inspec 1.0.0 → 1.35.1

data/docs/resources/port.md.erb

@@ -6,7 +6,7 @@ title: About the port Resource
 
 Use the `port` InSpec audit resource to test basic port properties, such as port, process, if it's listening.
 
-# Syntax
+## Syntax
 
 A `port` resource block declares a port, and then depending on what needs to be tested, a process, protocol, process identifier, and its state (is it listening?):
 
@@ -35,55 +35,55 @@ For example, to test if the SSH daemon is available on a Linux machine via the d
       its('addresses') { should include '0.0.0.0' }
     end
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## address
+### address
 
 The `addresses` matcher tests if the specified address is associated with a port:
 
     its('addresses') { should include '0.0.0.0' }
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## be_listening
+### be_listening
 
 The `be_listening` matcher tests if the port is listening for traffic:
 
     it { should be_listening }
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## pids
+### pids
 
 The `pids` matcher tests the process identifiers (PIDs):
 
-    its('pids') { should eq ['27808'] }
+    its('pids') { should cmp 27808 }
 
-## processes
+### processes
 
 The `processes` matcher tests if the named process is running on the system:
 
-    its('processes') { should eq ['syslog'] }
+    its('processes') { should cmp 'syslog' }
 
-## protocols
+### protocols
 
 The `protocols` matcher tests the Internet protocol: ICMP (`'icmp'`), TCP (`'tcp'` or `'tcp6'`), or UDP (`'udp'` or `'udp6'`):
 
@@ -93,18 +93,18 @@ or for the IPv6 protocol:
 
     its('protocols') { should include 'tcp6' }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test port 80, listening with the TCP protocol
+### Test port 80, listening with the TCP protocol
 
     describe port(80) do
       it { should be_listening }
-      its('protocols') {should eq ['tcp']}
+      its('protocols') { should cmp 'tcp' }
     end
 
-## Test port 80, on a specific address
+### Test port 80, on a specific address
 
 A specific port address may be checked using either of the following examples:
 
@@ -119,14 +119,14 @@ or:
       it { should be_listening }
     end
 
-## Test port 80, listening with TCP version IPv6 protocol
+### Test port 80, listening with TCP version IPv6 protocol
 
     describe port(80) do
       it { should be_listening }
-      its('protocols') {should eq ['tcp6']}
+      its('protocols') { should cmp 'tcp6' }
     end
 
-## Test that only secure ports accept requests
+### Test that only secure ports accept requests
 
     describe port(80) do
       it { should_not be_listening }
@@ -134,10 +134,10 @@ or:
 
     describe port(443) do
       it { should be_listening }
-      its('protocols') {should eq ['tcp']}
+      its('protocols') { should cmp 'tcp' }
     end
 
-## Verify port 65432 is not listening
+### Verify port 65432 is not listening
 
     describe port(22) do
       it { should be_listening }

data/docs/resources/postgres_conf.md.erb

@@ -6,7 +6,7 @@ title: About the postgres_conf Resource
 
 Use the `postgres_conf` InSpec audit resource to test the contents of the configuration file for PostgreSQL, typically located at `/etc/postgresql/<version>/main/postgresql.conf` or `/var/lib/postgres/data/postgresql.conf`, depending on the platform.
 
-# Syntax
+## Syntax
 
 A `postgres_conf` resource block declares one (or more) settings in the `postgresql.conf` file, and then compares the setting in the configuration file to the value stated in the test:
 
@@ -14,37 +14,38 @@ A `postgres_conf` resource block declares one (or more) settings in the `postgre
       its('setting') { should eq 'value' }
     end
 
+
 where
 
 * `'setting'` specifies a setting in the `postgresql.conf` file
 * `('path')` is the non-default path to the `postgresql.conf` file (optional)
 * `should eq 'value'` is the value that is expected
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## setting
+### setting
 
 The `setting` matcher tests specific, named settings in the `postgresql.conf` file:
 
@@ -52,17 +53,17 @@ The `setting` matcher tests specific, named settings in the `postgresql.conf` fi
 
 Use a `setting` matcher for each setting to be tested.
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test the maximum number of allowed client connections
+### Test the maximum number of allowed client connections
 
     describe postgres_conf do
       its('max_connections') { should eq '5' }
     end
 
-## Test system logging
+### Test system logging
 
     describe postgres_conf do
       its('logging_collector') { should eq 'on' }
@@ -71,15 +72,16 @@ The following examples show how to use this InSpec audit resource.
       its('log_duration') { should eq 'on' }
       its('log_hostname') { should eq 'on' }
       its('log_line_prefix') { should eq '%t %u %d %h' }
+      its(['pgaudit.log_parameter']) { should cmp 'on' }
     end
 
-## Test the port on which PostgreSQL listens
+### Test the port on which PostgreSQL listens
 
     describe postgres_conf do
       its('port') { should eq '5432' }
     end
 
-## Test the Unix socket settings
+### Test the Unix socket settings
 
     describe postgres_conf do
       its('unix_socket_directories') { should eq '.s.PGSQL.5432' }

data/docs/resources/postgres_hba_conf.md.erb

@@ -0,0 +1,104 @@
+---
+title: About the postgres_hba_conf Resource
+---
+
+# postgres_hba_conf
+
+Use the `postgres_hba_conf` InSpec audit resource to test the client authentication data defined in the pg_hba.conf file.
+## Syntax
+
+An `postgres_hba_conf` InSpec audit resource block declares client authentication data that should be tested:
+
+    describe postgres_hba_conf.where { type == 'local' } do
+     its('auth_method') { should eq ['peer'] }
+    end
+
+where
+
+* `'attribute'` is a attribute in the  pg hba configuration file
+* `'filter_value'` is the value that is to be filtered for
+* `'value'` is the value that is to be matched expected
+
+## Matchers
+
+This InSpec audit resource matches any service that is listed in the HBA configuration file:
+
+    its('auth_method') { should_not cmp 'peer' }
+
+or:
+
+    its('auth_method') { should cmp 'peer' }
+
+For example:
+
+    describe postgres_hba_conf.where { type == 'type' } do
+      its('auth_method') { should cmp 'value' }
+      its('user') { should cmp 'value' }
+    end
+
+### be
+
+<%= partial "/shared/matcher_be" %>
+
+### cmp
+
+<%= partial "/shared/matcher_cmp" %>
+
+### eq
+
+<%= partial "/shared/matcher_eq" %>
+
+### include
+
+<%= partial "/shared/matcher_include" %>
+
+### match
+
+<%= partial "/shared/matcher_match" %>
+
+
+## Supported Properties
+
+    'address', 'auth_method', 'auth_params', 'conf_dir' , 'conf_file' , 'database', 'params' ,'type', 'user'
+
+## Property Examples and Return Types
+
+### address([String])
+
+`address` returns a an array of strings that matches the where condition of the filter table
+
+    describe postgres_hba_conf.where { type == 'local' } do
+      its('address') { should cmp 'value' }
+    end
+    
+### auth_method([String])
+
+`auth_method` returns a an array of strings that matches the where condition of the filter table
+
+    describe postgres_hba_conf.where { type == 'local' } do
+      its('auth_method') { should cmp 'value' }
+    end
+
+### database([String])
+
+`database` returns a an array of strings that matches the where condition of the filter table
+
+    describe postgres_hba_conf.where { type == 'local' } do
+      its('database') { should cmp 'value' }
+    end
+
+### type([String])
+
+`type` returns a an array of strings that matches the where condition of the filter table
+
+    describe postgres_hba_conf.where { database == 'acme_test_db' } do
+      its('type') { should cmp 'value' }
+    end
+
+### user([String])
+
+`user` returns a an array of strings that matches the where condition of the filter table
+
+    describe postgres_hba_conf.where { database == 'acme_test_db' } do
+      its('user') { should cmp 'value' }
+    end

data/docs/resources/postgres_ident_conf.md.erb

@@ -0,0 +1,87 @@
+---
+title: About the postgres_ident_conf Resource
+---
+
+# postgres_ident_conf
+
+Use the `postgres_ident_conf` InSpec audit resource to test the client authentication data defined in the pg_hba.conf file.
+## Syntax
+
+An `postgres_ident_conf` InSpec audit resource block declares client authentication data that should be tested:
+
+    describe postgres_ident_conf.where { pg_username == 'filter_value' } do
+      its('attribute') { should eq ['value'] }
+    end
+
+where
+
+* `'attribute'` is a attribute in the  pg ident configuration file
+* `'filter_value'` is the value that is to be filtered for
+* `'value'` is the value that is to be matched expected
+
+## Matchers
+
+This InSpec audit resource matches any service that is listed in the pg ident  configuration file:
+
+    its('pg_username') { should_not eq ['peer'] }
+
+or:
+
+    its('map_name') { should eq ['value'] }
+
+For example:
+
+    describe postgres_ident_conf.where { pg_username == 'name' } do
+      its('system_username') { should eq ['value'] }
+      its('map_name') { should eq ['value'] }
+    end
+
+### be
+
+<%= partial "/shared/matcher_be" %>
+
+### cmp
+
+<%= partial "/shared/matcher_cmp" %>
+
+### eq
+
+<%= partial "/shared/matcher_eq" %>
+
+### include
+
+<%= partial "/shared/matcher_include" %>
+
+### match
+
+<%= partial "/shared/matcher_match" %>
+
+
+## Supported Properties
+
+    'conf_file', 'map_name', 'params', 'pg_username', 'system_username'
+
+## Property Examples and Return Types
+
+### map_name([String])
+
+`address` returns a an array of strings that matches the where condition of the filter table
+
+    describe pg_hba_conf.where { pg_username == 'name' } do
+      its('map_name') { should eq ['value'] }
+    end
+### pg_username([String])
+
+`pg_username` returns a an array of strings that matches the where condition of the filter table
+
+    describe pg_hba_conf.where { pg_username == 'name' } do
+      its('pg_username') { should eq ['value'] }
+    end
+
+### system_username([String])
+
+`system_username` returns a an array of strings that matches the where condition of the filter table
+
+    describe pg_hba_conf.where { pg_username == 'name' } do
+      its('system_username') { should eq ['value'] }
+    end

data/docs/resources/postgres_session.md.erb

@@ -6,70 +6,77 @@ title: About the postgres_session Resource
 
 Use the `postgres_session` InSpec audit resource to test SQL commands run against a PostgreSQL database.
 
-# Syntax
+## Syntax
 
 A `postgres_session` resource block declares the username and password to use for the session, and then the command to be run:
 
-    sql = postgres_session('username', 'password')
+    # Create a PostgreSQL session:
+    sql = postgres_session('username', 'password', 'host')
 
+    # default values:
+    #   username: 'postgres'
+    #   host: 'localhost'
+
+    # Run an SQL query with an optional database to execute
+    sql.query('sql_query', ['database_name'])`
+
+A full example is:
+
+    sql = postgres_session('username', 'password', 'host')
     describe sql.query('SELECT * FROM pg_shadow WHERE passwd IS NULL;') do
-      its('output') { should eq('') }
+      its('output') { should eq '' }
     end
 
-where
-
-* `sql = postgres_session` declares a username and password with permission to run the query
-* `sql.query('')` contains the query to be run
-* `its('output') { should eq('') }` compares the results of the query against the expected result in the test
+where `its('output') { should eq '' }` compares the results of the query against the expected result in the test
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## output
+### output
 
 The `output` matcher tests the results of the query:
 
     its('output') { should eq(/^0/) }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test the PostgreSQL shadow password
+### Test the PostgreSQL shadow password
 
-    sql = postgres_session('my_user', 'password')
+    sql = postgres_session('my_user', 'password', '192.168.1.2')
 
-    describe sql.query('SELECT * FROM pg_shadow WHERE passwd IS NULL;') do
+    describe sql.query('SELECT * FROM pg_shadow WHERE passwd IS NULL;', ['testdb']) do
       its('output') { should eq('') }
     end
 
-## Test for risky database entries
+### Test for risky database entries
 
     describe postgres_session('my_user', 'password').query('SELECT count (*)
                   FROM pg_language
                   WHERE lanpltrusted = \'f\'
                   AND lanname!=\'internal\'
-                  AND lanname!=\'c\';') do
+                  AND lanname!=\'c\';', ['postgres']) do
       its('output') { should eq '0' }
     end

data/docs/resources/powershell.md.erb

@@ -6,7 +6,7 @@ title: About the powershell Resource
 
 Use the `powershell` InSpec audit resource to test a Powershell script on the Windows platform.
 
-# Syntax
+## Syntax
 
 A `powershell` resource block declares a Powershell script to be tested, and then compares the output of that command to the matcher in the test:
 
@@ -14,7 +14,7 @@ A `powershell` resource block declares a Powershell script to be tested, and the
       # a PowerShell script
     EOH
 
-    describe script(script) do
+    describe powershell(script) do
       its('matcher') { should eq 'output' }
     end
 
@@ -25,53 +25,53 @@ where
 * `'output'` tests the output of the command run on the system versus the output value stated in the test
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## exit_status
+### exit_status
 
 The `exit_status` matcher tests the exit status for the command:
 
     its('exit_status') { should eq 123 }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## stderr
+### stderr
 
 The `stderr` matcher tests results of the command as returned in standard error (stderr):
 
     its('stderr') { should eq 'error' }
 
-## stdout
+### stdout
 
 The `stdout` matcher tests results of the command as returned in standard output (stdout):
 
     its('stdout') { should eq '/^1$/' }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Get all groups of Administrator user
+### Get all groups of Administrator user
 
     script = <<-EOH
       # find user
@@ -85,7 +85,7 @@ The following examples show how to use this InSpec audit resource.
       its('stdout') { should_not eq '' }
     end
 
-## Write-Output 'hello'
+### Write-Output 'hello'
 
 The following Powershell script: