inspec 1.31.0 → 1.45.9

data/docs/resources/registry_key.md.erb

@@ -6,6 +6,8 @@ title: About the registry_key Resource
 
 Use the `registry_key` InSpec audit resource to test key values in the Windows registry.
 
+<br>
+
 ## Syntax
 
 A `registry_key` resource block declares the item in the Windows registry, the path to a setting under that item, and then one (or more) name/value pairs to be tested.
@@ -61,13 +63,34 @@ Please make sure that you use backslashes instead of forward slashes. Forward sl
       its('Release') { should eq 378675 }
     end
 
-## Matchers
+<br>
+
+## Examples
+
+The following examples show how to use this InSpec audit resource.
+
+### Test the start time for the Schedule service
 
-This InSpec audit resource has the following matchers:
+    describe registry_key('Task Scheduler','HKEY_LOCAL_MACHINE\...\Schedule') do
+      its('Start') { should eq 2 }
+    end
 
-### be
+where `'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Schedule'` is the full path to the setting.
 
-<%= partial "/shared/matcher_be" %>
+### Use a regular expression in responses
+
+    describe registry_key({
+      hive: 'HKEY_LOCAL_MACHINE',
+      key: 'SOFTWARE\Microsoft\Windows NT\CurrentVersion'
+    }) do
+      its('ProductName') { should match /^[a-zA-Z0-9\(\)\s]*2012\s[rR]2[a-zA-Z0-9\(\)\s]*$/ }
+    end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
 
 ### children
 
@@ -93,14 +116,6 @@ The following example shows how find a property that may exist against multiple
         end
       }
 
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
 ### exist
 
 The `exist` matcher tests if the registry key is present:
@@ -125,14 +140,6 @@ The `have_value` matcher tests if a value exists for a registry key:
 
     it { should have_value 'value' }
 
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
-
 ### name
 
 The `name` matcher tests the value for the specified registry setting:
@@ -148,25 +155,3 @@ Any name with a dot will not work as expected: <code>its('explorer.exe') { shoul
     # its('explorer.exe') { should eq 'test' }
     # use the following solution:
     it { should have_property_value('explorer.exe', :string, 'test') }
-
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Test the start time for the Schedule service
-
-    describe registry_key('Task Scheduler','HKEY_LOCAL_MACHINE\...\Schedule') do
-      its('Start') { should eq 2 }
-    end
-
-where `'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Schedule'` is the full path to the setting.
-
-### Use a regular expression in responses
-
-    describe registry_key({
-      hive: 'HKEY_LOCAL_MACHINE',
-      key: 'SOFTWARE\Microsoft\Windows NT\CurrentVersion'
-    }) do
-      its('ProductName') { should match /^[a-zA-Z0-9\(\)\s]*2012\s[rR]2[a-zA-Z0-9\(\)\s]*$/ }
-    end

data/docs/resources/runit_service.md.erb

@@ -6,6 +6,8 @@ title: About the runit_service Resource
 
 Use the `runit_service` InSpec audit resource to test a service using runit.
 
+<br>
+
 ## Syntax
 
 A `runit_service` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
@@ -29,13 +31,11 @@ The path to the service manager's control may be specified for situations where
       it { should be_running }
     end
 
-## Matchers
-
-This InSpec audit resource has the following matchers:
+<br>
 
-### be
+## Matchers
 
-<%= partial "/shared/matcher_be" %>
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
 
 ### be_enabled
 
@@ -54,23 +54,3 @@ The `be_installed` matcher tests if the named service is installed:
 The `be_running` matcher tests if the named service is running:
 
     it { should be_running }
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
-
-## Examples
-
-None.

data/docs/resources/security_policy.md.erb

@@ -6,6 +6,8 @@ title: About the security_policy Resource
 
 Use the `security_policy` InSpec audit resource to test security policies on the Windows platform.
 
+<br>
+
 ## Syntax
 
 A `security_policy` resource block declares the name of a security policy and the value to be tested:
@@ -19,43 +21,26 @@ where
 * `'policy_name'` must specify a security policy
 * `{ should eq 'value' }` tests the value of `policy_name` against the value declared in the test
 
+<br>
 
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
+## Examples
 
-### eq
+The following examples show how to use this InSpec audit resource.
 
-<%= partial "/shared/matcher_eq" %>
+### Verify that only the Administrators group has remote access
 
-### include
+    describe security_policy do
+      its('SeRemoteInteractiveLogonRight') { should eq '*S-1-5-32-544' }
+    end
 
-<%= partial "/shared/matcher_include" %>
+<br>
 
-### match
+## Matchers
 
-<%= partial "/shared/matcher_match" %>
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
 
 ### policy_name
 
 The `policy_name` matcher must be the name of a security policy:
 
     its('SeNetworkLogonRight') { should eq '*S-1-5-11' }
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Verify that only the Administrators group has remote access
-
-    describe security_policy do
-      its('SeRemoteInteractiveLogonRight') { should eq '*S-1-5-32-544' }
-    end

data/docs/resources/service.md.erb

@@ -8,6 +8,8 @@ Use the `service` InSpec audit resource to test if the named service is installe
 
 Under some circumstances, it may be necessary to specify the service manager by using one of the following service manager-specific resources: `bsd_service`, `launchd_service`, `runit_service`, `systemd_service`, `sysv_service`, or `upstart_service`. These resources are based on the `service` resource.
 
+<br>
+
 ## Syntax
 
 A `service` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
@@ -23,48 +25,7 @@ where
 * `('service_name')` must specify a service name
 * `be_installed`, `be_enabled`, and `be_running` are valid matchers for this resource
 
-
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### be_enabled
-
-The `be_enabled` matcher tests if the named service is enabled:
-
-    it { should be_enabled }
-
-### be_installed
-
-The `be_installed` matcher tests if the named service is installed:
-
-    it { should be_installed }
-
-### be_running
-
-The `be_running` matcher tests if the named service is running:
-
-    it { should be_running }
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
+<br>
 
 ## Examples
 
@@ -133,3 +94,27 @@ This is also possible with `systemd_service`, `runit_service`, `sysv_service`, `
       it { should be_installed }
       it { should be_running }
     end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### be_enabled
+
+The `be_enabled` matcher tests if the named service is enabled:
+
+    it { should be_enabled }
+
+### be_installed
+
+The `be_installed` matcher tests if the named service is installed:
+
+    it { should be_installed }
+
+### be_running
+
+The `be_running` matcher tests if the named service is running:
+
+    it { should be_running }

data/docs/resources/{etc_shadow.md.erb → shadow.md.erb}

@@ -19,6 +19,8 @@ These entries are defined as a colon-delimited row in the file, one row per user
 
     dannos:Gb7crrO5CDF.:10063:0:99999:7:::
 
+<br>
+
 ## Syntax
 
 A `shadow` resource block declares one (or more) users and associated user information to be tested:
@@ -27,30 +29,56 @@ A `shadow` resource block declares one (or more) users and associated user infor
       its('users') { should_not include 'forbidden_user' }
     end
 
+or with a single query:
+
+    describe shadow.users('root') do
+      its('count') { should eq 1 }
+    end
+
 or with a filter:
 
-    describe shadow.uid(filter) do
-      its('users') { should cmp 'root' }
+    describe shadow.filter(min_days: '0', max_days: '99999') do
       its('count') { should eq 1 }
     end
 
-where
+The following properties are available:
 
-* `homes`, `gids`, `passwords`, `shells`, `uids`, and `users` are valid accessors for `passwd`
-* `filter` one (or more) arguments, for example: `passwd.users(/name/)` used to define filtering; `filter` may take any of the following arguments: `count` (retrieves the number of entries), `lines` (provides raw `passwd` lines), and `params` (returns an array of maps for all entries)
+* `users`
+* `passwords`
+* `last_changes`
+* `min_days`
+* `max_days`
+* `warn_days`
+* `inactive_days`
+* `expiry_date`
+* `reserved`
 
+Properties can be used as a single query or can be joined together with the `.filter` method.
 
-## Matchers
+<br>
 
-This InSpec audit resource has the following matchers:
+## Examples
 
-### be
+The following examples show how to use this InSpec audit resource.
 
-<%= partial "/shared/matcher_be" %>
+### Test for a forbidden user
 
-### cmp
+    describe shadow do
+      its('users') { should_not include 'forbidden_user' }
+    end
 
-<%= partial "/shared/matcher_cmp" %>
+### Test that a user appears one time
+
+    describe shadow.users('bin') do
+      its('passwords') { should cmp 'x' }
+      its('count') { should eq 1 }
+    end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
 
 ### count
 
@@ -58,16 +86,12 @@ The `count` matcher tests the number of times the named user appears in `/etc/sh
 
     its('count') { should eq 1 }
 
-TThis matcher is best used in conjunction with filters. For example:
+This matcher is best used in conjunction with filters. For example:
 
     describe shadow.users('dannos') do
        its('count') { should eq 1 }
     end
 
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
 ### expiry_dates
 
 The `expiry_dates` matcher tests the number of days a user account has been disabled:
@@ -80,20 +104,12 @@ The `inactive_days` matcher tests the number of days a user must be inactive bef
 
     its('inactive_days') { should eq '' }
 
-### include
-
-<%= partial "/shared/matcher_include" %>
-
 ### last_changes
 
 The `last_changes` matcher tests the last time a password was changed:
 
     its('last_changes') { should eq '' }
 
-### match
-
-<%= partial "/shared/matcher_match" %>
-
 ### max_days
 
 The `max_days` matcher tests the maximum number of days after which a password must be changed:
@@ -108,15 +124,10 @@ The `min_days` matcher tests the minimum number of days a password must exist, b
 
 ### passwords
 
-The `passwords` matcher tests if passwords are
-
-* Encrypted
-* Have direct logins disabled, as indicated by an asterisk (`*`)
-* In the `/etc/shadow` file, as indicated by the letter x (`x`)
+The `passwords` matcher returns the encrypted password string from the shadow file. The returned string may not be an encrypted password, but rather a `*` or similar which indicates that direct logins are not allowed.
 
 For example:
 
-    its('passwords') { should eq ['x'] }
     its('passwords') { should cmp '*' }
 
 ### users
@@ -130,20 +141,3 @@ The `users` matcher tests if the user name exists `/etc/shadow`:
 The `warn_days` matcher tests the number of days a user is warned about an expiring password:
 
     its('warn_days') { should eq 7 }
-
-## Examples
-
-The following examples show how to use this InSpec audit resource.
-
-### Test for a forbidden user
-
-    describe shadow do
-      its('users') { should_not include 'forbidden_user' }
-    end
-
-### Test that a user appears one time
-
-    describe shadow.users('bin') do
-      its('passwords') { should cmp 'x' }
-      its('count') { should eq 1 }
-    end

data/docs/resources/ssh_config.md.erb

@@ -6,6 +6,8 @@ title: About the ssh_config Resource
 
 Use the `ssh_config` InSpec audit resource to test OpenSSH client configuration data located at `/etc/ssh/ssh_config` on Linux and Unix platforms.
 
+<br>
+
 ## Syntax
 
 An `ssh_config` resource block declares the client OpenSSH configuration data to be tested:
@@ -20,40 +22,7 @@ where
 * `('path')` is the non-default `/path/to/ssh_config`
 * `{ should include('foo') }` tests the value of `name` as read from `ssh_config` versus the value declared in the test
 
-
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
-
-### name
-
-The `name` matcher tests the value of `name` as read from `ssh_config` versus the value declared in the test:
-
-    its('name') { should eq 'foo' }
-
-or:
-
-    its('name') { should include('bar') }
+<br>
 
 ## Examples
 
@@ -92,3 +61,19 @@ The following examples show how to use this InSpec audit resource.
       its('SendEnv') { should eq 'LANG LC_*' }
       its('HashKnownHosts') { should eq 'yes' }
     end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### name
+
+The `name` matcher tests the value of `name` as read from `ssh_config` versus the value declared in the test:
+
+    its('name') { should eq 'foo' }
+
+or:
+
+    its('name') { should include('bar') }

data/docs/resources/sshd_config.md.erb

@@ -6,6 +6,8 @@ title: About the sshd_config Resource
 
 Use the `sshd_config` InSpec audit resource to test configuration data for the OpenSSH daemon located at `/etc/ssh/sshd_config` on Linux and Unix platforms. sshd---the OpenSSH daemon---listens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command execution, and data exchanges.
 
+<br>
+
 ## Syntax
 
 An `sshd_config` resource block declares the client OpenSSH configuration data to be tested:
@@ -20,40 +22,7 @@ where
 * `('path')` is the non-default `/path/to/sshd_config`
 * `{ should include('foo') }` tests the value of `name` as read from `sshd_config` versus the value declared in the test
 
-
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
-
-### name
-
-The `name` matcher tests the value of `name` as read from `sshd_config` versus the value declared in the test:
-
-    its('name') { should cmp 'foo' }
-
-or:
-
-    its('name') {should include('bar') }
+<br>
 
 ## Examples
 
@@ -95,3 +64,19 @@ The following examples show how to use this InSpec audit resource.
           '/etc/ssh/ssh_host_ecdsa_key',
         ] }
     end
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### name
+
+The `name` matcher tests the value of `name` as read from `sshd_config` versus the value declared in the test:
+
+    its('name') { should cmp 'foo' }
+
+or:
+
+    its('name') {should include('bar') }

data/docs/resources/ssl.md.erb

@@ -6,6 +6,8 @@ title: About the ssl Resource
 
 Use the `ssl` InSpec audit resource to test SSL settings for the named port.
 
+<br>
+
 ## Syntax
 
 An `ssl` resource block declares an SSL port, and then other properties of the test like cipher and/or protocol:
@@ -25,60 +27,7 @@ where
 * `ssl(port: #)` is the port number, such as `ssl(port: 443)`
 * `filter` may take any of the following arguments: `ciphers`, `protocols`, and `handshake`
 
-
-## Matchers
-
-This InSpec audit resource has the following matchers:
-
-### be
-
-<%= partial "/shared/matcher_be" %>
-
-### be_enabled
-
-The `be_enabled` matcher tests if SSL is enabled:
-
-    it { should be_enabled }
-
-### ciphers
-
-The `ciphers` matcher tests the named cipher:
-
-    its('ciphers') { should_not eq '/rc4/i' }
-
-or:
-
-    describe ssl(port: 443).ciphers(/rc4/i) do
-      it { should_not be_enabled }
-    end
-
-### cmp
-
-<%= partial "/shared/matcher_cmp" %>
-
-### eq
-
-<%= partial "/shared/matcher_eq" %>
-
-### include
-
-<%= partial "/shared/matcher_include" %>
-
-### match
-
-<%= partial "/shared/matcher_match" %>
-
-### protocols
-
-The `protocols` matcher tests what protocol versions (SSLv3, TLSv1.1, etc) are enabled:
-
-    its('protocols') { should eq 'ssl2' }
-
-or:
-
-    describe ssl(port: 443).protocols('ssl2') do
-      it { should_not be_enabled }
-    end
+<br>
 
 ## Examples
 
@@ -131,3 +80,39 @@ and then run:
 Or execute the profile directly via URL:
 
     $ inspec exec https://github.com/dev-sec/ssl-benchmark
+
+<br>
+
+## Matchers
+
+This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
+
+### be_enabled
+
+The `be_enabled` matcher tests if SSL is enabled:
+
+    it { should be_enabled }
+
+### ciphers
+
+The `ciphers` matcher tests the named cipher:
+
+    its('ciphers') { should_not eq '/rc4/i' }
+
+or:
+
+    describe ssl(port: 443).ciphers(/rc4/i) do
+      it { should_not be_enabled }
+    end
+
+### protocols
+
+The `protocols` matcher tests what protocol versions (SSLv3, TLSv1.1, etc) are enabled:
+
+    its('protocols') { should eq 'ssl2' }
+
+or:
+
+    describe ssl(port: 443).protocols('ssl2') do
+      it { should_not be_enabled }
+    end