inspec 1.0.0 → 1.35.1

data/docs/resources/iptables.md.erb

@@ -6,7 +6,7 @@ title: About the iptables Resource
 
 Use the `iptables` InSpec audit resource to test rules that are defined in `iptables`, which maintains tables of IP packet filtering rules. There may be more than one table. Each table contains one (or more) chains (both built-in and custom). A chain is a list of rules that match packets. When the rule matches, the rule defines what target to assign to the packet.
 
-# Syntax
+## Syntax
 
 A `iptables` resource block declares tests for rules in IP tables:
 
@@ -20,51 +20,58 @@ where
 * `rule:'name'` is the name of a rule that matches a set of packets
 * `table:'name'` is the packet matching table against which the test is run
 * `chain: 'name'` is the name of a user-defined chain or one of `ACCEPT`, `DROP`, `QUEUE`, or `RETURN`
-* `have_rule('RULE')` tests that rule in the iptables file
+* `have_rule('RULE')` tests that rule in the iptables list. This must match the entire line taken from `iptables -S CHAIN`.
 
-
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## have_rule
+### have_rule
 
 The `have_rule` matcher tests the named rule against the information in the `iptables` file:
 
     it { should have_rule('RULE') }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test if the IP table allows a packet through
+### Test if the INPUT chain is in default ACCEPT mode
 
     describe iptables do
       it { should have_rule('-P INPUT ACCEPT') }
     end
 
-## Test if the IP table allows a packet through, for a specific table and chain
+### Test if the INPUT chain from the mangle table is in ACCEPT mode
 
-    describe iptables(table:'mangle', chain: 'input') do
+    describe iptables(table:'mangle', chain: 'INPUT') do
       it { should have_rule('-P INPUT ACCEPT') }
     end
+
+### Test if there is a rule allowing Postgres (5432/TCP) traffic
+
+    describe iptables do
+      it { should have_rule('-A INPUT -p tcp -m tcp -m multiport --dports 5432 -m comment --comment "postgres" -j ACCEPT') }
+    end
+
+Note that the rule specification must exactly match what's in the output of `iptables -S INPUT`, which will depend on how you've built your rules.

data/docs/resources/json.md.erb

@@ -6,7 +6,7 @@ title: About the json Resource
 
 Use the `json` InSpec audit resource to test data in a JSON file.
 
-# Syntax
+## Syntax
 
 A `json` resource block declares the data to be tested. Assume the following JSON file:
 
@@ -23,7 +23,7 @@ A `json` resource block declares the data to be tested. Assume the following JSO
 
 This file can be queried using:
 
-    describe json('/paht/to/name.json') do
+    describe json('/path/to/name.json') do
       its('name') { should eq 'hello' }
       its(['meta','creator']) { should eq 'John Doe' }
       its(['array', 1]) { should eq 'one' }
@@ -35,41 +35,41 @@ where
 * `should eq 'foo'` tests a value of `name` as read from a JSON file versus the value declared in the test
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## name
+### name
 
 The `name` matcher tests the value of `name` as read from a JSON file versus the value declared in the test:
 
     its('name') { should eq 'foo' }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test a cookbook version in a policyfile.lock.json file
+### Test a cookbook version in a policyfile.lock.json file
 
     describe json('policyfile.lock.json') do
       its(['cookbook_locks', 'omnibus', 'version']) { should eq('2.2.0') }

data/docs/resources/kernel_module.md.erb

@@ -4,57 +4,118 @@ title: About the kernel_module Resource
 
 # kernel_module
 
-Use the `kernel_module` InSpec audit resource to test kernel modules on Linux platforms. These parameters are located under `/lib/modules`. Any submodule may be tested using this resource.
+Use the `kernel_module` InSpec audit resource to test kernel modules on Linux
+platforms. These parameters are located under `/lib/modules`. Any submodule may
+be tested using this resource.
 
-# Syntax
+The `kernel_module` resource can also verify if a kernel module is `blacklisted`
+or if a module is disabled via a fake install using the `bin_true` or `bin_false`
+method.
 
-A `kernel_module` resource block declares a module name, and then tests if that module is a loadable kernel module:
+## Syntax
+
+A `kernel_module` resource block declares a module name, and then tests if that
+module is a loadable kernel module, if it is enabled, disabled or if it is
+blacklisted:
 
     describe kernel_module('module_name') do
       it { should be_loaded }
+      it { should_not be_disabled }
+      it { should_not be_blacklisted }
+    end
     end
 
 where
 
 * `'module_name'` must specify a kernel module, such as `'bridge'`
 * `{ should be_loaded }` tests if the module is a loadable kernel module
+* `{ should be_blacklisted }` tests if the module is blacklisted or if the module is disabled via a fake install using /bin/false or /bin/true
+* `{ should be_disabled }` tests if the module is disabled via a fake install using /bin/false or /bin/true
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## be_loaded
+### be_loaded
 
 The `be_loaded` matcher tests if the module is a loadable kernel module:
 
     it { should be_loaded }
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+### version
+
+The `version` matcher tests if the named module version is on the system:
+
+    its(:version) { should eq '3.2.2' }
+
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test if a module is loaded
+    ### Test a modules 'version'
 
     describe kernel_module('bridge') do
       it { should be_loaded }
+      its(:version) { should cmp >= '2.2.2' }
+    end
+
+    ### Test if a module is loaded, not disabled and not blacklisted
+
+    describe kernel_module('video') do
+      it { should be_loaded }
+      it { should_not be_disabled }
+      it { should_not be_blacklisted }
+    end
+
+    ### Check if a module is blacklisted
+
+    describe kernel_module('floppy') do
+      it { should be_blacklisted }
+    end
+
+    ### Ensure a module is *not* blacklisted and it is loaded
+
+    describe kernel_module('video') do
+      it { should_not be_blacklisted }
+      it { should be_loaded }
+    end
+
+    ### Ensure a module is disabled via 'bin_false'
+
+    describe kernel_module('sstfb') do
+      it { should_not be_loaded }
+      it { should be_disabled }
+    end
+
+    ### Ensure a module is 'blacklisted'/'disabled' via 'bin_true'
+
+    describe kernel_module('nvidiafb') do
+      it { should_not be_loaded }
+      it { should be_blacklisted }
+    end
+
+    ### Ensure a module is not loaded
+
+    describe kernel_module('dhcp') do
+      it { should_not be_loaded }
     end

data/docs/resources/kernel_parameter.md.erb

@@ -6,7 +6,7 @@ title: About the kernel_parameter Resource
 
 Use the `kernel_parameter` InSpec audit resource to test kernel parameters on Linux platforms.
 
-# Syntax
+## Syntax
 
 A `kernel_parameter` resource block declares a parameter and then a value to be tested:
 
@@ -19,53 +19,53 @@ where
 * `'kernel.parameter'` must specify a kernel parameter, such as `'net.ipv4.conf.all.forwarding'`
 * `{ should eq 0 }` states the value to be tested
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## value
+### value
 
 The `value` matcher tests the value assigned to the named IP address versus the value declared in the test:
 
     its('value') { should eq 0 }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test if global forwarding is enabled for an IPv4 address
+### Test if global forwarding is enabled for an IPv4 address
 
     describe kernel_parameter('net.ipv4.conf.all.forwarding') do
       its('value') { should eq 1 }
     end
 
-## Test if global forwarding is disabled for an IPv6 address
+### Test if global forwarding is disabled for an IPv6 address
 
     describe kernel_parameter('net.ipv6.conf.all.forwarding') do
       its('value') { should eq 0 }
     end
 
-## Test if an IPv6 address accepts redirects
+### Test if an IPv6 address accepts redirects
 
     describe kernel_parameter('net.ipv6.conf.interface.accept_redirects') do
       its('value') { should eq 'true' }

data/docs/resources/key_rsa.md.erb

@@ -0,0 +1,70 @@
+---
+title: The key_rsa Resource
+---
+
+# key_rsa
+
+Use the `key_rsa` InSpec audit resource to test RSA public/private keypairs.
+
+This resource is mainly useful when used in conjunction with the x509_certificate resource but it can also be used for checking SSH keys.
+
+
+## Syntax
+
+An `key_rsa` resource block declares a `key file` to be tested.
+
+    describe key_rsa('mycertificate.key') do
+      it { should be_private }
+      it { should be_public }
+      its('public_key') { should match "-----BEGIN PUBLIC KEY-----\n3597459df9f3982" }
+      its('key_length') { should eq 2048 }
+    end
+
+You can use an optional passphrase with `key_rsa`
+
+    describe key_rsa('mycertificate.key', 'passphrase') do
+      it { should be_private }
+    end
+
+## Supported Properties
+
+### public?
+
+To verify if a key is public use the following:
+
+    describe key_rsa('/etc/pki/www.mywebsite.com.key') do
+      it { should be_public }
+    end
+
+### public_key (String)
+
+The `public_key` property returns the public part of the RSA key pair
+
+    describe key_rsa('/etc/pki/www.mywebsite.com.key') do
+      its('public_key') { should match "-----BEGIN PUBLIC KEY-----\n3597459df9f3982......" }
+    end
+
+### private?
+
+This property verifies that the key includes a private key:
+
+    describe key_rsa('/etc/pki/www.mywebsite.com.key') do
+      it { should be_private }
+    end
+
+
+### private_key (String)
+
+The `private_key` property returns the private key or the RSA key pair.
+
+    describe key_rsa('/etc/pki/www.mywebsite.com.key') do
+      its('private_key') { should match "-----BEGIN RSA PRIVATE KEY-----\nMIIJJwIBAAK......" }
+    end
+
+### key_length
+
+The `key_length` property allows testing the number of bits in the key pair.
+
+    describe key_rsa('/etc/pki/www.mywebsite.com.key') do
+      its('key_length') { should eq 2048 }
+    end

data/docs/resources/launchd_service.md.erb

@@ -6,7 +6,7 @@ title: About the launchd_service Resource
 
 Use the ``launchd_service`` InSpec audit resource to test a service using Launchd.
 
-# Syntax
+## Syntax
 
 A ``launchd_service`` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
 
@@ -29,48 +29,48 @@ The path to the service manager's control may be specified for situations where
       it { should be_running }
     end
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## be_enabled
+### be_enabled
 
 The `be_enabled` matcher tests if the named service is enabled:
 
     it { should be_enabled }
 
-## be_installed
+### be_installed
 
 The `be_installed` matcher tests if the named service is installed:
 
     it { should be_installed }
 
-## be_running
+### be_running
 
 The `be_running` matcher tests if the named service is running:
 
     it { should be_running }
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 None.

data/docs/resources/limits_conf.md.erb

@@ -17,7 +17,7 @@ Entries in the `limits.conf` file are similar to:
     ^^^^^^^^^   ^^^^   ^^^^^^   ^^^^^
     domain      type    item    value
 
-# Syntax
+## Syntax
 
 A `limits_conf` resource block declares a domain to be tested, along with associated type, item, and value:
 
@@ -34,19 +34,19 @@ where
 * `'item'` is the item for which limits are defined, such as `core`, `nofile`, `stack`, `nproc`, `priority`, or `maxlogins`
 * `'value'` is the value associated with the `item`
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## domain
+### domain
 
 The `domain` matcher tests the domain in the `limits.conf` file, along with associated type, item, and value:
 
@@ -56,23 +56,23 @@ For example:
 
     its('grantmc') { should include ['hard', 'nofile', '63536'] }
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test limits
+### Test limits
 
     describe limits_conf('path') do
       its('*') { should include ['soft', 'core', '0'], ['hard', 'rss', '10000'] }

data/docs/resources/login_def.md.erb

@@ -6,7 +6,7 @@ title: About the login_defs Resource
 
 Use the `login_defs` InSpec audit resource to test configuration settings in the `/etc/login.defs` file. The `logins.defs` file defines site-specific configuration for the shadow password suite on Linux and Unix platforms, such as password expiration ranges, minimum/maximum values for automatic selection of user and group identifiers, or the method with which passwords are encrypted.
 
-# Syntax
+## Syntax
 
 A `login_defs` resource block declares the `login.defs` configuration data to be tested:
 
@@ -20,41 +20,41 @@ where
 * `{ should include('foo') }` tests the value of `name` as read from `login.defs` versus the value declared in the test
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## name
+### name
 
 The `name` matcher tests the value of `name` as read from `login.defs` versus the value declared in the test:
 
     its('name') { should eq 'foo' }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test password expiration settings
+### Test password expiration settings
 
     describe login_defs do
       its('PASS_MAX_DAYS') { should eq '180' }
@@ -63,13 +63,13 @@ The following examples show how to use this InSpec audit resource.
       its('PASS_WARN_AGE') { should eq '30' }
     end
 
-## Test the encryption method
+### Test the encryption method
 
     describe login_defs do
       its('ENCRYPT_METHOD') { should eq 'SHA512' }
     end
 
-## Test umask setting
+### Test umask setting
 
     describe login_def do
       its('UMASK') { should eq '077' }