inspec 1.40.0 → 1.41.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +30 -9
- data/docs/matchers.md +18 -0
- data/docs/plugin_kitchen_inspec.md +18 -24
- data/docs/profiles.md +39 -2
- data/docs/resources/aide_conf.md.erb +18 -28
- data/docs/resources/apache_conf.md.erb +19 -33
- data/docs/resources/apt.md.erb +22 -36
- data/docs/resources/audit_policy.md.erb +9 -24
- data/docs/resources/auditd.md.erb +9 -24
- data/docs/resources/auditd_conf.md.erb +20 -34
- data/docs/resources/auditd_rules.md.erb +8 -24
- data/docs/resources/bash.md.erb +4 -26
- data/docs/resources/bond.md.erb +25 -40
- data/docs/resources/bridge.md.erb +5 -25
- data/docs/resources/bsd_service.md.erb +5 -25
- data/docs/resources/command.md.erb +35 -50
- data/docs/resources/crontab.md.erb +9 -23
- data/docs/resources/csv.md.erb +12 -27
- data/docs/resources/dh_params.md +1 -0
- data/docs/resources/directory.md.erb +5 -25
- data/docs/resources/docker.md.erb +60 -57
- data/docs/resources/docker_container.md.erb +23 -19
- data/docs/resources/docker_image.md.erb +20 -16
- data/docs/resources/etc_fstab.md.erb +5 -2
- data/docs/resources/etc_group.md.erb +29 -45
- data/docs/resources/etc_hosts.md.erb +6 -0
- data/docs/resources/etc_hosts_allow.md.erb +6 -2
- data/docs/resources/etc_hosts_deny.md.erb +6 -2
- data/docs/resources/file.md.erb +198 -212
- data/docs/resources/firewalld.md.erb +7 -1
- data/docs/resources/gem.md.erb +21 -35
- data/docs/resources/group.md.erb +16 -30
- data/docs/resources/grub_conf.md.erb +9 -24
- data/docs/resources/host.md.erb +32 -49
- data/docs/resources/http.md.erb +38 -44
- data/docs/resources/iis_app.md.erb +25 -35
- data/docs/resources/iis_site.md.erb +26 -40
- data/docs/resources/inetd_conf.md.erb +27 -42
- data/docs/resources/ini.md.erb +9 -23
- data/docs/resources/interface.md.erb +5 -25
- data/docs/resources/iptables.md.erb +15 -29
- data/docs/resources/json.md.erb +12 -27
- data/docs/resources/kernel_module.md.erb +47 -61
- data/docs/resources/kernel_parameter.md.erb +15 -29
- data/docs/resources/key_rsa.md.erb +3 -0
- data/docs/resources/launchd_service.md.erb +5 -25
- data/docs/resources/limits_conf.md.erb +15 -29
- data/docs/resources/login_def.md.erb +15 -30
- data/docs/resources/mount.md.erb +18 -33
- data/docs/resources/mssql_session.md.erb +9 -12
- data/docs/resources/mysql_conf.md.erb +17 -32
- data/docs/resources/mysql_session.md.erb +15 -29
- data/docs/resources/nginx.md.erb +6 -0
- data/docs/resources/nginx_conf.md.erb +25 -20
- data/docs/resources/npm.md.erb +19 -35
- data/docs/resources/ntp_conf.md.erb +20 -37
- data/docs/resources/oneget.md.erb +15 -30
- data/docs/resources/oracledb_session.md.erb +9 -11
- data/docs/resources/os.md.erb +29 -43
- data/docs/resources/os_env.md.erb +29 -44
- data/docs/resources/package.md.erb +33 -42
- data/docs/resources/parse_config.md.erb +5 -25
- data/docs/resources/parse_config_file.md.erb +31 -43
- data/docs/resources/passwd.md.erb +24 -39
- data/docs/resources/pip.md.erb +20 -35
- data/docs/resources/port.md.erb +43 -57
- data/docs/resources/postgres_conf.md.erb +17 -31
- data/docs/resources/postgres_hba_conf.md.erb +26 -38
- data/docs/resources/postgres_ident_conf.md.erb +25 -37
- data/docs/resources/postgres_session.md.erb +15 -29
- data/docs/resources/powershell.md.erb +27 -42
- data/docs/resources/processes.md.erb +17 -33
- data/docs/resources/rabbitmq_config.md.erb +9 -24
- data/docs/resources/registry_key.md.erb +27 -42
- data/docs/resources/runit_service.md.erb +5 -25
- data/docs/resources/security_policy.md.erb +12 -27
- data/docs/resources/service.md.erb +27 -42
- data/docs/resources/shadow.md.erb +20 -35
- data/docs/resources/ssh_config.md.erb +19 -34
- data/docs/resources/sshd_config.md.erb +19 -34
- data/docs/resources/ssl.md.erb +39 -54
- data/docs/resources/sys_info.md.erb +12 -26
- data/docs/resources/systemd_service.md.erb +5 -25
- data/docs/resources/sysv_service.md.erb +5 -25
- data/docs/resources/upstart_service.md.erb +5 -25
- data/docs/resources/user.md.erb +29 -44
- data/docs/resources/users.md.erb +12 -26
- data/docs/resources/vbscript.md.erb +9 -24
- data/docs/resources/virtualization.md.erb +8 -23
- data/docs/resources/windows_feature.md.erb +15 -30
- data/docs/resources/windows_hotfix.md.erb +15 -9
- data/docs/resources/windows_task.md.erb +12 -26
- data/docs/resources/wmi.md.erb +9 -24
- data/docs/resources/x509_certificate.md.erb +4 -0
- data/docs/resources/xinetd_conf.md.erb +65 -80
- data/docs/resources/xml.md.erb +12 -26
- data/docs/resources/yaml.md.erb +12 -27
- data/docs/resources/yum.md.erb +37 -51
- data/docs/resources/zfs_dataset.md.erb +15 -26
- data/docs/resources/zfs_pool.md.erb +9 -20
- data/lib/inspec/backend.rb +8 -0
- data/lib/inspec/profile.rb +9 -1
- data/lib/inspec/shell.rb +13 -13
- data/lib/inspec/version.rb +1 -1
- data/lib/matchers/matchers.rb +2 -0
- data/lib/resources/etc_hosts.rb +1 -1
- data/lib/resources/host.rb +4 -1
- data/lib/resources/http.rb +173 -23
- data/lib/resources/processes.rb +106 -20
- data/lib/resources/ssh_conf.rb +1 -1
- data/lib/resources/ssl.rb +4 -3
- data/lib/utils/object_traversal.rb +35 -10
- metadata +2 -2
@@ -6,6 +6,8 @@ title: About the powershell Resource
|
|
6
6
|
|
7
7
|
Use the `powershell` InSpec audit resource to test a Powershell script on the Windows platform.
|
8
8
|
|
9
|
+
<br>
|
10
|
+
|
9
11
|
## Syntax
|
10
12
|
|
11
13
|
A `powershell` resource block declares a Powershell script to be tested, and then compares the output of that command to the matcher in the test:
|
@@ -24,48 +26,7 @@ where
|
|
24
26
|
* `'matcher'` is one of `exit_status`, `stderr`, or `stdout`
|
25
27
|
* `'output'` tests the output of the command run on the system versus the output value stated in the test
|
26
28
|
|
27
|
-
|
28
|
-
## Matchers
|
29
|
-
|
30
|
-
This InSpec audit resource has the following matchers:
|
31
|
-
|
32
|
-
### be
|
33
|
-
|
34
|
-
<%= partial "/shared/matcher_be" %>
|
35
|
-
|
36
|
-
### cmp
|
37
|
-
|
38
|
-
<%= partial "/shared/matcher_cmp" %>
|
39
|
-
|
40
|
-
### eq
|
41
|
-
|
42
|
-
<%= partial "/shared/matcher_eq" %>
|
43
|
-
|
44
|
-
### exit_status
|
45
|
-
|
46
|
-
The `exit_status` matcher tests the exit status for the command:
|
47
|
-
|
48
|
-
its('exit_status') { should eq 123 }
|
49
|
-
|
50
|
-
### include
|
51
|
-
|
52
|
-
<%= partial "/shared/matcher_include" %>
|
53
|
-
|
54
|
-
### match
|
55
|
-
|
56
|
-
<%= partial "/shared/matcher_match" %>
|
57
|
-
|
58
|
-
### stderr
|
59
|
-
|
60
|
-
The `stderr` matcher tests results of the command as returned in standard error (stderr):
|
61
|
-
|
62
|
-
its('stderr') { should eq 'error' }
|
63
|
-
|
64
|
-
### stdout
|
65
|
-
|
66
|
-
The `stdout` matcher tests results of the command as returned in standard output (stdout):
|
67
|
-
|
68
|
-
its('stdout') { should eq '/^1$/' }
|
29
|
+
<br>
|
69
30
|
|
70
31
|
## Examples
|
71
32
|
|
@@ -114,3 +75,27 @@ No newline:
|
|
114
75
|
its('stdout') { should eq 'hello' }
|
115
76
|
its('stderr') { should eq '' }
|
116
77
|
end
|
78
|
+
|
79
|
+
<br>
|
80
|
+
|
81
|
+
## Matchers
|
82
|
+
|
83
|
+
This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
84
|
+
|
85
|
+
### exit_status
|
86
|
+
|
87
|
+
The `exit_status` matcher tests the exit status for the command:
|
88
|
+
|
89
|
+
its('exit_status') { should eq 123 }
|
90
|
+
|
91
|
+
### stderr
|
92
|
+
|
93
|
+
The `stderr` matcher tests results of the command as returned in standard error (stderr):
|
94
|
+
|
95
|
+
its('stderr') { should eq 'error' }
|
96
|
+
|
97
|
+
### stdout
|
98
|
+
|
99
|
+
The `stdout` matcher tests results of the command as returned in standard output (stdout):
|
100
|
+
|
101
|
+
its('stdout') { should eq '/^1$/' }
|
@@ -6,6 +6,8 @@ title: About the processes Resource
|
|
6
6
|
|
7
7
|
Use the `processes` InSpec audit resource to test properties for programs that are running on the system.
|
8
8
|
|
9
|
+
<br>
|
10
|
+
|
9
11
|
## Syntax
|
10
12
|
|
11
13
|
A `processes` resource block declares the name of the process to be tested, and then declares one (or more) property/value pairs:
|
@@ -16,39 +18,10 @@ A `processes` resource block declares the name of the process to be tested, and
|
|
16
18
|
|
17
19
|
where
|
18
20
|
|
19
|
-
* `processes('process_name')` specifies the name of a process to check. If this is a string, it will be converted to a Regexp. For more specificity, pass a Regexp directly.
|
21
|
+
* `processes('process_name')` specifies the name of a process to check. If this is a string, it will be converted to a Regexp. For more specificity, pass a Regexp directly. If left blank, all processes will be returned.
|
20
22
|
* `property_name` may be used to test user (`its('users')`) and state properties (`its('states')`)
|
21
23
|
|
22
|
-
|
23
|
-
## Matchers
|
24
|
-
|
25
|
-
This InSpec audit resource has the following matchers:
|
26
|
-
|
27
|
-
### be
|
28
|
-
|
29
|
-
<%= partial "/shared/matcher_be" %>
|
30
|
-
|
31
|
-
### cmp
|
32
|
-
|
33
|
-
<%= partial "/shared/matcher_cmp" %>
|
34
|
-
|
35
|
-
### eq
|
36
|
-
|
37
|
-
<%= partial "/shared/matcher_eq" %>
|
38
|
-
|
39
|
-
### include
|
40
|
-
|
41
|
-
<%= partial "/shared/matcher_include" %>
|
42
|
-
|
43
|
-
### match
|
44
|
-
|
45
|
-
<%= partial "/shared/matcher_match" %>
|
46
|
-
|
47
|
-
### property_name
|
48
|
-
|
49
|
-
The `property_name` matcher tests the named property for the specified value:
|
50
|
-
|
51
|
-
its('property_name') { should eq ['property_value'] }
|
24
|
+
<br>
|
52
25
|
|
53
26
|
## Examples
|
54
27
|
|
@@ -100,9 +73,9 @@ needed.
|
|
100
73
|
### Notes for auditing Windows systems
|
101
74
|
|
102
75
|
Sometimes with system properties there isn't a direct comparison between different operating systems.
|
103
|
-
Most of the `property_name`'s do align between the different OS's.
|
76
|
+
Most of the `property_name`'s do align between the different OS's.
|
104
77
|
|
105
|
-
There are however some exception's, for example, within linux `states` offers multiple properties.
|
78
|
+
There are however some exception's, for example, within linux `states` offers multiple properties.
|
106
79
|
Windows doesn't have direct comparison that is a single property so instead `states` is mapped to the property of `Responding`, This is a boolean true/false flag to help determine if the process is hung.
|
107
80
|
|
108
81
|
Below is a mapping table to help you understand what property the unix field maps to the windows `Get-Process` Property
|
@@ -121,3 +94,14 @@ Below is a mapping table to help you understand what property the unix field map
|
|
121
94
|
|time |TotalProcessorTime|
|
122
95
|
|users |UserName|
|
123
96
|
|commands |Path|
|
97
|
+
|
98
|
+
|
99
|
+
## Matchers
|
100
|
+
|
101
|
+
This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
102
|
+
|
103
|
+
### property_name
|
104
|
+
|
105
|
+
The `property_name` matcher tests the named property for the specified value:
|
106
|
+
|
107
|
+
its('property_name') { should eq ['property_value'] }
|
@@ -6,6 +6,8 @@ title: About the rabbitmq_config Resource
|
|
6
6
|
|
7
7
|
Use the `rabbitmq_config` InSpec audit resource to test configuration data for the RabbitMQ daemon located at `/etc/rabbitmq/rabbitmq.config` on Linux and Unix platforms.
|
8
8
|
|
9
|
+
<br>
|
10
|
+
|
9
11
|
## Syntax
|
10
12
|
|
11
13
|
A `rabbitmq_config` resource block declares the RabbitMQ configuration data to be tested:
|
@@ -19,30 +21,7 @@ where
|
|
19
21
|
* `params` is the list of parameters configured in the RabbitMQ config file
|
20
22
|
* `{ should cmp 5671 }` tests the value of `rabbit.ssl_listeners` as read from `rabbitmq.config` versus the value declared in the test
|
21
23
|
|
22
|
-
|
23
|
-
## Matchers
|
24
|
-
|
25
|
-
This InSpec audit resource has the following matchers:
|
26
|
-
|
27
|
-
### be
|
28
|
-
|
29
|
-
<%= partial "/shared/matcher_be" %>
|
30
|
-
|
31
|
-
### cmp
|
32
|
-
|
33
|
-
<%= partial "/shared/matcher_cmp" %>
|
34
|
-
|
35
|
-
### eq
|
36
|
-
|
37
|
-
<%= partial "/shared/matcher_eq" %>
|
38
|
-
|
39
|
-
### include
|
40
|
-
|
41
|
-
<%= partial "/shared/matcher_include" %>
|
42
|
-
|
43
|
-
### match
|
44
|
-
|
45
|
-
<%= partial "/shared/matcher_match" %>
|
24
|
+
<br>
|
46
25
|
|
47
26
|
## Examples
|
48
27
|
|
@@ -53,3 +32,9 @@ The following examples show how to use this InSpec audit resource.
|
|
53
32
|
describe rabbitmq_config.params('rabbit', 'tcp_listeners') do
|
54
33
|
it { should eq [5672] }
|
55
34
|
end
|
35
|
+
|
36
|
+
<br>
|
37
|
+
|
38
|
+
## Matchers
|
39
|
+
|
40
|
+
For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
@@ -6,6 +6,8 @@ title: About the registry_key Resource
|
|
6
6
|
|
7
7
|
Use the `registry_key` InSpec audit resource to test key values in the Windows registry.
|
8
8
|
|
9
|
+
<br>
|
10
|
+
|
9
11
|
## Syntax
|
10
12
|
|
11
13
|
A `registry_key` resource block declares the item in the Windows registry, the path to a setting under that item, and then one (or more) name/value pairs to be tested.
|
@@ -61,13 +63,34 @@ Please make sure that you use backslashes instead of forward slashes. Forward sl
|
|
61
63
|
its('Release') { should eq 378675 }
|
62
64
|
end
|
63
65
|
|
64
|
-
|
66
|
+
<br>
|
67
|
+
|
68
|
+
## Examples
|
69
|
+
|
70
|
+
The following examples show how to use this InSpec audit resource.
|
71
|
+
|
72
|
+
### Test the start time for the Schedule service
|
65
73
|
|
66
|
-
|
74
|
+
describe registry_key('Task Scheduler','HKEY_LOCAL_MACHINE\...\Schedule') do
|
75
|
+
its('Start') { should eq 2 }
|
76
|
+
end
|
67
77
|
|
68
|
-
|
78
|
+
where `'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Schedule'` is the full path to the setting.
|
69
79
|
|
70
|
-
|
80
|
+
### Use a regular expression in responses
|
81
|
+
|
82
|
+
describe registry_key({
|
83
|
+
hive: 'HKEY_LOCAL_MACHINE',
|
84
|
+
key: 'SOFTWARE\Microsoft\Windows NT\CurrentVersion'
|
85
|
+
}) do
|
86
|
+
its('ProductName') { should match /^[a-zA-Z0-9\(\)\s]*2012\s[rR]2[a-zA-Z0-9\(\)\s]*$/ }
|
87
|
+
end
|
88
|
+
|
89
|
+
<br>
|
90
|
+
|
91
|
+
## Matchers
|
92
|
+
|
93
|
+
This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
71
94
|
|
72
95
|
### children
|
73
96
|
|
@@ -93,14 +116,6 @@ The following example shows how find a property that may exist against multiple
|
|
93
116
|
end
|
94
117
|
}
|
95
118
|
|
96
|
-
### cmp
|
97
|
-
|
98
|
-
<%= partial "/shared/matcher_cmp" %>
|
99
|
-
|
100
|
-
### eq
|
101
|
-
|
102
|
-
<%= partial "/shared/matcher_eq" %>
|
103
|
-
|
104
119
|
### exist
|
105
120
|
|
106
121
|
The `exist` matcher tests if the registry key is present:
|
@@ -125,14 +140,6 @@ The `have_value` matcher tests if a value exists for a registry key:
|
|
125
140
|
|
126
141
|
it { should have_value 'value' }
|
127
142
|
|
128
|
-
### include
|
129
|
-
|
130
|
-
<%= partial "/shared/matcher_include" %>
|
131
|
-
|
132
|
-
### match
|
133
|
-
|
134
|
-
<%= partial "/shared/matcher_match" %>
|
135
|
-
|
136
143
|
### name
|
137
144
|
|
138
145
|
The `name` matcher tests the value for the specified registry setting:
|
@@ -148,25 +155,3 @@ Any name with a dot will not work as expected: <code>its('explorer.exe') { shoul
|
|
148
155
|
# its('explorer.exe') { should eq 'test' }
|
149
156
|
# use the following solution:
|
150
157
|
it { should have_property_value('explorer.exe', :string, 'test') }
|
151
|
-
|
152
|
-
|
153
|
-
## Examples
|
154
|
-
|
155
|
-
The following examples show how to use this InSpec audit resource.
|
156
|
-
|
157
|
-
### Test the start time for the Schedule service
|
158
|
-
|
159
|
-
describe registry_key('Task Scheduler','HKEY_LOCAL_MACHINE\...\Schedule') do
|
160
|
-
its('Start') { should eq 2 }
|
161
|
-
end
|
162
|
-
|
163
|
-
where `'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Schedule'` is the full path to the setting.
|
164
|
-
|
165
|
-
### Use a regular expression in responses
|
166
|
-
|
167
|
-
describe registry_key({
|
168
|
-
hive: 'HKEY_LOCAL_MACHINE',
|
169
|
-
key: 'SOFTWARE\Microsoft\Windows NT\CurrentVersion'
|
170
|
-
}) do
|
171
|
-
its('ProductName') { should match /^[a-zA-Z0-9\(\)\s]*2012\s[rR]2[a-zA-Z0-9\(\)\s]*$/ }
|
172
|
-
end
|
@@ -6,6 +6,8 @@ title: About the runit_service Resource
|
|
6
6
|
|
7
7
|
Use the `runit_service` InSpec audit resource to test a service using runit.
|
8
8
|
|
9
|
+
<br>
|
10
|
+
|
9
11
|
## Syntax
|
10
12
|
|
11
13
|
A `runit_service` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
|
@@ -29,13 +31,11 @@ The path to the service manager's control may be specified for situations where
|
|
29
31
|
it { should be_running }
|
30
32
|
end
|
31
33
|
|
32
|
-
|
33
|
-
|
34
|
-
This InSpec audit resource has the following matchers:
|
34
|
+
<br>
|
35
35
|
|
36
|
-
|
36
|
+
## Matchers
|
37
37
|
|
38
|
-
|
38
|
+
This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
39
39
|
|
40
40
|
### be_enabled
|
41
41
|
|
@@ -54,23 +54,3 @@ The `be_installed` matcher tests if the named service is installed:
|
|
54
54
|
The `be_running` matcher tests if the named service is running:
|
55
55
|
|
56
56
|
it { should be_running }
|
57
|
-
|
58
|
-
### cmp
|
59
|
-
|
60
|
-
<%= partial "/shared/matcher_cmp" %>
|
61
|
-
|
62
|
-
### eq
|
63
|
-
|
64
|
-
<%= partial "/shared/matcher_eq" %>
|
65
|
-
|
66
|
-
### include
|
67
|
-
|
68
|
-
<%= partial "/shared/matcher_include" %>
|
69
|
-
|
70
|
-
### match
|
71
|
-
|
72
|
-
<%= partial "/shared/matcher_match" %>
|
73
|
-
|
74
|
-
## Examples
|
75
|
-
|
76
|
-
None.
|
@@ -6,6 +6,8 @@ title: About the security_policy Resource
|
|
6
6
|
|
7
7
|
Use the `security_policy` InSpec audit resource to test security policies on the Windows platform.
|
8
8
|
|
9
|
+
<br>
|
10
|
+
|
9
11
|
## Syntax
|
10
12
|
|
11
13
|
A `security_policy` resource block declares the name of a security policy and the value to be tested:
|
@@ -19,43 +21,26 @@ where
|
|
19
21
|
* `'policy_name'` must specify a security policy
|
20
22
|
* `{ should eq 'value' }` tests the value of `policy_name` against the value declared in the test
|
21
23
|
|
24
|
+
<br>
|
22
25
|
|
23
|
-
##
|
24
|
-
|
25
|
-
This InSpec audit resource has the following matchers:
|
26
|
-
|
27
|
-
### be
|
28
|
-
|
29
|
-
<%= partial "/shared/matcher_be" %>
|
30
|
-
|
31
|
-
### cmp
|
32
|
-
|
33
|
-
<%= partial "/shared/matcher_cmp" %>
|
26
|
+
## Examples
|
34
27
|
|
35
|
-
|
28
|
+
The following examples show how to use this InSpec audit resource.
|
36
29
|
|
37
|
-
|
30
|
+
### Verify that only the Administrators group has remote access
|
38
31
|
|
39
|
-
|
32
|
+
describe security_policy do
|
33
|
+
its('SeRemoteInteractiveLogonRight') { should eq '*S-1-5-32-544' }
|
34
|
+
end
|
40
35
|
|
41
|
-
|
36
|
+
<br>
|
42
37
|
|
43
|
-
|
38
|
+
## Matchers
|
44
39
|
|
45
|
-
|
40
|
+
This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
46
41
|
|
47
42
|
### policy_name
|
48
43
|
|
49
44
|
The `policy_name` matcher must be the name of a security policy:
|
50
45
|
|
51
46
|
its('SeNetworkLogonRight') { should eq '*S-1-5-11' }
|
52
|
-
|
53
|
-
## Examples
|
54
|
-
|
55
|
-
The following examples show how to use this InSpec audit resource.
|
56
|
-
|
57
|
-
### Verify that only the Administrators group has remote access
|
58
|
-
|
59
|
-
describe security_policy do
|
60
|
-
its('SeRemoteInteractiveLogonRight') { should eq '*S-1-5-32-544' }
|
61
|
-
end
|
@@ -8,6 +8,8 @@ Use the `service` InSpec audit resource to test if the named service is installe
|
|
8
8
|
|
9
9
|
Under some circumstances, it may be necessary to specify the service manager by using one of the following service manager-specific resources: `bsd_service`, `launchd_service`, `runit_service`, `systemd_service`, `sysv_service`, or `upstart_service`. These resources are based on the `service` resource.
|
10
10
|
|
11
|
+
<br>
|
12
|
+
|
11
13
|
## Syntax
|
12
14
|
|
13
15
|
A `service` resource block declares the name of a service and then one (or more) matchers to test the state of the service:
|
@@ -23,48 +25,7 @@ where
|
|
23
25
|
* `('service_name')` must specify a service name
|
24
26
|
* `be_installed`, `be_enabled`, and `be_running` are valid matchers for this resource
|
25
27
|
|
26
|
-
|
27
|
-
## Matchers
|
28
|
-
|
29
|
-
This InSpec audit resource has the following matchers:
|
30
|
-
|
31
|
-
### be
|
32
|
-
|
33
|
-
<%= partial "/shared/matcher_be" %>
|
34
|
-
|
35
|
-
### be_enabled
|
36
|
-
|
37
|
-
The `be_enabled` matcher tests if the named service is enabled:
|
38
|
-
|
39
|
-
it { should be_enabled }
|
40
|
-
|
41
|
-
### be_installed
|
42
|
-
|
43
|
-
The `be_installed` matcher tests if the named service is installed:
|
44
|
-
|
45
|
-
it { should be_installed }
|
46
|
-
|
47
|
-
### be_running
|
48
|
-
|
49
|
-
The `be_running` matcher tests if the named service is running:
|
50
|
-
|
51
|
-
it { should be_running }
|
52
|
-
|
53
|
-
### cmp
|
54
|
-
|
55
|
-
<%= partial "/shared/matcher_cmp" %>
|
56
|
-
|
57
|
-
### eq
|
58
|
-
|
59
|
-
<%= partial "/shared/matcher_eq" %>
|
60
|
-
|
61
|
-
### include
|
62
|
-
|
63
|
-
<%= partial "/shared/matcher_include" %>
|
64
|
-
|
65
|
-
### match
|
66
|
-
|
67
|
-
<%= partial "/shared/matcher_match" %>
|
28
|
+
<br>
|
68
29
|
|
69
30
|
## Examples
|
70
31
|
|
@@ -133,3 +94,27 @@ This is also possible with `systemd_service`, `runit_service`, `sysv_service`, `
|
|
133
94
|
it { should be_installed }
|
134
95
|
it { should be_running }
|
135
96
|
end
|
97
|
+
|
98
|
+
<br>
|
99
|
+
|
100
|
+
## Matchers
|
101
|
+
|
102
|
+
This InSpec audit resource has the following matchers. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
103
|
+
|
104
|
+
### be_enabled
|
105
|
+
|
106
|
+
The `be_enabled` matcher tests if the named service is enabled:
|
107
|
+
|
108
|
+
it { should be_enabled }
|
109
|
+
|
110
|
+
### be_installed
|
111
|
+
|
112
|
+
The `be_installed` matcher tests if the named service is installed:
|
113
|
+
|
114
|
+
it { should be_installed }
|
115
|
+
|
116
|
+
### be_running
|
117
|
+
|
118
|
+
The `be_running` matcher tests if the named service is running:
|
119
|
+
|
120
|
+
it { should be_running }
|