inspec 1.0.0 → 1.35.1

data/docs/resources/user.md.erb

@@ -6,7 +6,7 @@ title: About the user Resource
 
 Use the `user` InSpec audit resource to test user profiles for a single, known/expected local user, including the groups to which that user belongs, the frequency of required password changes, and the directory paths to home and shell.
 
-# Syntax
+## Syntax
 
 A `user` resource block declares a user name, and then one (or more) matchers:
 
@@ -29,29 +29,29 @@ where
 * `it { should exist }` tests if the user exists
 * `gid`, `group`, `groups`, `home`, `maxdays`, `mindays`, `shell`, `uid`, and `warndays` are valid matchers for this resource
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## exist
+### exist
 
 The `exist` matcher tests if the named user exists:
 
     it { should exist }
 
-## gid
+### gid
 
 The `gid` matcher tests the group identifier:
 
@@ -59,7 +59,7 @@ The `gid` matcher tests the group identifier:
 
 where `1234` represents the user identifier.
 
-## group
+### group
 
 The `group` matcher tests the group to which the user belongs:
 
@@ -67,27 +67,27 @@ The `group` matcher tests the group to which the user belongs:
 
 where `root` represents the group.
 
-## groups
+### groups
 
 The `groups` matcher tests two (or more) groups to which the user belongs:
 
     its('groups') { should eq ['root', 'other']}
 
-## home
+### home
 
 The `home` matcher tests the home directory path for the user:
 
     its('home') { should eq '/root' }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## maxdays
+### maxdays
 
 The `maxdays` matcher tests the maximum number of days between password changes:
 
@@ -95,7 +95,7 @@ The `maxdays` matcher tests the maximum number of days between password changes:
 
 where `99` represents the maximum number of days.
 
-## mindays
+### mindays
 
 The `mindays` matcher tests the minimum number of days between password changes:
 
@@ -103,13 +103,13 @@ The `mindays` matcher tests the minimum number of days between password changes:
 
 where `0` represents the maximum number of days.
 
-## shell
+### shell
 
 The `shell` matcher tests the path to the default shell for the user:
 
     its('shell') { should eq '/bin/bash' }
 
-## uid
+### uid
 
 The `uid` matcher tests the user identifier:
 
@@ -117,7 +117,7 @@ The `uid` matcher tests the user identifier:
 
 where `1234` represents the user identifier.
 
-## warndays
+### warndays
 
 The `warndays` matcher tests the number of days a user is warned before a password must be changed:
 
@@ -125,11 +125,11 @@ The `warndays` matcher tests the number of days a user is warned before a passwo
 
 where `5` represents the number of days a user is warned.
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Verify available users for the MySQL server
+### Verify available users for the MySQL server
 
     describe user('root') do
       it { should exist }
@@ -142,7 +142,7 @@ The following examples show how to use this InSpec audit resource.
      it { should_not exist }
     end
 
-## Test users on multiple platforms
+### Test users on multiple platforms
 
 The `nginx` user is typically `www-data`, but on CentOS it's `nginx`. The following example shows how to test for the `nginx` user with a single test, but accounting for all platforms:
 

data/docs/resources/users.md.erb

@@ -6,7 +6,7 @@ title: About the users Resource
 
 Use the `users` InSpec audit resource to look up all local users available on the system, and then test specific properties of those users. This resource does not return information about users that may be located on other systems, such as LDAP or Active Directory.
 
-# Syntax
+## Syntax
 
 A `users` resource block declares a user name, and then one (or more) matchers:
 
@@ -33,29 +33,29 @@ or:
       it { should exist }
     end
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## exist
+### exist
 
 The `exist` matcher tests if the named user exists:
 
     it { should exist }
 
-## gid
+### gid
 
 The `gid` matcher tests the group identifier:
 
@@ -63,7 +63,7 @@ The `gid` matcher tests the group identifier:
 
 where `1234` represents the user identifier.
 
-## group
+### group
 
 The `group` matcher tests the group to which the user belongs:
 
@@ -71,27 +71,27 @@ The `group` matcher tests the group to which the user belongs:
 
 where `root` represents the group.
 
-## groups
+### groups
 
 The `groups` matcher tests two (or more) groups to which the user belongs:
 
     its('groups') { should eq ['root', 'other']}
 
-## home
+### home
 
 The `home` matcher tests the home directory path for the user:
 
     its('home') { should eq '/root' }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## maxdays
+### maxdays
 
 The `maxdays` matcher tests the maximum number of days between password changes:
 
@@ -99,7 +99,7 @@ The `maxdays` matcher tests the maximum number of days between password changes:
 
 where `99` represents the maximum number of days.
 
-## mindays
+### mindays
 
 The `mindays` matcher tests the minimum number of days between password changes:
 
@@ -107,13 +107,13 @@ The `mindays` matcher tests the minimum number of days between password changes:
 
 where `0` represents the maximum number of days.
 
-## shell
+### shell
 
 The `shell` matcher tests the path to the default shell for the user:
 
     its('shell') { should eq '/bin/bash' }
 
-## uid
+### uid
 
 The `uid` matcher tests the user identifier:
 
@@ -121,7 +121,7 @@ The `uid` matcher tests the user identifier:
 
 where `1234` represents the user identifier.
 
-## warndays
+### warndays
 
 The `warndays` matcher tests the number of days a user is warned before a password must be changed:
 
@@ -129,11 +129,11 @@ The `warndays` matcher tests the number of days a user is warned before a passwo
 
 where `5` represents the number of days a user is warned.
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Use a regular expression to find users
+### Use a regular expression to find users
 
     describe users.where { uid =~ /S\-1\-5\-21\-\d+\-\d+\-\d+\-500/ } do
       it { should exist }

data/docs/resources/vbscript.md.erb

@@ -6,11 +6,11 @@ title: About the vbscript Resource
 
 Use the `vbscript` InSpec audit resource to test a VBScript on the Windows platform.
 
-# Syntax
+## Syntax
 
 A `vbscript` resource block tests the output of a VBScript on the Windows platform:
 
-    describe vbscript('script_name') do
+    describe vbscript('script contents') do
       its('stdout') { should eq 'output' }
     end
 
@@ -20,50 +20,50 @@ where
 * `('output')` is the expected output of the VBScript
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test a VBScript
+### Test a VBScript
 
 A VBScript file similar to:
 
-    vbscript = <<-EOH
+    script = <<-EOH
       WScript.Echo "hello"
     EOH
 
 may be tested for multiple lines:
 
-    describe vbscript(vbscript) do
+    describe vbscript(script) do
       its('stdout') { should eq "hello\r\n" }
     end
 
 and tested for whitespace removal from standard output:
 
-    describe vbscript(vbscript) do
+    describe vbscript(script) do
       its('strip') { should eq "hello" }
     end

data/docs/resources/virtualization.md.erb

@@ -0,0 +1,71 @@
+---
+title: About the virtualization Resource
+---
+
+# virtualization
+
+Use the `virtualization` InSpec audit resource to test the virtualization platform on which the system is running.
+
+## Syntax
+
+An `virtualization` resource block declares the virtualization platform that should be tested:
+
+    describe virtualization do
+      its('system') { should MATCHER 'value' }
+    end
+
+where
+
+* `('system')` is the name of the system information of the virtualization platform (e.g. docker, lxc, vbox, kvm, etc)
+* `MATCHER` is a valid matcher for this resource
+* `'value'` is the value to be tested
+
+## Matchers
+
+This InSpec audit resource has the following matchers:
+
+### be
+
+<%= partial "/shared/matcher_be" %>
+
+### cmp
+
+<%= partial "/shared/matcher_cmp" %>
+
+### eq
+
+<%= partial "/shared/matcher_eq" %>
+
+### include
+
+<%= partial "/shared/matcher_include" %>
+
+### match
+
+<%= partial "/shared/matcher_match" %>
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test for Docker
+
+    describe virtualization do
+      its('system') { should eq 'docker' }
+    end
+
+### Test for VirtualBox
+
+    describe virtualization do
+      its('system') { should eq 'vbox' }
+      its('role') { should eq 'guest' }
+    end
+
+### Detect the virtualization platform
+
+    if virtualization.system == 'vbox'
+      describe package('name') do
+        it { should be_installed }
+      end
+    end
+

data/docs/resources/windows_feature.md.erb

@@ -6,7 +6,7 @@ title: About the windows_feature Resource
 
 Use the `windows_feature` InSpec audit resource to test features on Windows via the `Get-WindowsFeature` cmdlet.
 
-# Syntax
+## Syntax
 
 A `windows_feature` resource block declares the name of the Windows feature, tests if that feature is installed, and then returns information about that feature:
 
@@ -20,41 +20,41 @@ where
 * `be_installed` is a valid matcher for this resource
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## be_installed
+### be_installed
 
 The `be_installed` matcher tests if the named Windows feature is installed:
 
     it { should be_installed }
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test the DHCP Server feature
+### Test the DHCP Server feature
 
     describe windows_feature('DHCP Server') do
       it{ should be_installed }

data/docs/resources/windows_task.md.erb

@@ -0,0 +1,103 @@
+---
+title: About the windows_task Resource
+---
+
+# windows_task
+
+Use the `windows_task` Inspec audit resource to test a scheduled tasks configuration on a Windows platform. 
+Microsoft and application vendors use scheduled tasks to perform a variety of system maintaince tasks but system administrators can schedule their own.
+
+## Syntax
+
+A `windows_task` resource block declares the name of the task (as its full path) and tests its configuration:
+
+    describe windows_task('task name uri') do
+      its('parameter') { should eq 'value' }
+      it { should be_enabled }
+    end
+
+where
+
+* `'parameter'` must be a valid parameter defined within this resource  ie `logon_mode`, `last_result`, `task_to_run`, `run_as_user` 
+* `'value'` will be used to compare the value gather from your chosen parameter
+* `'be_enabled'` is an example of a valid matcher that checks the state of a task, other examples are `exist` or `be_disabled` 
+
+## Matchers
+
+This InSpec audit resource has the following matchers:
+
+### be
+
+<%= partial "/shared/matcher_be" %>
+
+### cmp
+
+<%= partial "/shared/matcher_cmp" %>
+
+### eq
+
+<%= partial "/shared/matcher_eq" %>
+
+### include
+
+<%= partial "/shared/matcher_include" %>
+
+### match
+
+<%= partial "/shared/matcher_match" %>
+
+## Examples
+
+The following examples show how to use this InSpec resource.
+
+### Test's that a task is enabled
+```
+describe windows_task('\Microsoft\Windows\Time Synchronization\SynchronizeTime') do
+  it { should be_enabled }
+end
+```
+
+### Test's that a task is disabled
+```
+describe windows_task('\Microsoft\Windows\AppID\PolicyConverter') do
+  it { should be_disabled }
+end
+```
+
+### Test's the configuration parameters of a task
+```
+describe windows_task('\Microsoft\Windows\AppID\PolicyConverter') do
+  its('logon_mode') { should eq 'Interactive/Background' }
+  its('last_result') { should eq '1' }
+  its('task_to_run') { should cmp '%Windir%\system32\appidpolicyconverter.exe' }
+  its('run_as_user') { should eq 'LOCAL SERVICE' }
+end
+```
+
+### Test's that a task is defined
+```
+describe windows_task('\Microsoft\Windows\Defrag\ScheduledDefrag') do
+  it { should exist }
+end
+```
+
+## Gathering Tasknames
+Rather then use the GUI you can use the `schtasks.exe` to output a full list of tasks available on the system
+
+`schtasks /query /FO list`
+
+rather than use the `list` output you can use `CSV` if it is easier.
+
+Please make sure you use the full TaskName (include the prefix `\`) within your control
+
+```
+C:\>schtasks /query /FO list
+...
+Folder: \Microsoft\Windows\Diagnosis
+HostName:      XPS15
+TaskName:      \Microsoft\Windows\Diagnosis\Scheduled
+Next Run Time: N/A
+Status:        Ready
+Logon Mode:    Interactive/Background
+...
+```

data/docs/resources/wmi.md.erb

@@ -6,7 +6,7 @@ title: About the wmi Resource
 
 Use the `wmi` InSpec audit resource to test WMI settings on the Windows platform.
 
-# Syntax
+## Syntax
 
 A `wmi` resource block tests WMI settings on the Windows platform:
 
@@ -47,35 +47,35 @@ and the second uses a filter in the Ruby Hash to first identify WinRM, and then
     end
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test a password expiration policy
+### Test a password expiration policy
 
     describe wmi({
       class: 'RSOP_SecuritySettingNumeric',
@@ -85,7 +85,7 @@ The following examples show how to use this InSpec audit resource.
        its('Setting') { should eq 1 }
     end
 
-## Test if an anonymous user can query the Local Security Authority (LSA)
+### Test if an anonymous user can query the Local Security Authority (LSA)
 
     describe wmi({
       namespace: 'root\rsop\computer',