inspec 1.0.0 → 1.35.1

data/docs/resources/bsd_service.md.erb

@@ -6,7 +6,7 @@ title: About the bsd_service Resource
 
 Use the `bsd_service` InSpec audit resource to test a service using a Berkeley OS-style `init` on the FreeBSD platform.
 
-# Syntax
+## Syntax
 
 A `bsd_service` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
 
@@ -29,48 +29,48 @@ The path to the service manager's control may be specified for situations where
       it { should be_running }
     end
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## be_enabled
+### be_enabled
 
 The `be_enabled` matcher tests if the named service is enabled:
 
     it { should be_enabled }
 
-## be_installed
+### be_installed
 
 The `be_installed` matcher tests if the named service is installed:
 
     it { should be_installed }
 
-## be_running
+### be_running
 
 The `be_running` matcher tests if the named service is running:
 
     it { should be_running }
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 None.

data/docs/resources/command.md.erb

@@ -6,7 +6,7 @@ title: About the command Resource
 
 Use the `command` InSpec audit resource to test an arbitrary command that is run on the system.
 
-# Syntax
+## Syntax
 
 A `command` resource block declares a command to be run, one (or more) expected outputs, and the location to which that output is sent:
 
@@ -22,49 +22,49 @@ where
 * `'output'` tests the output of the command run on the system versus the output value stated in the test
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## exist
+### exist
 
 The `exist` matcher tests if a command may be run on the system:
 
     it { should exist }
 
-## exit_status
+### exit_status
 
 The `exit_status` matcher tests the exit status for the command:
 
     its('exit_status') { should eq 123 }
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## stderr
+### stderr
 
 The `stderr` matcher tests results of the command as returned in standard error (stderr):
 
     its('stderr') { should eq 'error' }
 
-## stdout
+### stdout
 
 The `stdout` matcher tests results of the command as returned in standard output (stdout). The following example shows matching output using a regular expression:
 
@@ -72,11 +72,11 @@ The `stdout` matcher tests results of the command as returned in standard output
        its('stdout') { should match (/[0-9]/) }
     end
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test for PostgreSQL database running a RC, development, or beta release
+### Test for PostgreSQL database running a RC, development, or beta release
 
     describe command('psql -V') do
       its('stdout') { should eq '/RC/' }
@@ -84,23 +84,23 @@ The following examples show how to use this InSpec audit resource.
       its('stdout') { should_not eq '/BETA/' }
     end
 
-## Test standard output (stdout)
+### Test standard output (stdout)
 
     describe command('echo hello') do
-      its('stdout') { should eq 'hello\n' }
+      its('stdout') { should eq "hello\n" }
       its('stderr') { should eq '' }
       its('exit_status') { should eq 0 }
     end
 
-## Test standard error (stderr)
+### Test standard error (stderr)
 
     describe command('>&2 echo error') do
       its('stdout') { should eq '' }
-      its('stderr') { should eq 'error\n' }
+      its('stderr') { should eq "error\n" }
       its('exit_status') { should eq 0 }
     end
 
-## Test an exit status code
+### Test an exit status code
 
     describe command('exit 123') do
       its('stdout') { should eq '' }
@@ -108,19 +108,19 @@ The following examples show how to use this InSpec audit resource.
       its('exit_status') { should eq 123 }
     end
 
-## Test if the command shell exists
+### Test if the command shell exists
 
     describe command('/bin/sh').exist? do
       it { should eq true }
     end
 
-## Test for a command that should not exist
+### Test for a command that should not exist
 
     describe command('this is not existing').exist? do
       it { should eq false }
     end
 
-## Verify NTP
+### Verify NTP
 
 The following example shows how to use the `file` audit resource to verify if the `ntp.conf` and `leap-seconds` files are present, and then the `command` resource to verify if NTP is installed and running:
 
@@ -136,7 +136,7 @@ The following example shows how to use the `file` audit resource to verify if th
        its('exit_status') { should eq 0 }
     end
 
-## Verify WiX
+### Verify WiX
 
 Wix includes serveral tools -- such as `candle` (preprocesses and compiles source files into object files), `light` (links and binds object files to an installer database), and `heat` (harvests files from various input formats). The following example uses a whitespace array and the `file` audit resource to verify if these three tools are present:
 
@@ -145,7 +145,7 @@ Wix includes serveral tools -- such as `candle` (preprocesses and compiles sourc
       heat.exe
       light.exe
     ).each do |utility|
-      describe file("C:/wix/#{utility}") do
+      describe file("C:/wix/##{utility}") do
         it { should be_file }
       end
     end

data/docs/resources/crontab.md.erb

@@ -0,0 +1,84 @@
+---
+title: About the crontab Resource
+---
+
+# crontab
+
+Use the `crontab` InSpec audit resource to test the crontab entries for a particular user on the system. It recognizes special time strings (@yearly, @weekly, etc).
+
+## Syntax
+
+A `crontab` resource block declares a user (which defaults to the current user, if not specified), and then the details to be tested, such as the schedule elements for each crontab entry or the commands itself:
+
+    describe crontab do
+      its('commands') { should include '/some/scheduled/task.sh' }
+    end
+
+## Matchers
+
+This InSpec audit resource has the following matchers:
+
+### be
+
+<%= partial "/shared/matcher_be" %>
+
+### cmp
+
+<%= partial "/shared/matcher_cmp" %>
+
+### eq
+
+<%= partial "/shared/matcher_eq" %>
+
+### include
+
+<%= partial "/shared/matcher_include" %>
+
+### match
+
+<%= partial "/shared/matcher_match" %>
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test that root's crontab has a particular command
+
+    describe crontab('root') do
+      its('commands') { should include '/path/to/some/script' }
+    end
+
+### Test that myuser's crontab entry for command '/home/myuser/build.sh' runs every minute
+
+    describe crontab('myuser').commands('/home/myuser/build.sh') do
+      its('hours') { should cmp '*' }
+      its('minutes') { should cmp '*' }
+    end
+
+### Test that the logged-in user's crontab has no tasks set to run on every hour and every minute
+
+    describe crontab.where({'hour' => '*', 'minute' => '*'}) do
+      its('entries.length') { should cmp '0' }
+    end
+
+### Test that the logged-in user's crontab contains a single command that matches a mattern
+
+    describe crontab.where { command =~ /a partial command string/ } do
+      its('entries.length') { should cmp 1 }
+    end
+
+### Test a special time string (i.e., @yearly /root/anual_report.sh)
+
+    describe crontab.commands('/root/anual_report.sh') do
+      its('hours') { should cmp '0' }
+      its('minutes') { should cmp '0' }
+      its('days') { should cmp '1' }
+      its('months') { should cmp '1' }
+    end
+
+### Test @reboot case
+
+    describe crontab.commands('/root/reboot.sh') do
+      its('hours') { should cmp '-1' }
+      its('minutes') { should cmp '-1' }
+    end

data/docs/resources/csv.md.erb

@@ -6,7 +6,7 @@ title: About the csv Resource
 
 Use the `csv` InSpec audit resource to test configuration data in a CSV file.
 
-# Syntax
+## Syntax
 
 A `csv` resource block declares the configuration data to be tested:
 
@@ -21,41 +21,41 @@ where
 * `should eq 'foo'` tests a value of `name` as read from a CSV file versus the value declared in the test
 
 
-# Matchers
+## Matchers
 
 This InSpec audit resource has the following matchers:
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-## name
+### name
 
 The `name` matcher tests the value of `name` as read from a CSV file versus the value declared in the test:
 
     its('name') { should eq 'foo' }
 
-# Examples
+## Examples
 
 The following examples show how to use this InSpec audit resource.
 
-## Test a CSV file
+### Test a CSV file
 
     describe csv('some_file.csv') do
       its('setting') { should eq 1 }

data/docs/resources/dh_params.md

@@ -0,0 +1,191 @@
+---
+title: The dh_params Resource
+---
+
+# dh_params
+
+Use the `dh_params` InSpec audit resource to test Diffie-Hellman (DH) parameters.
+
+
+## Syntax
+
+A `dh_params` resource block declares a parameter file to be tested.
+
+    describe dh_params('/path/to/file.dh_pem') do
+      it { should be_dh_params }
+      it { should be_valid }
+      its('generator') { should eq 2 }
+      its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
+      its('prime_length') { should eq 2048 }
+      its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
+      its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
+    end
+
+
+## Supported Properties
+
+### dh_params?
+
+Verify whether file contains DH parameters:
+
+    describe dh_params('/path/to/file.dh_pem') do
+      it { should be_dh_params }
+    end
+
+### valid?
+
+Verify whether DH parameters are valid:
+
+    describe dh_params('/path/to/file.dh_pem') do
+      it { should be_valid }
+    end
+
+### generator (Integer)
+
+Verify generator used for the Diffie-Hellman operation:
+
+    describe dh_params('/path/to/file.dh_pem') do
+      its('generator') { should eq 2 }
+    end
+
+### modulus (String)
+
+Verify prime modulus used for the Diffie-Hellman operation:
+
+    describe dh_params('/path/to/file.dh_pem') do
+      its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
+    end
+
+Example using multi-line string:
+
+    describe dh_params('/path/to/file.dh_pem') do
+      its('modulus') do
+        # regex removes all whitespace
+        should eq <<-EOF.gsub(/[[:space:]]+/, '')
+          00:91:a0:15:89:e5:bc:38:93:12:02:fc:91:a2:85:
+          f7:f7:29:63:2e:d3:4e:7a:86:f7:ee:84:fe:42:d0:
+          48:bc:9c:91:d5:54:f8:78:1d:c0:41:78:a2:c4:ac:
+          1a:24:8b:9d:88:55:98:0b:ac:a7:23:eb:c2:aa:2b:
+          2e:a9:f9:af:d4:8e:4e:11:bc:7f:35:a2:ac:da:3a:
+          ef:f0:25:6c:9a:a4:fd:00:28:76:86:2c:57:87:67:
+          30:5d:b1:d6:5b:22:8f:72:a1:ea:de:8b:ef:9e:33:
+          1a:40:92:68:85:02:54:02:09:fa:c0:60:c1:3c:4e:
+          28:26:db:ed:25:8e:38:21:56:40:dc:c0:c0:66:1f:
+          2b:32:c3:b4:78:a9:26:94:ea:f7:41:28:b2:f5:5b:
+          01:38:0c:46:09:85:26:4d:69:12:8d:95:0f:35:e2:
+          e6:4e:47:3a:86:dd:8a:b2:fe:45:15:27:d8:59:c2:
+          3c:f4:62:ff:5f:74:e9:77:92:50:47:36:2b:05:57:
+          60:ee:7b:a1:60:cc:1c:7a:2b:77:18:8a:37:f7:c7:
+          31:3e:15:cb:15:7f:7b:66:96:fb:c6:be:7d:d6:03:
+          5e:0d:60:75:2b:5b:62:2a:a3:37:b6:34:f9:fe:96:
+          4c:f6:c5:e3:a1:52:af:01:c1:4f:c7:42:a0:be:ed:
+          cd:13
+        EOF
+      end
+    end
+
+### prime_length (Integer)
+
+Verify length of prime modulus used for the Diffie-Hellman operation:
+
+    describe dh_params('/path/to/file.dh_pem') do
+      its('prime_length') { should eq 2048 }
+    end
+
+### pem (String)
+
+Verify `pem` output of DH parameters:
+
+    describe dh_params('/path/to/file.dh_pem') do
+      its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
+    end
+
+Example using multi-line string:
+
+    its('pem') do
+      # regex removes all leading spaces
+      should eq <<-EOF.gsub(/^[[:blank:]]+/, '')
+        -----BEGIN DH PARAMETERS-----
+        MIIBCAKCAQEAkaAVieW8OJMSAvyRooX39yljLtNOeob37oT+QtBIvJyR1VT4eB3A
+        QXiixKwaJIudiFWYC6ynI+vCqisuqfmv1I5OEbx/NaKs2jrv8CVsmqT9ACh2hixX
+        h2cwXbHWWyKPcqHq3ovvnjMaQJJohQJUAgn6wGDBPE4oJtvtJY44IVZA3MDAZh8r
+        MsO0eKkmlOr3QSiy9VsBOAxGCYUmTWkSjZUPNeLmTkc6ht2Ksv5FFSfYWcI89GL/
+        X3Tpd5JQRzYrBVdg7nuhYMwceit3GIo398cxPhXLFX97Zpb7xr591gNeDWB1K1ti
+        KqM3tjT5/pZM9sXjoVKvAcFPx0Kgvu3NEwIBAg==
+        -----END DH PARAMETERS-----
+      EOF
+    end
+
+Verify via `openssl dhparam` command:
+
+    $ openssl dhparam -in /path/to/file.dh_pem
+    -----BEGIN DH PARAMETERS-----
+    MIIBCAKCAQEAkaAVieW8OJMSAvyRooX39yljLtNOeob37oT+QtBIvJyR1VT4eB3A
+    QXiixKwaJIudiFWYC6ynI+vCqisuqfmv1I5OEbx/NaKs2jrv8CVsmqT9ACh2hixX
+    h2cwXbHWWyKPcqHq3ovvnjMaQJJohQJUAgn6wGDBPE4oJtvtJY44IVZA3MDAZh8r
+    MsO0eKkmlOr3QSiy9VsBOAxGCYUmTWkSjZUPNeLmTkc6ht2Ksv5FFSfYWcI89GL/
+    X3Tpd5JQRzYrBVdg7nuhYMwceit3GIo398cxPhXLFX97Zpb7xr591gNeDWB1K1ti
+    KqM3tjT5/pZM9sXjoVKvAcFPx0Kgvu3NEwIBAg==
+    -----END DH PARAMETERS-----
+
+### text (String)
+
+Verify human-readable text output of DH parameters:
+
+    describe dh_params('/path/to/file.dh_pem') do
+      its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
+    end
+
+Example using multi-line string:
+
+    its('text') do
+      # regex removes 2 leading spaces
+      should eq <<-EOF.gsub(/^[[:blank:]]{2}/, '')
+        PKCS#3 DH Parameters: (2048 bit)
+            prime:
+                00:91:a0:15:89:e5:bc:38:93:12:02:fc:91:a2:85:
+                f7:f7:29:63:2e:d3:4e:7a:86:f7:ee:84:fe:42:d0:
+                48:bc:9c:91:d5:54:f8:78:1d:c0:41:78:a2:c4:ac:
+                1a:24:8b:9d:88:55:98:0b:ac:a7:23:eb:c2:aa:2b:
+                2e:a9:f9:af:d4:8e:4e:11:bc:7f:35:a2:ac:da:3a:
+                ef:f0:25:6c:9a:a4:fd:00:28:76:86:2c:57:87:67:
+                30:5d:b1:d6:5b:22:8f:72:a1:ea:de:8b:ef:9e:33:
+                1a:40:92:68:85:02:54:02:09:fa:c0:60:c1:3c:4e:
+                28:26:db:ed:25:8e:38:21:56:40:dc:c0:c0:66:1f:
+                2b:32:c3:b4:78:a9:26:94:ea:f7:41:28:b2:f5:5b:
+                01:38:0c:46:09:85:26:4d:69:12:8d:95:0f:35:e2:
+                e6:4e:47:3a:86:dd:8a:b2:fe:45:15:27:d8:59:c2:
+                3c:f4:62:ff:5f:74:e9:77:92:50:47:36:2b:05:57:
+                60:ee:7b:a1:60:cc:1c:7a:2b:77:18:8a:37:f7:c7:
+                31:3e:15:cb:15:7f:7b:66:96:fb:c6:be:7d:d6:03:
+                5e:0d:60:75:2b:5b:62:2a:a3:37:b6:34:f9:fe:96:
+                4c:f6:c5:e3:a1:52:af:01:c1:4f:c7:42:a0:be:ed:
+                cd:13
+            generator: 2 (0x2)
+        EOF
+    end
+
+Verify via `openssl dhparam` command:
+
+    $ openssl dhparam -in /path/to/file.dh_pem -noout -text
+    PKCS#3 DH Parameters: (2048 bit)
+        prime:
+            00:91:a0:15:89:e5:bc:38:93:12:02:fc:91:a2:85:
+            f7:f7:29:63:2e:d3:4e:7a:86:f7:ee:84:fe:42:d0:
+            48:bc:9c:91:d5:54:f8:78:1d:c0:41:78:a2:c4:ac:
+            1a:24:8b:9d:88:55:98:0b:ac:a7:23:eb:c2:aa:2b:
+            2e:a9:f9:af:d4:8e:4e:11:bc:7f:35:a2:ac:da:3a:
+            ef:f0:25:6c:9a:a4:fd:00:28:76:86:2c:57:87:67:
+            30:5d:b1:d6:5b:22:8f:72:a1:ea:de:8b:ef:9e:33:
+            1a:40:92:68:85:02:54:02:09:fa:c0:60:c1:3c:4e:
+            28:26:db:ed:25:8e:38:21:56:40:dc:c0:c0:66:1f:
+            2b:32:c3:b4:78:a9:26:94:ea:f7:41:28:b2:f5:5b:
+            01:38:0c:46:09:85:26:4d:69:12:8d:95:0f:35:e2:
+            e6:4e:47:3a:86:dd:8a:b2:fe:45:15:27:d8:59:c2:
+            3c:f4:62:ff:5f:74:e9:77:92:50:47:36:2b:05:57:
+            60:ee:7b:a1:60:cc:1c:7a:2b:77:18:8a:37:f7:c7:
+            31:3e:15:cb:15:7f:7b:66:96:fb:c6:be:7d:d6:03:
+            5e:0d:60:75:2b:5b:62:2a:a3:37:b6:34:f9:fe:96:
+            4c:f6:c5:e3:a1:52:af:01:c1:4f:c7:42:a0:be:ed:
+            cd:13
+        generator: 2 (0x2)

data/docs/resources/directory.md.erb

@@ -6,7 +6,7 @@ title: About the directory Resource
 
 Use the `directory` InSpec audit resource to test if the file type is a directory. This is equivalent to using the `file` resource and the `be_directory` matcher, but provides a simpler and more direct way to test directories. All of the matchers available to `file` may be used with `directory`.
 
-# Syntax
+## Syntax
 
 A `directory` resource block declares the location of the directory to be tested, and then one (or more) matchers:
 
@@ -14,30 +14,30 @@ A `directory` resource block declares the location of the directory to be tested
       it { should MATCHER 'value' }
     end
 
-# Matchers
+## Matchers
 
 This resource may use any of the matchers available to the `file` resource that may be useful when testing a directory.
 
-## be
+### be
 
 <%= partial "/shared/matcher_be" %>
 
-## cmp
+### cmp
 
 <%= partial "/shared/matcher_cmp" %>
 
-## eq
+### eq
 
 <%= partial "/shared/matcher_eq" %>
 
-## include
+### include
 
 <%= partial "/shared/matcher_include" %>
 
-## match
+### match
 
 <%= partial "/shared/matcher_match" %>
 
-# Examples
+## Examples
 
 None.