inspec 1.0.0 → 1.35.1

data/docs/resources/{etc_shadow.md.erb → shadow.md.erb}

@@ -19,7 +19,7 @@ These entries are defined as a colon-delimited row in the file, one row per user
 
     dannos:Gb7crrO5CDF.:10063:0:99999:7:::
 
-# Syntax
+## Syntax
 
 A `shadow` resource block declares one (or more) users and associated user information to be tested:
 
@@ -40,19 +40,19 @@ where
 * `filter` one (or more) arguments, for example: `passwd.users(/name/)` used to define filtering; `filter` may take any of the following arguments: `count` (retrieves the number of entries), `lines` (provides raw `passwd` lines), and `params` (returns an array of maps for all entries)
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## count
+### count
 
 The `count` matcher tests the number of times the named user appears in `/etc/shadow`:
 
@@ -64,49 +64,49 @@ TThis matcher is best used in conjunction with filters. For example:
        its('count') { should eq 1 }
     end
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## expiry_dates
+### expiry_dates
 
 The `expiry_dates` matcher tests the number of days a user account has been disabled:
 
     its('expiry_dates') { should eq '' }
 
-## inactive_days
+### inactive_days
 
 The `inactive_days` matcher tests the number of days a user must be inactive before the user account is disabled:
 
     its('inactive_days') { should eq '' }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## last_changes
+### last_changes
 
 The `last_changes` matcher tests the last time a password was changed:
 
     its('last_changes') { should eq '' }
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## max_days
+### max_days
 
 The `max_days` matcher tests the maximum number of days after which a password must be changed:
 
     its('max_days') { should eq 90 }
 
-## min_days
+### min_days
 
 The `min_days` matcher tests the minimum number of days a password must exist, before it may be changed:
 
     its('min_days') { should eq 0 }
 
-## passwords
+### passwords
 
 The `passwords` matcher tests if passwords are
 
@@ -119,29 +119,29 @@ For example:
     its('passwords') { should eq ['x'] }
     its('passwords') { should cmp '*' }
 
-## users
+### users
 
 The `users` matcher tests if the user name exists `/etc/shadow`:
 
     its('users') { should eq 'root' }
 
-## warn_days
+### warn_days
 
 The `warn_days` matcher tests the number of days a user is warned about an expiring password:
 
     its('warn_days') { should eq 7 }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test for a forbidden user
+### Test for a forbidden user
 
     describe shadow do
       its('users') { should_not include 'forbidden_user' }
     end
 
-## Test that a user appears one time
+### Test that a user appears one time
 
     describe shadow.users('bin') do
       its('passwords') { should cmp 'x' }

data/docs/resources/ssh_config.md.erb

@@ -6,7 +6,7 @@ title: About the ssh_config Resource
 
 Use the `ssh_config` InSpec audit resource to test OpenSSH client configuration data located at `/etc/ssh/ssh_config` on Linux and Unix platforms.
 
-# Syntax
+## Syntax
 
 An `ssh_config` resource block declares the client OpenSSH configuration data to be tested:
 
@@ -21,31 +21,31 @@ where
 * `{ should include('foo') }` tests the value of `name` as read from `ssh_config` versus the value declared in the test
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## name
+### name
 
 The `name` matcher tests the value of `name` as read from `ssh_config` versus the value declared in the test:
 
@@ -55,11 +55,11 @@ or:
 
     its('name') { should include('bar') }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test SSH configuration settings
+### Test SSH configuration settings
 
     describe ssh_config do
       its('cipher') { should contain '3des' }
@@ -67,7 +67,7 @@ The following examples show how to use this InSpec audit resource.
       its('hostname') { should include('example.com') }
     end
 
-## Test which variables from the local environment are sent to the server
+### Test which variables from the local environment are sent to the server
 
     only_if do
       command('sshd').exist? or command('ssh').exists?
@@ -77,14 +77,14 @@ The following examples show how to use this InSpec audit resource.
       its('SendEnv') { should include('GORDON_CLIENT') }
     end
 
-## Test owner and group permissions
+### Test owner and group permissions
 
     describe ssh_config do
       its('owner') { should eq 'root' }
       its('mode') { should cmp '0644' }
     end
 
-## Test SSH configuration
+### Test SSH configuration
 
     describe ssh_config do
       its('Host') { should eq '*' }

data/docs/resources/sshd_config.md.erb

@@ -4,9 +4,9 @@ title: About the sshd_config Resource
 
 # sshd_config
 
-Use the `sshd_config` InSpec audit resource to test configuration data for the OpenSSH daemon located at `/etc/ssh/sshd_config` on Linux and Unix platforms. sshd---the OpenSSH daemon---listens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command executation, and data exchanges.
+Use the `sshd_config` InSpec audit resource to test configuration data for the OpenSSH daemon located at `/etc/ssh/sshd_config` on Linux and Unix platforms. sshd---the OpenSSH daemon---listens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command execution, and data exchanges.
 
-# Syntax
+## Syntax
 
 An `sshd_config` resource block declares the client OpenSSH configuration data to be tested:
 
@@ -21,31 +21,31 @@ where
 * `{ should include('foo') }` tests the value of `name` as read from `sshd_config` versus the value declared in the test
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## name
+### name
 
 The `name` matcher tests the value of `name` as read from `sshd_config` versus the value declared in the test:
 
@@ -55,35 +55,35 @@ or:
 
     its('name') {should include('bar') }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test which variables may be sent to the server
+### Test which variables may be sent to the server
 
     describe sshd_config do
       its('AcceptEnv') { should include('GORDON_SERVER') }
     end
 
-## Test for IPv6-only addresses
+### Test for IPv6-only addresses
 
     describe sshd_config do
       its('AddressFamily') { should cmp 'inet6' }
     end
 
-## Test the Protocol setting
+### Test the Protocol setting
 
     describe sshd_config do
       its('Protocol') { should cmp 2 }
     end
 
-## Test for approved, strong ciphers
+### Test for approved, strong ciphers
 
     describe sshd_config do
       its('Ciphers') { should cmp('chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr') }
     end
 
-## Test SSH protocols
+### Test SSH protocols
 
     describe sshd_config do
       its('Port') { should cmp  22 }

data/docs/resources/ssl.md.erb

@@ -6,7 +6,7 @@ title: About the ssl Resource
 
 Use the `ssl` InSpec audit resource to test SSL settings for the named port.
 
-# Syntax
+## Syntax
 
 An `ssl` resource block declares an SSL port, and then other properties of the test like cipher and/or protocol:
 
@@ -26,21 +26,21 @@ where
 * `filter` may take any of the following arguments: `ciphers`, `protocols`, and `handshake`
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## be_enabled
+### be_enabled
 
 The `be_enabled` matcher tests if SSL is enabled:
 
     it { should be_enabled }
 
-## ciphers
+### ciphers
 
 The `ciphers` matcher tests the named cipher:
 
@@ -52,25 +52,25 @@ or:
       it { should_not be_enabled }
     end
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## protocols
+### protocols
 
-The `protocols` matcher tests the number of times the named user appears in `/etc/shadow`:
+The `protocols` matcher tests what protocol versions (SSLv3, TLSv1.1, etc) are enabled:
 
     its('protocols') { should eq 'ssl2' }
 
@@ -80,11 +80,11 @@ or:
       it { should_not be_enabled }
     end
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Run the ssl-benchmark example profile
+### Run the ssl-benchmark example profile
 
 The following shows how to use the `ssl` InSpec audit resource to find all TCP ports on the system, including IPv4 and IPv6. (This is a partial example based on the `ssl_text.rb` file in the `ssl-benchmark` profile on GitHub.)
 

data/docs/resources/sys_info.md.erb

@@ -6,7 +6,7 @@ title: About the sys_info Resource
 
 Use the `sys_info` InSpec audit resource to test for operating system properties for the named host, and then returns that info as standard output.
 
-# Syntax
+## Syntax
 
 An `sys_info` resource block declares the hostname to be tested:
 
@@ -14,41 +14,41 @@ An `sys_info` resource block declares the hostname to be tested:
       its('hostname') { should eq 'value' }
     end
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## hostname
+### hostname
 
 The `hostname` matcher tests the host for which standard output is returned:
 
     its('hostname') { should eq 'value' }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Get system information for example.com
+### Get system information for example.com
 
     describe sys_info do
       its('hostname') { should eq 'example.com' }

data/docs/resources/systemd_service.md.erb

@@ -6,7 +6,7 @@ title: About the systemd_service Resource
 
 Use the `systemd_service` InSpec audit resource to test a service using SystemD.
 
-# Syntax
+## Syntax
 
 A `systemd_service` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
 
@@ -29,48 +29,48 @@ The path to the service manager's control may be specified for situations where
       it { should be_running }
     end
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## be_enabled
+### be_enabled
 
 The `be_enabled` matcher tests if the named service is enabled:
 
     it { should be_enabled }
 
-## be_installed
+### be_installed
 
 The `be_installed` matcher tests if the named service is installed:
 
     it { should be_installed }
 
-## be_running
+### be_running
 
 The `be_running` matcher tests if the named service is running:
 
     it { should be_running }
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 None.

data/docs/resources/sysv_service.md.erb

@@ -6,7 +6,7 @@ title: About the sysv_service Resource
 
 Use the `sysv_service` InSpec audit resource to test a service using SystemV.
 
-# Syntax
+## Syntax
 
 A `sysv_service` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
 
@@ -29,48 +29,48 @@ The path to the service manager's control may be specified for situations where
       it { should be_running }
     end
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## be_enabled
+### be_enabled
 
 The `be_enabled` matcher tests if the named service is enabled:
 
     it { should be_enabled }
 
-## be_installed
+### be_installed
 
 The `be_installed` matcher tests if the named service is installed:
 
     it { should be_installed }
 
-## be_running
+### be_running
 
 The `be_running` matcher tests if the named service is running:
 
     it { should be_running }
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 None.

data/docs/resources/upstart_service.md.erb

@@ -6,7 +6,7 @@ title: About the upstart_service Resource
 
 Use the `upstart_service` InSpec audit resource to test a service using Upstart.
 
-# Syntax
+## Syntax
 
 An `upstart_service` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
 
@@ -29,48 +29,48 @@ The path to the service manager's control may be specified for situations where
       it { should be_running }
     end
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## be_enabled
+### be_enabled
 
 The `be_enabled` matcher tests if the named service is enabled:
 
     it { should be_enabled }
 
-## be_installed
+### be_installed
 
 The `be_installed` matcher tests if the named service is installed:
 
     it { should be_installed }
 
-## be_running
+### be_running
 
 The `be_running` matcher tests if the named service is running:
 
     it { should be_running }
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 None.