inspec 1.0.0 → 1.1.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +46 -3
- data/Gemfile +4 -1
- data/README.md +3 -0
- data/docs/dsl_inspec.md +3 -3
- data/docs/profiles.md +17 -0
- data/docs/resources/apache_conf.md.erb +10 -10
- data/docs/resources/apt.md.erb +13 -13
- data/docs/resources/audit_policy.md.erb +10 -10
- data/docs/resources/auditd_conf.md.erb +10 -10
- data/docs/resources/auditd_rules.md.erb +11 -11
- data/docs/resources/bash.md.erb +12 -12
- data/docs/resources/bond.md.erb +15 -15
- data/docs/resources/bridge.md.erb +11 -11
- data/docs/resources/bsd_service.md.erb +11 -11
- data/docs/resources/command.md.erb +21 -21
- data/docs/resources/csv.md.erb +10 -10
- data/docs/resources/directory.md.erb +8 -8
- data/docs/resources/etc_group.md.erb +16 -16
- data/docs/resources/etc_passwd.md.erb +17 -17
- data/docs/resources/etc_shadow.md.erb +19 -19
- data/docs/resources/file.md.erb +58 -58
- data/docs/resources/gem.md.erb +12 -12
- data/docs/resources/group.md.erb +12 -12
- data/docs/resources/grub_conf.md.erb +11 -11
- data/docs/resources/host.md.erb +13 -13
- data/docs/resources/iis_site.md.erb +16 -16
- data/docs/resources/inetd_conf.md.erb +10 -10
- data/docs/resources/ini.md.erb +9 -9
- data/docs/resources/interface.md.erb +11 -11
- data/docs/resources/iptables.md.erb +11 -11
- data/docs/resources/json.md.erb +10 -10
- data/docs/resources/kernel_module.md.erb +10 -10
- data/docs/resources/kernel_parameter.md.erb +12 -12
- data/docs/resources/launchd_service.md.erb +11 -11
- data/docs/resources/limits_conf.md.erb +10 -10
- data/docs/resources/login_def.md.erb +12 -12
- data/docs/resources/mount.md.erb +13 -13
- data/docs/resources/mysql_conf.md.erb +14 -14
- data/docs/resources/mysql_session.md.erb +10 -10
- data/docs/resources/npm.md.erb +12 -12
- data/docs/resources/ntp_conf.md.erb +9 -9
- data/docs/resources/oneget.md.erb +11 -11
- data/docs/resources/os.md.erb +13 -13
- data/docs/resources/os_env.md.erb +12 -12
- data/docs/resources/package.md.erb +15 -15
- data/docs/resources/parse_config.md.erb +13 -13
- data/docs/resources/parse_config_file.md.erb +22 -16
- data/docs/resources/pip.md.erb +12 -12
- data/docs/resources/port.md.erb +18 -18
- data/docs/resources/postgres_conf.md.erb +13 -13
- data/docs/resources/postgres_session.md.erb +11 -11
- data/docs/resources/powershell.md.erb +13 -13
- data/docs/resources/process.md.erb +12 -12
- data/docs/resources/registry_key.md.erb +17 -17
- data/docs/resources/runit_service.md.erb +11 -11
- data/docs/resources/security_policy.md.erb +10 -10
- data/docs/resources/service.md.erb +17 -17
- data/docs/resources/ssh_config.md.erb +13 -13
- data/docs/resources/sshd_config.md.erb +14 -14
- data/docs/resources/ssl.md.erb +12 -12
- data/docs/resources/sys_info.md.erb +10 -10
- data/docs/resources/systemd_service.md.erb +11 -11
- data/docs/resources/sysv_service.md.erb +11 -11
- data/docs/resources/upstart_service.md.erb +11 -11
- data/docs/resources/user.md.erb +20 -20
- data/docs/resources/users.md.erb +19 -19
- data/docs/resources/vbscript.md.erb +9 -9
- data/docs/resources/windows_feature.md.erb +10 -10
- data/docs/resources/wmi.md.erb +10 -10
- data/docs/resources/xinetd_conf.md.erb +17 -17
- data/docs/resources/yaml.md.erb +10 -10
- data/docs/resources/yum.md.erb +16 -16
- data/examples/meta-profile/README.md +0 -5
- data/lib/inspec/base_cli.rb +6 -0
- data/lib/inspec/cli.rb +10 -3
- data/lib/inspec/profile.rb +3 -3
- data/lib/inspec/rspec_json_formatter.rb +24 -15
- data/lib/inspec/version.rb +1 -1
- data/lib/resources/registry_key.rb +15 -5
- data/lib/utils/filter.rb +1 -0
- metadata +3 -4
data/docs/resources/users.md.erb
CHANGED
@@ -6,7 +6,7 @@ title: About the users Resource
|
|
6
6
|
|
7
7
|
Use the `users` InSpec audit resource to look up all local users available on the system, and then test specific properties of those users. This resource does not return information about users that may be located on other systems, such as LDAP or Active Directory.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `users` resource block declares a user name, and then one (or more) matchers:
|
12
12
|
|
@@ -33,29 +33,29 @@ or:
|
|
33
33
|
it { should exist }
|
34
34
|
end
|
35
35
|
|
36
|
-
|
36
|
+
## Matchers
|
37
37
|
|
38
38
|
This InSpec audit resource has the following matchers:
|
39
39
|
|
40
|
-
|
40
|
+
### be
|
41
41
|
|
42
42
|
<%= partial "/shared/matcher_be" %>
|
43
43
|
|
44
|
-
|
44
|
+
### cmp
|
45
45
|
|
46
46
|
<%= partial "/shared/matcher_cmp" %>
|
47
47
|
|
48
|
-
|
48
|
+
### eq
|
49
49
|
|
50
50
|
<%= partial "/shared/matcher_eq" %>
|
51
51
|
|
52
|
-
|
52
|
+
### exist
|
53
53
|
|
54
54
|
The `exist` matcher tests if the named user exists:
|
55
55
|
|
56
56
|
it { should exist }
|
57
57
|
|
58
|
-
|
58
|
+
### gid
|
59
59
|
|
60
60
|
The `gid` matcher tests the group identifier:
|
61
61
|
|
@@ -63,7 +63,7 @@ The `gid` matcher tests the group identifier:
|
|
63
63
|
|
64
64
|
where `1234` represents the user identifier.
|
65
65
|
|
66
|
-
|
66
|
+
### group
|
67
67
|
|
68
68
|
The `group` matcher tests the group to which the user belongs:
|
69
69
|
|
@@ -71,27 +71,27 @@ The `group` matcher tests the group to which the user belongs:
|
|
71
71
|
|
72
72
|
where `root` represents the group.
|
73
73
|
|
74
|
-
|
74
|
+
### groups
|
75
75
|
|
76
76
|
The `groups` matcher tests two (or more) groups to which the user belongs:
|
77
77
|
|
78
78
|
its('groups') { should eq ['root', 'other']}
|
79
79
|
|
80
|
-
|
80
|
+
### home
|
81
81
|
|
82
82
|
The `home` matcher tests the home directory path for the user:
|
83
83
|
|
84
84
|
its('home') { should eq '/root' }
|
85
85
|
|
86
|
-
|
86
|
+
### include
|
87
87
|
|
88
88
|
<%= partial "/shared/matcher_include" %>
|
89
89
|
|
90
|
-
|
90
|
+
### match
|
91
91
|
|
92
92
|
<%= partial "/shared/matcher_match" %>
|
93
93
|
|
94
|
-
|
94
|
+
### maxdays
|
95
95
|
|
96
96
|
The `maxdays` matcher tests the maximum number of days between password changes:
|
97
97
|
|
@@ -99,7 +99,7 @@ The `maxdays` matcher tests the maximum number of days between password changes:
|
|
99
99
|
|
100
100
|
where `99` represents the maximum number of days.
|
101
101
|
|
102
|
-
|
102
|
+
### mindays
|
103
103
|
|
104
104
|
The `mindays` matcher tests the minimum number of days between password changes:
|
105
105
|
|
@@ -107,13 +107,13 @@ The `mindays` matcher tests the minimum number of days between password changes:
|
|
107
107
|
|
108
108
|
where `0` represents the maximum number of days.
|
109
109
|
|
110
|
-
|
110
|
+
### shell
|
111
111
|
|
112
112
|
The `shell` matcher tests the path to the default shell for the user:
|
113
113
|
|
114
114
|
its('shell') { should eq '/bin/bash' }
|
115
115
|
|
116
|
-
|
116
|
+
### uid
|
117
117
|
|
118
118
|
The `uid` matcher tests the user identifier:
|
119
119
|
|
@@ -121,7 +121,7 @@ The `uid` matcher tests the user identifier:
|
|
121
121
|
|
122
122
|
where `1234` represents the user identifier.
|
123
123
|
|
124
|
-
|
124
|
+
### warndays
|
125
125
|
|
126
126
|
The `warndays` matcher tests the number of days a user is warned before a password must be changed:
|
127
127
|
|
@@ -129,11 +129,11 @@ The `warndays` matcher tests the number of days a user is warned before a passwo
|
|
129
129
|
|
130
130
|
where `5` represents the number of days a user is warned.
|
131
131
|
|
132
|
-
|
132
|
+
## Examples
|
133
133
|
|
134
134
|
The following examples show how to use this InSpec audit resource.
|
135
135
|
|
136
|
-
|
136
|
+
### Use a regular expression to find users
|
137
137
|
|
138
138
|
describe users.where { uid =~ /S\-1\-5\-21\-\d+\-\d+\-\d+\-500/ } do
|
139
139
|
it { should exist }
|
@@ -6,7 +6,7 @@ title: About the vbscript Resource
|
|
6
6
|
|
7
7
|
Use the `vbscript` InSpec audit resource to test a VBScript on the Windows platform.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `vbscript` resource block tests the output of a VBScript on the Windows platform:
|
12
12
|
|
@@ -20,35 +20,35 @@ where
|
|
20
20
|
* `('output')` is the expected output of the VBScript
|
21
21
|
|
22
22
|
|
23
|
-
|
23
|
+
## Matchers
|
24
24
|
|
25
25
|
This InSpec audit resource has the following matchers:
|
26
26
|
|
27
|
-
|
27
|
+
### be
|
28
28
|
|
29
29
|
<%= partial "/shared/matcher_be" %>
|
30
30
|
|
31
|
-
|
31
|
+
### cmp
|
32
32
|
|
33
33
|
<%= partial "/shared/matcher_cmp" %>
|
34
34
|
|
35
|
-
|
35
|
+
### eq
|
36
36
|
|
37
37
|
<%= partial "/shared/matcher_eq" %>
|
38
38
|
|
39
|
-
|
39
|
+
### include
|
40
40
|
|
41
41
|
<%= partial "/shared/matcher_include" %>
|
42
42
|
|
43
|
-
|
43
|
+
### match
|
44
44
|
|
45
45
|
<%= partial "/shared/matcher_match" %>
|
46
46
|
|
47
|
-
|
47
|
+
## Examples
|
48
48
|
|
49
49
|
The following examples show how to use this InSpec audit resource.
|
50
50
|
|
51
|
-
|
51
|
+
### Test a VBScript
|
52
52
|
|
53
53
|
A VBScript file similar to:
|
54
54
|
|
@@ -6,7 +6,7 @@ title: About the windows_feature Resource
|
|
6
6
|
|
7
7
|
Use the `windows_feature` InSpec audit resource to test features on Windows via the `Get-WindowsFeature` cmdlet.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `windows_feature` resource block declares the name of the Windows feature, tests if that feature is installed, and then returns information about that feature:
|
12
12
|
|
@@ -20,41 +20,41 @@ where
|
|
20
20
|
* `be_installed` is a valid matcher for this resource
|
21
21
|
|
22
22
|
|
23
|
-
|
23
|
+
## Matchers
|
24
24
|
|
25
25
|
This InSpec audit resource has the following matchers:
|
26
26
|
|
27
|
-
|
27
|
+
### be
|
28
28
|
|
29
29
|
<%= partial "/shared/matcher_be" %>
|
30
30
|
|
31
|
-
|
31
|
+
### be_installed
|
32
32
|
|
33
33
|
The `be_installed` matcher tests if the named Windows feature is installed:
|
34
34
|
|
35
35
|
it { should be_installed }
|
36
36
|
|
37
|
-
|
37
|
+
### cmp
|
38
38
|
|
39
39
|
<%= partial "/shared/matcher_cmp" %>
|
40
40
|
|
41
|
-
|
41
|
+
### eq
|
42
42
|
|
43
43
|
<%= partial "/shared/matcher_eq" %>
|
44
44
|
|
45
|
-
|
45
|
+
### include
|
46
46
|
|
47
47
|
<%= partial "/shared/matcher_include" %>
|
48
48
|
|
49
|
-
|
49
|
+
### match
|
50
50
|
|
51
51
|
<%= partial "/shared/matcher_match" %>
|
52
52
|
|
53
|
-
|
53
|
+
## Examples
|
54
54
|
|
55
55
|
The following examples show how to use this InSpec audit resource.
|
56
56
|
|
57
|
-
|
57
|
+
### Test the DHCP Server feature
|
58
58
|
|
59
59
|
describe windows_feature('DHCP Server') do
|
60
60
|
it{ should be_installed }
|
data/docs/resources/wmi.md.erb
CHANGED
@@ -6,7 +6,7 @@ title: About the wmi Resource
|
|
6
6
|
|
7
7
|
Use the `wmi` InSpec audit resource to test WMI settings on the Windows platform.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `wmi` resource block tests WMI settings on the Windows platform:
|
12
12
|
|
@@ -47,35 +47,35 @@ and the second uses a filter in the Ruby Hash to first identify WinRM, and then
|
|
47
47
|
end
|
48
48
|
|
49
49
|
|
50
|
-
|
50
|
+
## Matchers
|
51
51
|
|
52
52
|
This InSpec audit resource has the following matchers:
|
53
53
|
|
54
|
-
|
54
|
+
### be
|
55
55
|
|
56
56
|
<%= partial "/shared/matcher_be" %>
|
57
57
|
|
58
|
-
|
58
|
+
### cmp
|
59
59
|
|
60
60
|
<%= partial "/shared/matcher_cmp" %>
|
61
61
|
|
62
|
-
|
62
|
+
### eq
|
63
63
|
|
64
64
|
<%= partial "/shared/matcher_eq" %>
|
65
65
|
|
66
|
-
|
66
|
+
### include
|
67
67
|
|
68
68
|
<%= partial "/shared/matcher_include" %>
|
69
69
|
|
70
|
-
|
70
|
+
### match
|
71
71
|
|
72
72
|
<%= partial "/shared/matcher_match" %>
|
73
73
|
|
74
|
-
|
74
|
+
## Examples
|
75
75
|
|
76
76
|
The following examples show how to use this InSpec audit resource.
|
77
77
|
|
78
|
-
|
78
|
+
### Test a password expiration policy
|
79
79
|
|
80
80
|
describe wmi({
|
81
81
|
class: 'RSOP_SecuritySettingNumeric',
|
@@ -85,7 +85,7 @@ The following examples show how to use this InSpec audit resource.
|
|
85
85
|
its('Setting') { should eq 1 }
|
86
86
|
end
|
87
87
|
|
88
|
-
|
88
|
+
### Test if an anonymous user can query the Local Security Authority (LSA)
|
89
89
|
|
90
90
|
describe wmi({
|
91
91
|
namespace: 'root\rsop\computer',
|
@@ -6,7 +6,7 @@ title: About the xinetd_conf Resource
|
|
6
6
|
|
7
7
|
Use the `xinetd_conf` InSpec audit resource to test services under `/etc/xinet.d` on Linux and Unix platforms. xinetd---the extended Internet service daemon---listens on all ports, and then loads the appropriate program based on a request. The `xinetd.conf` file is typically located at `/etc/xinetd.conf` and contains a list of Internet services associated to the ports on which that service will listen. Only enabled services may handle a request; only services that are required by the system should be enabled.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
An `xinetd_conf` resource block declares settings found in a `xinetd.conf` file for the named service:
|
12
12
|
|
@@ -22,29 +22,29 @@ where
|
|
22
22
|
* `should eq 'value'` is the value that is expected
|
23
23
|
|
24
24
|
|
25
|
-
|
25
|
+
## Matchers
|
26
26
|
|
27
27
|
This InSpec audit resource has the following matchers:
|
28
28
|
|
29
|
-
|
29
|
+
### be
|
30
30
|
|
31
31
|
<%= partial "/shared/matcher_be" %>
|
32
32
|
|
33
|
-
|
33
|
+
### be_enabed
|
34
34
|
|
35
35
|
The `be_enabled` matcher tests if a service listed under `/etc/xinet.d` is enabled:
|
36
36
|
|
37
37
|
it { should be_enabled }
|
38
38
|
|
39
|
-
|
39
|
+
### cmp
|
40
40
|
|
41
41
|
<%= partial "/shared/matcher_cmp" %>
|
42
42
|
|
43
|
-
|
43
|
+
### eq
|
44
44
|
|
45
45
|
<%= partial "/shared/matcher_eq" %>
|
46
46
|
|
47
|
-
|
47
|
+
### ids
|
48
48
|
|
49
49
|
The `ids` matcher tests if the named service is located under `/etc/xinet.d`:
|
50
50
|
|
@@ -54,21 +54,21 @@ For example:
|
|
54
54
|
|
55
55
|
its('ids') { should include 'chargen-stream chargen-dgram'}
|
56
56
|
|
57
|
-
|
57
|
+
### include
|
58
58
|
|
59
59
|
<%= partial "/shared/matcher_include" %>
|
60
60
|
|
61
|
-
|
61
|
+
### match
|
62
62
|
|
63
63
|
<%= partial "/shared/matcher_match" %>
|
64
64
|
|
65
|
-
|
65
|
+
### services
|
66
66
|
|
67
67
|
The `services` matcher tests if the named service is listed under `/etc/xinet.d`:
|
68
68
|
|
69
69
|
its('services') { should include 'service_name' }
|
70
70
|
|
71
|
-
|
71
|
+
### socket_types
|
72
72
|
|
73
73
|
The `socket_types` matcher tests if a service listed under `/etc/xinet.d` is configured to use the named socket type:
|
74
74
|
|
@@ -86,7 +86,7 @@ For a TCP-based service:
|
|
86
86
|
|
87
87
|
its('socket_types') { should eq 'stream' }
|
88
88
|
|
89
|
-
|
89
|
+
### types
|
90
90
|
|
91
91
|
The `types` matcher tests the service type:
|
92
92
|
|
@@ -94,7 +94,7 @@ The `types` matcher tests the service type:
|
|
94
94
|
|
95
95
|
where `'TYPE'` is `INTERNAL` (for a service provided by xinetd), `RPC` (for a service based on remote procedure call), or `UNLISTED` (for services not under `/etc/services` or `/etc/rpc`).
|
96
96
|
|
97
|
-
|
97
|
+
### wait
|
98
98
|
|
99
99
|
The `wait` matcher tests how a service handles incoming connections.
|
100
100
|
|
@@ -108,11 +108,11 @@ For TCP (`stream`) socket types the `wait` matcher should test for `no`:
|
|
108
108
|
its('socket_types') { should eq 'stream' }
|
109
109
|
its('wait') { should eq 'no' }
|
110
110
|
|
111
|
-
|
111
|
+
## Examples
|
112
112
|
|
113
113
|
The following examples show how to use this InSpec audit resource.
|
114
114
|
|
115
|
-
|
115
|
+
### Test a socket_type
|
116
116
|
|
117
117
|
The network socket type: `dgram` (a datagram-based service), `raw` (a service that requires direct access to an IP address), `stream` (a stream-based service), or `seqpacket` (a service that requires a sequenced packet).
|
118
118
|
|
@@ -120,7 +120,7 @@ The network socket type: `dgram` (a datagram-based service), `raw` (a service th
|
|
120
120
|
its('socket_types') { should include 'dgram' }
|
121
121
|
end
|
122
122
|
|
123
|
-
|
123
|
+
### Test a service type
|
124
124
|
|
125
125
|
The type of service: `INTERNAL` (a service provided by xinetd), `RPC` (an RPC-based service), `TCPMUX` (a service that is started on a well-known TPCMUX port), or `UNLISTED` (a service that is not listed in a standard system file location).
|
126
126
|
|
@@ -128,7 +128,7 @@ The type of service: `INTERNAL` (a service provided by xinetd), `RPC` (an RPC-ba
|
|
128
128
|
its('type') { should include 'RPC' }
|
129
129
|
end
|
130
130
|
|
131
|
-
|
131
|
+
### Test the telnet service
|
132
132
|
|
133
133
|
For example, a `telnet` file under `/etc/xinet.d` contains the following settings:
|
134
134
|
|
data/docs/resources/yaml.md.erb
CHANGED
@@ -6,7 +6,7 @@ title: About the yaml Resource
|
|
6
6
|
|
7
7
|
Use the `yaml` InSpec audit resource to test configuration data in a Yaml file.
|
8
8
|
|
9
|
-
|
9
|
+
## Syntax
|
10
10
|
|
11
11
|
A `yaml` resource block declares the configuration data to be tested. Assume the following Yaml file:
|
12
12
|
|
@@ -28,41 +28,41 @@ where
|
|
28
28
|
* `should eq 'foo'` tests a value of `name` as read from a Yaml file versus the value declared in the test
|
29
29
|
|
30
30
|
|
31
|
-
|
31
|
+
## Matchers
|
32
32
|
|
33
33
|
This InSpec audit resource has the following matchers:
|
34
34
|
|
35
|
-
|
35
|
+
### be
|
36
36
|
|
37
37
|
<%= partial "/shared/matcher_be" %>
|
38
38
|
|
39
|
-
|
39
|
+
### cmp
|
40
40
|
|
41
41
|
<%= partial "/shared/matcher_cmp" %>
|
42
42
|
|
43
|
-
|
43
|
+
### eq
|
44
44
|
|
45
45
|
<%= partial "/shared/matcher_eq" %>
|
46
46
|
|
47
|
-
|
47
|
+
### include
|
48
48
|
|
49
49
|
<%= partial "/shared/matcher_include" %>
|
50
50
|
|
51
|
-
|
51
|
+
### match
|
52
52
|
|
53
53
|
<%= partial "/shared/matcher_match" %>
|
54
54
|
|
55
|
-
|
55
|
+
### name
|
56
56
|
|
57
57
|
The `name` matcher tests the value of `name` as read from a Yaml file versus the value declared in the test:
|
58
58
|
|
59
59
|
its('name') { should eq 'foo' }
|
60
60
|
|
61
|
-
|
61
|
+
## Examples
|
62
62
|
|
63
63
|
The following examples show how to use this InSpec audit resource.
|
64
64
|
|
65
|
-
|
65
|
+
### Test a kitchen.yml file driver
|
66
66
|
|
67
67
|
describe yaml('.kitchen.yaml') do
|
68
68
|
its('driver.name') { should eq('vagrant') }
|