    end
+
+where
+
+* `'attribute'` is a attribute in the  pg hba configuration file
+* `'filter_value'` is the value that is to be filtered for
+* `'value'` is the value that is to be matched expected
+
+<br>
+
+## Properties
+
+    'address', 'auth_method', 'auth_params', 'conf_dir' , 'conf_file' , 'database', 'params' ,'type', 'user'
+
+<br>
+
+## Property Examples
+
+### address([String])
+
+`address` returns a an array of strings that matches the where condition of the filter table
+
+    describe postgres_hba_conf.where { type == 'local' } do
+      its('address') { should cmp 'value' }
+    end
+
+### auth_method([String])
+
+`auth_method` returns a an array of strings that matches the where condition of the filter table
+
+    describe postgres_hba_conf.where { type == 'local' } do
+      its('auth_method') { should cmp 'value' }
+    end
+
+### database([String])
+
+`database` returns a an array of strings that matches the where condition of the filter table
+
+    describe postgres_hba_conf.where { type == 'local' } do
+      its('database') { should cmp 'value' }
+    end
+
+### type([String])
+
+`type` returns a an array of strings that matches the where condition of the filter table
+
+    describe postgres_hba_conf.where { database == 'acme_test_db' } do
+      its('type') { should cmp 'value' }
+    end
+
+### user([String])
+
+`user` returns a an array of strings that matches the where condition of the filter table
+
+    describe postgres_hba_conf.where { database == 'acme_test_db' } do
+      its('user') { should cmp 'value' }
+    end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource matches any service that is listed in the HBA configuration file. For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+    its('auth_method') { should_not cmp 'peer' }
+
+or:
+
+    its('auth_method') { should cmp 'peer' }
+
+For example:
+
+    describe postgres_hba_conf.where { type == 'type' } do
+      its('auth_method') { should cmp 'value' }
+      its('user') { should cmp 'value' }
+    end

data/docs/resources/postgres_ident_conf.md.erb

@@ -0,0 +1,76 @@
+---
+title: About the postgres_ident_conf Resource
+platform: linux
+---
+
+# postgres\_ident\_conf
+
+Use the `postgres_ident_conf` InSpec audit resource to test the client authentication data defined in the pg_hba.conf file.
+
+<br>
+
+## Syntax
+
+An `postgres_ident_conf` InSpec audit resource block declares client authentication data that should be tested:
+
+    describe postgres_ident_conf.where { pg_username == 'filter_value' } do
+      its('attribute') { should eq ['value'] }
+    end
+
+where
+
+* `'attribute'` is a attribute in the  pg ident configuration file
+* `'filter_value'` is the value that is to be filtered for
+* `'value'` is the value that is to be matched expected
+
+<br>
+
+## Properties
+
+    'conf_file', 'map_name', 'params', 'pg_username', 'system_username'
+
+<br>
+
+## Property Examples
+
+### map_name([String])
+
+`address` returns a an array of strings that matches the where condition of the filter table
+
+    describe pg_hba_conf.where { pg_username == 'name' } do
+      its('map_name') { should eq ['value'] }
+    end
+### pg_username([String])
+
+`pg_username` returns a an array of strings that matches the where condition of the filter table
+
+    describe pg_hba_conf.where { pg_username == 'name' } do
+      its('pg_username') { should eq ['value'] }
+    end
+
+### system_username([String])
+
+`system_username` returns a an array of strings that matches the where condition of the filter table
+
+    describe pg_hba_conf.where { pg_username == 'name' } do
+      its('system_username') { should eq ['value'] }
+    end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource matches any service that is listed in the pg ident configuration file. For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+    its('pg_username') { should_not eq ['peer'] }
+
+or:
+
+    its('map_name') { should eq ['value'] }
+
+For example:
+
+    describe postgres_ident_conf.where { pg_username == 'name' } do
+      its('system_username') { should eq ['value'] }
+      its('map_name') { should eq ['value'] }
+    end