inspec-core 2.1.67

data/lib/resources/kernel_parameter.rb

@@ -0,0 +1,58 @@
+# encoding: utf-8
+
+module Inspec::Resources
+  class KernelParameter < Inspec.resource(1)
+    name 'kernel_parameter'
+    supports platform: 'unix'
+    desc 'Use the kernel_parameter InSpec audit resource to test kernel parameters on Linux platforms.'
+    example "
+      describe kernel_parameter('net.ipv4.conf.all.forwarding') do
+        its('value') { should eq 0 }
+      end
+    "
+
+    def initialize(parameter = nil)
+      @parameter = parameter
+
+      # this resource is only supported on Linux
+      return skip_resource 'The `kernel_parameter` resource is not supported on your OS.' if !inspec.os.linux?
+    end
+
+    def value
+      cmd = inspec.command("/sbin/sysctl -q -n #{@parameter}")
+      return nil if cmd.exit_status != 0
+      # remove whitespace
+      cmd = cmd.stdout.chomp.strip
+      # convert to number if possible
+      cmd = cmd.to_i if cmd =~ /^\d+$/
+      cmd
+    end
+
+    def to_s
+      "Kernel Parameter #{@parameter}"
+    end
+  end
+
+  # for compatability with serverspec
+  # this is deprecated syntax and will be removed in future versions
+  class LinuxKernelParameter < KernelParameter
+    name 'linux_kernel_parameter'
+
+    def initialize(parameter)
+      super(parameter)
+    end
+
+    def value
+      deprecated
+      super()
+    end
+
+    def deprecated
+      warn '[DEPRECATION] `linux_kernel_parameter(parameter)` is deprecated.  Please use `kernel_parameter(parameter)` instead.'
+    end
+
+    def to_s
+      "Kernel Parameter #{@parameter}"
+    end
+  end
+end

data/lib/resources/key_rsa.rb

@@ -0,0 +1,63 @@
+# encoding: utf-8
+
+require 'openssl'
+require 'hashie/mash'
+require 'utils/file_reader'
+require 'utils/pkey_reader'
+
+module Inspec::Resources
+  class RsaKey < Inspec.resource(1)
+    name 'key_rsa'
+    supports platform: 'unix'
+    supports platform: 'windows'
+    desc 'public/private RSA key pair test'
+    example "
+      describe key_rsa('/etc/pki/www.mywebsite.com.key') do
+        its('public_key') { should match /BEGIN RSA PUBLIC KEY/ }
+      end
+
+      describe key_rsa('/etc/pki/www.mywebsite.com.key', 'passphrase') do
+        it { should be_private }
+        it { should be_public }
+      end
+    "
+
+    include FileReader
+    include PkeyReader
+
+    def initialize(keypath, passphrase = nil)
+      @key_path = keypath
+      @passphrase = passphrase
+      @key = read_pkey(read_file_content(@key_path, allow_empty: true), @passphrase)
+    end
+
+    def public?
+      return if @key.nil?
+      @key.public?
+    end
+
+    def public_key
+      return if @key.nil?
+      @key.public_key.to_s
+    end
+
+    def private?
+      return if @key.nil?
+      @key.private?
+    end
+
+    def private_key
+      return if @key.nil?
+      @key.to_s
+    end
+
+    def key_length
+      return if @key.nil?
+      @key.public_key.n.num_bytes * 8
+    end
+
+    def to_s
+      "rsa_key #{@key_path}"
+    end
+  end
+end

data/lib/resources/limits_conf.rb

@@ -0,0 +1,46 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+require 'utils/simpleconfig'
+require 'utils/file_reader'
+
+module Inspec::Resources
+  class LimitsConf < Inspec.resource(1)
+    name 'limits_conf'
+    supports platform: 'unix'
+    desc 'Use the limits_conf InSpec audit resource to test configuration settings in the /etc/security/limits.conf file. The limits.conf defines limits for processes (by user and/or group names) and helps ensure that the system on which those processes are running remains stable. Each process may be assigned a hard or soft limit.'
+    example "
+      describe limits_conf do
+        its('*') { should include ['hard','core','0'] }
+      end
+    "
+
+    include FileReader
+
+    def initialize(path = nil)
+      @conf_path = path || '/etc/security/limits.conf'
+      @content = read_file_content(@conf_path)
+    end
+
+    def method_missing(name)
+      read_params[name.to_s]
+    end
+
+    def read_params
+      return @params if defined?(@params)
+
+      # parse the file
+      conf = SimpleConfig.new(
+        @content,
+        assignment_regex: /^\s*(\S+?)\s+(.*?)\s+(.*?)\s+(.*?)\s*$/,
+        key_values: 3,
+        multiple_values: true,
+      )
+      @params = conf.params
+    end
+
+    def to_s
+      'limits.conf'
+    end
+  end
+end

data/lib/resources/login_def.rb

@@ -0,0 +1,57 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+require 'utils/simpleconfig'
+require 'utils/file_reader'
+
+# Usage:
+#
+# describe login_def do
+#   its('UMASK') {
+#     should eq '077'
+#   }
+#
+#   its('PASS_MAX_DAYS.to_i') {
+#     should be <= 90
+#   }
+# end
+
+module Inspec::Resources
+  class LoginDef < Inspec.resource(1)
+    name 'login_defs'
+    supports platform: 'unix'
+    desc 'Use the login_defs InSpec audit resource to test configuration settings in the /etc/login.defs file. The logins.defs file defines site-specific configuration for the shadow password suite on Linux and UNIX platforms, such as password expiration ranges, minimum/maximum values for automatic selection of user and group identifiers, or the method with which passwords are encrypted.'
+    example "
+      describe login_defs do
+        its('ENCRYPT_METHOD') { should eq 'SHA512' }
+      end
+    "
+
+    include FileReader
+
+    def initialize(path = nil)
+      @conf_path = path || '/etc/login.defs'
+      @content = read_file_content(@conf_path)
+    end
+
+    def method_missing(name)
+      read_params[name.to_s]
+    end
+
+    def read_params
+      return @params if defined?(@params)
+
+      # parse the file
+      conf = SimpleConfig.new(
+        @content,
+        assignment_regex: /^\s*(\S+)\s+(\S*)\s*$/,
+        multiple_values: false,
+      )
+      @params = conf.params
+    end
+
+    def to_s
+      'login.defs'
+    end
+  end
+end

data/lib/resources/mount.rb

@@ -0,0 +1,88 @@
+# encoding: utf-8
+
+require 'utils/simpleconfig'
+
+module Inspec::Resources
+  class Mount < Inspec.resource(1)
+    name 'mount'
+    supports platform: 'unix'
+    desc 'Use the mount InSpec audit resource to test if mount points.'
+    example "
+      describe mount('/') do
+        it { should be_mounted }
+        its('count') { should eq 1 }
+        its('device') { should eq  '/dev/mapper/VolGroup-lv_root' }
+        its('type') { should eq  'ext4' }
+        its('options') { should eq ['rw', 'mode=620'] }
+        its('options') { should include 'nodev' }
+      end
+    "
+    attr_reader :file
+
+    def initialize(path)
+      @path = path
+      @mount_manager = mount_manager_for_os
+      return skip_resource 'The `mount` resource is not supported on your OS yet.' if @mount_manager.nil?
+      @file = inspec.backend.file(@path)
+    end
+
+    def mounted?
+      file.mounted?
+    end
+
+    def count
+      mounted = file.mounted
+      return nil if mounted.nil? || mounted.stdout.nil?
+      mounted.stdout.lines.count
+    end
+
+    def method_missing(name)
+      return nil if !file.mounted?
+
+      mounted = file.mounted
+      return nil if mounted.nil? || mounted.stdout.nil?
+
+      line = mounted.stdout
+      # if we got multiple lines, only use the last entry
+      line = mounted.stdout.lines.to_a.last if mounted.stdout.lines.count > 1
+
+      # parse content if we are on linux
+      @mount_options ||= @mount_manager.parse_mount_options(line)
+      @mount_options[name]
+    end
+
+    def to_s
+      "Mount #{@path}"
+    end
+
+    private
+
+    def mount_manager_for_os
+      os = inspec.os
+      if os.linux?
+        LinuxMounts.new(inspec)
+      elsif ['freebsd'].include?(os[:family])
+        BsdMounts.new(inspec)
+      end
+    end
+  end
+
+  class MountsInfo
+    attr_reader :inspec
+    def initialize(inspec)
+      @inspec = inspec
+    end
+
+    def parse_mount_options(_mount_line, _compatibility = false)
+      raise NotImplementedError
+    end
+  end
+
+  class LinuxMounts < MountsInfo
+    include LinuxMountParser
+  end
+
+  class BsdMounts < MountsInfo
+    include BsdMountParser
+  end
+end

data/lib/resources/mssql_session.rb

@@ -0,0 +1,101 @@
+# encoding: utf-8
+
+require 'hashie/mash'
+require 'utils/database_helpers'
+
+module Inspec::Resources
+  # STABILITY: Experimental
+  # This resource needs further testing and refinement
+  #
+  # This requires the `sqlcmd` tool available on platform
+  # @see https://docs.microsoft.com/en-us/sql/relational-databases/scripting/sqlcmd-use-the-utility
+  # @see https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-connect-and-query-sqlcmd
+  class MssqlSession < Inspec.resource(1)
+    name 'mssql_session'
+    supports platform: 'windows'
+    desc 'Use the mssql_session InSpec audit resource to test SQL commands run against a MS Sql Server database.'
+    example "
+      # Using SQL authentication
+      sql = mssql_session(user: 'myuser', pass: 'mypassword')
+      describe sql.query('SELECT * FROM table').row(0).column('columnname') do
+        its('value') { should cmp == 1 }
+      end
+
+      # Passing no credentials to mssql_session forces it to use Windows authentication
+      sql_windows_auth = mssql_session
+      describe sql_windows_auth.query(\"SELECT SERVERPROPERTY('IsIntegratedSecurityOnly') as \\\"login_mode\\\";\").row(0).column('login_mode') do
+        its('value') { should_not be_empty }
+        its('value') { should cmp == 1 }
+      end
+    "
+
+    attr_reader :user, :password, :host, :port, :instance
+    def initialize(opts = {})
+      @user = opts[:user]
+      @password = opts[:password] || opts[:pass]
+      if opts[:pass]
+        warn '[DEPRECATED] use `password` option to supply password instead of `pass`'
+      end
+      @host = opts[:host] || 'localhost'
+      @port = opts[:port] || '1433'
+      @instance = opts[:instance]
+
+      # check if sqlcmd is available
+      raise Inspec::Exceptions::ResourceSkipped, 'sqlcmd is missing' unless inspec.command('sqlcmd').exist?
+      # check that database is reachable
+      raise Inspec::Exceptions::ResourceSkipped, "Can't connect to the MS SQL Server." unless test_connection
+    end
+
+    def query(q)
+      escaped_query = q.gsub(/\\/, '\\\\').gsub(/"/, '\\"').gsub(/\$/, '\\$')
+      # surpress 'x rows affected' in SQLCMD with 'set nocount on;'
+      cmd_string = "sqlcmd -Q \"set nocount on; #{escaped_query}\" -W -w 1024 -s ','"
+      cmd_string += " -U '#{@user}' -P '#{@password}'" unless @user.nil? || @password.nil?
+      if @instance.nil?
+        cmd_string += " -S '#{@host},#{@port}'"
+      else
+        cmd_string += " -S '#{@host},#{@port}\\#{@instance}'"
+      end
+      cmd = inspec.command(cmd_string)
+      out = cmd.stdout + "\n" + cmd.stderr
+      if cmd.exit_status != 0 || out =~ /Sqlcmd: Error/
+        # TODO: we need to throw an exception here
+        # change once https://github.com/chef/inspec/issues/1205 is in
+        warn "Could not execute the sql query #{out}"
+        DatabaseHelper::SQLQueryResult.new(cmd, Hashie::Mash.new({}))
+      else
+        DatabaseHelper::SQLQueryResult.new(cmd, parse_csv_result(cmd))
+      end
+    end
+
+    def to_s
+      'MSSQL session'
+    end
+
+    private
+
+    def test_connection
+      !query('select getdate()').empty?
+    end
+
+    def parse_csv_result(cmd)
+      require 'csv'
+      table = CSV.parse(cmd.stdout, { headers: true })
+
+      # remove first row, since it will be a seperator line
+      table.delete(0)
+
+      # convert to hash
+      headers = table.headers
+
+      results = table.map { |row|
+        res = {}
+        headers.each { |header|
+          res[header.downcase] = row[header]
+        }
+        Hashie::Mash.new(res)
+      }
+      results
+    end
+  end
+end

data/lib/resources/mysql.rb

@@ -0,0 +1,82 @@
+# encoding: utf-8
+# copyright: 2015, Vulcano Security GmbH
+
+module Inspec::Resources
+  class Mysql < Inspec.resource(1)
+    name 'mysql'
+    supports platform: 'unix'
+    desc 'The \'mysql\' resource is a helper for the \'mysql_conf\' & \'mysql_session\' resources.  Please use those instead.'
+
+    attr_reader :package, :service, :conf_dir, :conf_path, :data_dir, :log_dir, :log_path, :log_group, :log_dir_group
+    def initialize
+      # set OS-dependent filenames and paths
+      case inspec.os[:family]
+      when 'debian'
+        init_ubuntu
+      when 'redhat', 'fedora'
+        init_redhat
+      when 'arch'
+        init_arch
+      else
+        # TODO: could not detect
+        init_default
+      end
+    end
+
+    def init_ubuntu
+      @package = 'mysql-server'
+      @service = 'mysql'
+      @conf_path = '/etc/mysql/my.cnf'
+      @conf_dir = '/etc/mysql/'
+      @data_dir = '/var/lib/mysql/'
+      @log_dir = '/var/log/'
+      @log_path = '/var/log/mysql.log'
+      @log_group = 'adm'
+      case inspec.os[:release]
+      when '14.04'
+        @log_dir_group = 'syslog'
+      else
+        @log_dir_group = 'root'
+      end
+    end
+
+    def init_redhat
+      @package = 'mysql-server'
+      @service = 'mysqld'
+      @conf_path = '/etc/my.cnf'
+      @conf_dir = '/etc/'
+      @data_dir = '/var/lib/mysql/'
+      @log_dir = '/var/log/'
+      @log_path = '/var/log/mysqld.log'
+      @log_group = 'mysql'
+      @log_dir_group = 'root'
+    end
+
+    def init_arch
+      @package = 'mariadb'
+      @service = 'mysql'
+      @conf_path = '/etc/mysql/my.cnf'
+      @conf_dir = '/etc/mysql/'
+      @data_dir = '/var/lib/mysql/'
+      @log_dir = '/var/log/'
+      @log_path = '/var/log/mysql.log'
+      @log_group = 'mysql'
+      @log_dir_group = 'root'
+    end
+
+    def init_default
+      @service = 'mysqld'
+      @conf_path = '/etc/my.cnf'
+      @conf_dir = '/etc/'
+      @data_dir = '/var/lib/mysql/'
+      @log_dir = '/var/log/'
+      @log_path = '/var/log/mysqld.log'
+      @log_group = 'mysql'
+      @log_dir_group = 'root'
+    end
+
+    def to_s
+      'MySQL'
+    end
+  end
+end