inspec 1.40.0 → 1.41.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (114) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +30 -9
  3. data/docs/matchers.md +18 -0
  4. data/docs/plugin_kitchen_inspec.md +18 -24
  5. data/docs/profiles.md +39 -2
  6. data/docs/resources/aide_conf.md.erb +18 -28
  7. data/docs/resources/apache_conf.md.erb +19 -33
  8. data/docs/resources/apt.md.erb +22 -36
  9. data/docs/resources/audit_policy.md.erb +9 -24
  10. data/docs/resources/auditd.md.erb +9 -24
  11. data/docs/resources/auditd_conf.md.erb +20 -34
  12. data/docs/resources/auditd_rules.md.erb +8 -24
  13. data/docs/resources/bash.md.erb +4 -26
  14. data/docs/resources/bond.md.erb +25 -40
  15. data/docs/resources/bridge.md.erb +5 -25
  16. data/docs/resources/bsd_service.md.erb +5 -25
  17. data/docs/resources/command.md.erb +35 -50
  18. data/docs/resources/crontab.md.erb +9 -23
  19. data/docs/resources/csv.md.erb +12 -27
  20. data/docs/resources/dh_params.md +1 -0
  21. data/docs/resources/directory.md.erb +5 -25
  22. data/docs/resources/docker.md.erb +60 -57
  23. data/docs/resources/docker_container.md.erb +23 -19
  24. data/docs/resources/docker_image.md.erb +20 -16
  25. data/docs/resources/etc_fstab.md.erb +5 -2
  26. data/docs/resources/etc_group.md.erb +29 -45
  27. data/docs/resources/etc_hosts.md.erb +6 -0
  28. data/docs/resources/etc_hosts_allow.md.erb +6 -2
  29. data/docs/resources/etc_hosts_deny.md.erb +6 -2
  30. data/docs/resources/file.md.erb +198 -212
  31. data/docs/resources/firewalld.md.erb +7 -1
  32. data/docs/resources/gem.md.erb +21 -35
  33. data/docs/resources/group.md.erb +16 -30
  34. data/docs/resources/grub_conf.md.erb +9 -24
  35. data/docs/resources/host.md.erb +32 -49
  36. data/docs/resources/http.md.erb +38 -44
  37. data/docs/resources/iis_app.md.erb +25 -35
  38. data/docs/resources/iis_site.md.erb +26 -40
  39. data/docs/resources/inetd_conf.md.erb +27 -42
  40. data/docs/resources/ini.md.erb +9 -23
  41. data/docs/resources/interface.md.erb +5 -25
  42. data/docs/resources/iptables.md.erb +15 -29
  43. data/docs/resources/json.md.erb +12 -27
  44. data/docs/resources/kernel_module.md.erb +47 -61
  45. data/docs/resources/kernel_parameter.md.erb +15 -29
  46. data/docs/resources/key_rsa.md.erb +3 -0
  47. data/docs/resources/launchd_service.md.erb +5 -25
  48. data/docs/resources/limits_conf.md.erb +15 -29
  49. data/docs/resources/login_def.md.erb +15 -30
  50. data/docs/resources/mount.md.erb +18 -33
  51. data/docs/resources/mssql_session.md.erb +9 -12
  52. data/docs/resources/mysql_conf.md.erb +17 -32
  53. data/docs/resources/mysql_session.md.erb +15 -29
  54. data/docs/resources/nginx.md.erb +6 -0
  55. data/docs/resources/nginx_conf.md.erb +25 -20
  56. data/docs/resources/npm.md.erb +19 -35
  57. data/docs/resources/ntp_conf.md.erb +20 -37
  58. data/docs/resources/oneget.md.erb +15 -30
  59. data/docs/resources/oracledb_session.md.erb +9 -11
  60. data/docs/resources/os.md.erb +29 -43
  61. data/docs/resources/os_env.md.erb +29 -44
  62. data/docs/resources/package.md.erb +33 -42
  63. data/docs/resources/parse_config.md.erb +5 -25
  64. data/docs/resources/parse_config_file.md.erb +31 -43
  65. data/docs/resources/passwd.md.erb +24 -39
  66. data/docs/resources/pip.md.erb +20 -35
  67. data/docs/resources/port.md.erb +43 -57
  68. data/docs/resources/postgres_conf.md.erb +17 -31
  69. data/docs/resources/postgres_hba_conf.md.erb +26 -38
  70. data/docs/resources/postgres_ident_conf.md.erb +25 -37
  71. data/docs/resources/postgres_session.md.erb +15 -29
  72. data/docs/resources/powershell.md.erb +27 -42
  73. data/docs/resources/processes.md.erb +17 -33
  74. data/docs/resources/rabbitmq_config.md.erb +9 -24
  75. data/docs/resources/registry_key.md.erb +27 -42
  76. data/docs/resources/runit_service.md.erb +5 -25
  77. data/docs/resources/security_policy.md.erb +12 -27
  78. data/docs/resources/service.md.erb +27 -42
  79. data/docs/resources/shadow.md.erb +20 -35
  80. data/docs/resources/ssh_config.md.erb +19 -34
  81. data/docs/resources/sshd_config.md.erb +19 -34
  82. data/docs/resources/ssl.md.erb +39 -54
  83. data/docs/resources/sys_info.md.erb +12 -26
  84. data/docs/resources/systemd_service.md.erb +5 -25
  85. data/docs/resources/sysv_service.md.erb +5 -25
  86. data/docs/resources/upstart_service.md.erb +5 -25
  87. data/docs/resources/user.md.erb +29 -44
  88. data/docs/resources/users.md.erb +12 -26
  89. data/docs/resources/vbscript.md.erb +9 -24
  90. data/docs/resources/virtualization.md.erb +8 -23
  91. data/docs/resources/windows_feature.md.erb +15 -30
  92. data/docs/resources/windows_hotfix.md.erb +15 -9
  93. data/docs/resources/windows_task.md.erb +12 -26
  94. data/docs/resources/wmi.md.erb +9 -24
  95. data/docs/resources/x509_certificate.md.erb +4 -0
  96. data/docs/resources/xinetd_conf.md.erb +65 -80
  97. data/docs/resources/xml.md.erb +12 -26
  98. data/docs/resources/yaml.md.erb +12 -27
  99. data/docs/resources/yum.md.erb +37 -51
  100. data/docs/resources/zfs_dataset.md.erb +15 -26
  101. data/docs/resources/zfs_pool.md.erb +9 -20
  102. data/lib/inspec/backend.rb +8 -0
  103. data/lib/inspec/profile.rb +9 -1
  104. data/lib/inspec/shell.rb +13 -13
  105. data/lib/inspec/version.rb +1 -1
  106. data/lib/matchers/matchers.rb +2 -0
  107. data/lib/resources/etc_hosts.rb +1 -1
  108. data/lib/resources/host.rb +4 -1
  109. data/lib/resources/http.rb +173 -23
  110. data/lib/resources/processes.rb +106 -20
  111. data/lib/resources/ssh_conf.rb +1 -1
  112. data/lib/resources/ssl.rb +4 -3
  113. data/lib/utils/object_traversal.rb +35 -10
  114. metadata +2 -2
@@ -6,6 +6,8 @@ title: About the pip Resource
6
6
 
7
7
  Use the `pip` InSpec audit resource to test packages that are installed using the Python PIP installer.
8
8
 
9
+ <br>
10
+
9
11
  ## Syntax
10
12
 
11
13
  A `pip` resource block declares a package and (optionally) a package version:
@@ -19,56 +21,39 @@ where
19
21
  * `'package_name'` is the name of the package, such as `'Jinja2'`
20
22
  * `be_installed` tests to see if the package described above is installed
21
23
 
24
+ <br>
22
25
 
23
- ## Matchers
24
-
25
- This InSpec audit resource has the following matchers:
26
-
27
- ### be
28
-
29
- <%= partial "/shared/matcher_be" %>
26
+ ## Examples
30
27
 
31
- ### be_installed
28
+ The following examples show how to use this InSpec audit resource.
32
29
 
33
- The `be_installed` matcher tests if the named package is installed on the system:
30
+ ### Test if Jinja2 is installed on the system
34
31
 
35
- it { should be_installed }
32
+ describe pip('Jinja2') do
33
+ it { should be_installed }
34
+ end
36
35
 
37
- ### cmp
36
+ ### Test if Jinja2 2.8 is installed on the system
38
37
 
39
- <%= partial "/shared/matcher_cmp" %>
38
+ describe pip('Jinja2') do
39
+ it { should be_installed }
40
+ its('version') { should eq '2.8' }
41
+ end
40
42
 
41
- ### eq
43
+ <br>
42
44
 
43
- <%= partial "/shared/matcher_eq" %>
45
+ ## Matchers
44
46
 
45
- ### include
47
+ This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
46
48
 
47
- <%= partial "/shared/matcher_include" %>
49
+ ### be_installed
48
50
 
49
- ### match
51
+ The `be_installed` matcher tests if the named package is installed on the system:
50
52
 
51
- <%= partial "/shared/matcher_match" %>
53
+ it { should be_installed }
52
54
 
53
55
  ### version
54
56
 
55
57
  The `version` matcher tests if the named package version is on the system:
56
58
 
57
59
  its('version') { should eq '1.2.3' }
58
-
59
- ## Examples
60
-
61
- The following examples show how to use this InSpec audit resource.
62
-
63
- ### Test if Jinja2 is installed on the system
64
-
65
- describe pip('Jinja2') do
66
- it { should be_installed }
67
- end
68
-
69
- ### Test if Jinja2 2.8 is installed on the system
70
-
71
- describe pip('Jinja2') do
72
- it { should be_installed }
73
- its('version') { should eq '2.8' }
74
- end
@@ -6,6 +6,8 @@ title: About the port Resource
6
6
 
7
7
  Use the `port` InSpec audit resource to test basic port properties, such as port, process, if it's listening.
8
8
 
9
+ <br>
10
+
9
11
  ## Syntax
10
12
 
11
13
  A `port` resource block declares a port, and then depending on what needs to be tested, a process, protocol, process identifier, and its state (is it listening?):
@@ -35,63 +37,7 @@ For example, to test if the SSH daemon is available on a Linux machine via the d
35
37
  its('addresses') { should include '0.0.0.0' }
36
38
  end
37
39
 
38
- ## Matchers
39
-
40
- This InSpec audit resource has the following matchers:
41
-
42
- ### address
43
-
44
- The `addresses` matcher tests if the specified address is associated with a port:
45
-
46
- its('addresses') { should include '0.0.0.0' }
47
-
48
- ### be
49
-
50
- <%= partial "/shared/matcher_be" %>
51
-
52
- ### be_listening
53
-
54
- The `be_listening` matcher tests if the port is listening for traffic:
55
-
56
- it { should be_listening }
57
-
58
- ### cmp
59
-
60
- <%= partial "/shared/matcher_cmp" %>
61
-
62
- ### eq
63
-
64
- <%= partial "/shared/matcher_eq" %>
65
-
66
- ### include
67
-
68
- <%= partial "/shared/matcher_include" %>
69
-
70
- ### match
71
-
72
- <%= partial "/shared/matcher_match" %>
73
-
74
- ### pids
75
-
76
- The `pids` matcher tests the process identifiers (PIDs):
77
-
78
- its('pids') { should cmp 27808 }
79
-
80
- ### processes
81
-
82
- The `processes` matcher tests if the named process is running on the system:
83
-
84
- its('processes') { should cmp 'syslog' }
85
-
86
- ### protocols
87
-
88
- The `protocols` matcher tests the Internet protocol: ICMP (`'icmp'`), TCP (`'tcp'` or `'tcp6'`), or UDP (`'udp'` or `'udp6'`):
89
-
90
- its('protocols') { should include 'tcp' }
91
-
92
- or for the IPv6 protocol:
93
-
94
- its('protocols') { should include 'tcp6' }
40
+ <br>
95
41
 
96
42
  ## Examples
97
43
 
@@ -148,3 +94,43 @@ or:
148
94
  describe port(65432) do
149
95
  it { should_not be_listening }
150
96
  end
97
+
98
+ <br>
99
+
100
+ ## Matchers
101
+
102
+ This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
103
+
104
+ ### address
105
+
106
+ The `addresses` matcher tests if the specified address is associated with a port:
107
+
108
+ its('addresses') { should include '0.0.0.0' }
109
+
110
+ ### be_listening
111
+
112
+ The `be_listening` matcher tests if the port is listening for traffic:
113
+
114
+ it { should be_listening }
115
+
116
+ ### pids
117
+
118
+ The `pids` matcher tests the process identifiers (PIDs):
119
+
120
+ its('pids') { should cmp 27808 }
121
+
122
+ ### processes
123
+
124
+ The `processes` matcher tests if the named process is running on the system:
125
+
126
+ its('processes') { should cmp 'syslog' }
127
+
128
+ ### protocols
129
+
130
+ The `protocols` matcher tests the Internet protocol: ICMP (`'icmp'`), TCP (`'tcp'` or `'tcp6'`), or UDP (`'udp'` or `'udp6'`):
131
+
132
+ its('protocols') { should include 'tcp' }
133
+
134
+ or for the IPv6 protocol:
135
+
136
+ its('protocols') { should include 'tcp6' }
@@ -6,6 +6,8 @@ title: About the postgres_conf Resource
6
6
 
7
7
  Use the `postgres_conf` InSpec audit resource to test the contents of the configuration file for PostgreSQL, typically located at `/etc/postgresql/<version>/main/postgresql.conf` or `/var/lib/postgres/data/postgresql.conf`, depending on the platform.
8
8
 
9
+ <br>
10
+
9
11
  ## Syntax
10
12
 
11
13
  A `postgres_conf` resource block declares one (or more) settings in the `postgresql.conf` file, and then compares the setting in the configuration file to the value stated in the test:
@@ -21,37 +23,7 @@ where
21
23
  * `('path')` is the non-default path to the `postgresql.conf` file (optional)
22
24
  * `should eq 'value'` is the value that is expected
23
25
 
24
- ## Matchers
25
-
26
- This InSpec audit resource has the following matchers:
27
-
28
- ### be
29
-
30
- <%= partial "/shared/matcher_be" %>
31
-
32
- ### cmp
33
-
34
- <%= partial "/shared/matcher_cmp" %>
35
-
36
- ### eq
37
-
38
- <%= partial "/shared/matcher_eq" %>
39
-
40
- ### include
41
-
42
- <%= partial "/shared/matcher_include" %>
43
-
44
- ### match
45
-
46
- <%= partial "/shared/matcher_match" %>
47
-
48
- ### setting
49
-
50
- The `setting` matcher tests specific, named settings in the `postgresql.conf` file:
51
-
52
- its('setting') { should eq 'value' }
53
-
54
- Use a `setting` matcher for each setting to be tested.
26
+ <br>
55
27
 
56
28
  ## Examples
57
29
 
@@ -90,3 +62,17 @@ The following examples show how to use this InSpec audit resource.
90
62
  end
91
63
 
92
64
  where `unix_socket_group` is set to the PostgreSQL default setting (the group to which the server user belongs).
65
+
66
+ <br>
67
+
68
+ ## Matchers
69
+
70
+ This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
71
+
72
+ ### setting
73
+
74
+ The `setting` matcher tests specific, named settings in the `postgresql.conf` file:
75
+
76
+ its('setting') { should eq 'value' }
77
+
78
+ Use a `setting` matcher for each setting to be tested.
@@ -5,6 +5,9 @@ title: About the postgres_hba_conf Resource
5
5
  # postgres_hba_conf
6
6
 
7
7
  Use the `postgres_hba_conf` InSpec audit resource to test the client authentication data defined in the pg_hba.conf file.
8
+
9
+ <br>
10
+
8
11
  ## Syntax
9
12
 
10
13
  An `postgres_hba_conf` InSpec audit resource block declares client authentication data that should be tested:
@@ -19,48 +22,14 @@ where
19
22
  * `'filter_value'` is the value that is to be filtered for
20
23
  * `'value'` is the value that is to be matched expected
21
24
 
22
- ## Matchers
23
-
24
- This InSpec audit resource matches any service that is listed in the HBA configuration file:
25
-
26
- its('auth_method') { should_not cmp 'peer' }
27
-
28
- or:
29
-
30
- its('auth_method') { should cmp 'peer' }
31
-
32
- For example:
33
-
34
- describe postgres_hba_conf.where { type == 'type' } do
35
- its('auth_method') { should cmp 'value' }
36
- its('user') { should cmp 'value' }
37
- end
38
-
39
- ### be
40
-
41
- <%= partial "/shared/matcher_be" %>
42
-
43
- ### cmp
44
-
45
- <%= partial "/shared/matcher_cmp" %>
46
-
47
- ### eq
48
-
49
- <%= partial "/shared/matcher_eq" %>
50
-
51
- ### include
52
-
53
- <%= partial "/shared/matcher_include" %>
54
-
55
- ### match
56
-
57
- <%= partial "/shared/matcher_match" %>
58
-
25
+ <br>
59
26
 
60
27
  ## Supported Properties
61
28
 
62
29
  'address', 'auth_method', 'auth_params', 'conf_dir' , 'conf_file' , 'database', 'params' ,'type', 'user'
63
30
 
31
+ <br>
32
+
64
33
  ## Property Examples and Return Types
65
34
 
66
35
  ### address([String])
@@ -70,7 +39,7 @@ For example:
70
39
  describe postgres_hba_conf.where { type == 'local' } do
71
40
  its('address') { should cmp 'value' }
72
41
  end
73
-
42
+
74
43
  ### auth_method([String])
75
44
 
76
45
  `auth_method` returns a an array of strings that matches the where condition of the filter table
@@ -102,3 +71,22 @@ For example:
102
71
  describe postgres_hba_conf.where { database == 'acme_test_db' } do
103
72
  its('user') { should cmp 'value' }
104
73
  end
74
+
75
+ <br>
76
+
77
+ ## Matchers
78
+
79
+ This InSpec audit resource matches any service that is listed in the HBA configuration file. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
80
+
81
+ its('auth_method') { should_not cmp 'peer' }
82
+
83
+ or:
84
+
85
+ its('auth_method') { should cmp 'peer' }
86
+
87
+ For example:
88
+
89
+ describe postgres_hba_conf.where { type == 'type' } do
90
+ its('auth_method') { should cmp 'value' }
91
+ its('user') { should cmp 'value' }
92
+ end
@@ -5,6 +5,9 @@ title: About the postgres_ident_conf Resource
5
5
  # postgres_ident_conf
6
6
 
7
7
  Use the `postgres_ident_conf` InSpec audit resource to test the client authentication data defined in the pg_hba.conf file.
8
+
9
+ <br>
10
+
8
11
  ## Syntax
9
12
 
10
13
  An `postgres_ident_conf` InSpec audit resource block declares client authentication data that should be tested:
@@ -19,48 +22,14 @@ where
19
22
  * `'filter_value'` is the value that is to be filtered for
20
23
  * `'value'` is the value that is to be matched expected
21
24
 
22
- ## Matchers
23
-
24
- This InSpec audit resource matches any service that is listed in the pg ident configuration file:
25
-
26
- its('pg_username') { should_not eq ['peer'] }
27
-
28
- or:
29
-
30
- its('map_name') { should eq ['value'] }
31
-
32
- For example:
33
-
34
- describe postgres_ident_conf.where { pg_username == 'name' } do
35
- its('system_username') { should eq ['value'] }
36
- its('map_name') { should eq ['value'] }
37
- end
38
-
39
- ### be
40
-
41
- <%= partial "/shared/matcher_be" %>
42
-
43
- ### cmp
44
-
45
- <%= partial "/shared/matcher_cmp" %>
46
-
47
- ### eq
48
-
49
- <%= partial "/shared/matcher_eq" %>
50
-
51
- ### include
52
-
53
- <%= partial "/shared/matcher_include" %>
54
-
55
- ### match
56
-
57
- <%= partial "/shared/matcher_match" %>
58
-
25
+ <br>
59
26
 
60
27
  ## Supported Properties
61
28
 
62
29
  'conf_file', 'map_name', 'params', 'pg_username', 'system_username'
63
30
 
31
+ <br>
32
+
64
33
  ## Property Examples and Return Types
65
34
 
66
35
  ### map_name([String])
@@ -85,3 +54,22 @@ For example:
85
54
  describe pg_hba_conf.where { pg_username == 'name' } do
86
55
  its('system_username') { should eq ['value'] }
87
56
  end
57
+
58
+ <br>
59
+
60
+ ## Matchers
61
+
62
+ This InSpec audit resource matches any service that is listed in the pg ident configuration file. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
63
+
64
+ its('pg_username') { should_not eq ['peer'] }
65
+
66
+ or:
67
+
68
+ its('map_name') { should eq ['value'] }
69
+
70
+ For example:
71
+
72
+ describe postgres_ident_conf.where { pg_username == 'name' } do
73
+ its('system_username') { should eq ['value'] }
74
+ its('map_name') { should eq ['value'] }
75
+ end
@@ -6,6 +6,8 @@ title: About the postgres_session Resource
6
6
 
7
7
  Use the `postgres_session` InSpec audit resource to test SQL commands run against a PostgreSQL database.
8
8
 
9
+ <br>
10
+
9
11
  ## Syntax
10
12
 
11
13
  A `postgres_session` resource block declares the username and password to use for the session, and then the command to be run:
@@ -29,35 +31,7 @@ A full example is:
29
31
 
30
32
  where `its('output') { should eq '' }` compares the results of the query against the expected result in the test
31
33
 
32
- ## Matchers
33
-
34
- This InSpec audit resource has the following matchers:
35
-
36
- ### be
37
-
38
- <%= partial "/shared/matcher_be" %>
39
-
40
- ### cmp
41
-
42
- <%= partial "/shared/matcher_cmp" %>
43
-
44
- ### eq
45
-
46
- <%= partial "/shared/matcher_eq" %>
47
-
48
- ### include
49
-
50
- <%= partial "/shared/matcher_include" %>
51
-
52
- ### match
53
-
54
- <%= partial "/shared/matcher_match" %>
55
-
56
- ### output
57
-
58
- The `output` matcher tests the results of the query:
59
-
60
- its('output') { should eq(/^0/) }
34
+ <br>
61
35
 
62
36
  ## Examples
63
37
 
@@ -80,3 +54,15 @@ The following examples show how to use this InSpec audit resource.
80
54
  AND lanname!=\'c\';', ['postgres']) do
81
55
  its('output') { should eq '0' }
82
56
  end
57
+
58
+ <br>
59
+
60
+ ## Matchers
61
+
62
+ This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
63
+
64
+ ### output
65
+
66
+ The `output` matcher tests the results of the query:
67
+
68
+ its('output') { should eq(/^0/) }