inspec 2.0.16 → 2.0.17
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.rubocop.yml +101 -101
- data/CHANGELOG.md +2949 -2944
- data/Gemfile +55 -55
- data/LICENSE +14 -14
- data/MAINTAINERS.md +31 -31
- data/MAINTAINERS.toml +47 -47
- data/README.md +438 -438
- data/Rakefile +284 -284
- data/bin/inspec +12 -12
- data/docs/.gitignore +2 -2
- data/docs/README.md +40 -40
- data/docs/dsl_inspec.md +258 -258
- data/docs/dsl_resource.md +93 -93
- data/docs/glossary.md +99 -99
- data/docs/habitat.md +191 -191
- data/docs/inspec_and_friends.md +107 -107
- data/docs/matchers.md +165 -165
- data/docs/migration.md +293 -293
- data/docs/platforms.md +118 -118
- data/docs/plugin_kitchen_inspec.md +49 -49
- data/docs/profiles.md +370 -370
- data/docs/reporters.md +105 -105
- data/docs/resources/aide_conf.md.erb +75 -75
- data/docs/resources/apache.md.erb +67 -67
- data/docs/resources/apache_conf.md.erb +68 -68
- data/docs/resources/apt.md.erb +71 -71
- data/docs/resources/audit_policy.md.erb +47 -47
- data/docs/resources/auditd.md.erb +79 -79
- data/docs/resources/auditd_conf.md.erb +68 -68
- data/docs/resources/aws_cloudtrail_trail.md.erb +140 -140
- data/docs/resources/aws_cloudtrail_trails.md.erb +81 -81
- data/docs/resources/aws_cloudwatch_alarm.md.erb +86 -86
- data/docs/resources/aws_cloudwatch_log_metric_filter.md.erb +151 -151
- data/docs/resources/aws_ec2_instance.md.erb +106 -106
- data/docs/resources/aws_iam_access_key.md.erb +123 -123
- data/docs/resources/aws_iam_access_keys.md.erb +198 -198
- data/docs/resources/aws_iam_group.md.erb +46 -46
- data/docs/resources/aws_iam_groups.md.erb +43 -43
- data/docs/resources/aws_iam_password_policy.md.erb +76 -76
- data/docs/resources/aws_iam_policies.md.erb +82 -82
- data/docs/resources/aws_iam_policy.md.erb +146 -146
- data/docs/resources/aws_iam_role.md.erb +65 -65
- data/docs/resources/aws_iam_root_user.md.erb +58 -58
- data/docs/resources/aws_iam_user.md.erb +64 -64
- data/docs/resources/aws_iam_users.md.erb +89 -89
- data/docs/resources/aws_kms_keys.md.erb +84 -84
- data/docs/resources/aws_route_table.md.erb +47 -47
- data/docs/resources/aws_s3_bucket.md.erb +134 -134
- data/docs/resources/aws_security_group.md.erb +152 -152
- data/docs/resources/aws_security_groups.md.erb +92 -92
- data/docs/resources/aws_sns_topic.md.erb +62 -62
- data/docs/resources/aws_subnet.md.erb +133 -133
- data/docs/resources/aws_subnets.md.erb +126 -126
- data/docs/resources/aws_vpc.md.erb +120 -120
- data/docs/resources/aws_vpcs.md.erb +48 -48
- data/docs/resources/azure_generic_resource.md.erb +170 -139
- data/docs/resources/azure_resource_group.md.erb +284 -284
- data/docs/resources/azure_virtual_machine.md.erb +347 -314
- data/docs/resources/azure_virtual_machine_data_disk.md.erb +224 -182
- data/docs/resources/bash.md.erb +75 -75
- data/docs/resources/bond.md.erb +90 -90
- data/docs/resources/bridge.md.erb +57 -57
- data/docs/resources/bsd_service.md.erb +67 -67
- data/docs/resources/command.md.erb +138 -138
- data/docs/resources/cpan.md.erb +79 -79
- data/docs/resources/cran.md.erb +64 -64
- data/docs/resources/crontab.md.erb +88 -88
- data/docs/resources/csv.md.erb +54 -54
- data/docs/resources/dh_params.md.erb +217 -217
- data/docs/resources/directory.md.erb +30 -30
- data/docs/resources/docker.md.erb +164 -164
- data/docs/resources/docker_container.md.erb +104 -104
- data/docs/resources/docker_image.md.erb +94 -94
- data/docs/resources/docker_service.md.erb +114 -114
- data/docs/resources/elasticsearch.md.erb +242 -242
- data/docs/resources/etc_fstab.md.erb +125 -125
- data/docs/resources/etc_group.md.erb +75 -75
- data/docs/resources/etc_hosts.md.erb +78 -78
- data/docs/resources/etc_hosts_allow.md.erb +74 -74
- data/docs/resources/etc_hosts_deny.md.erb +74 -74
- data/docs/resources/file.md.erb +515 -515
- data/docs/resources/filesystem.md.erb +41 -41
- data/docs/resources/firewalld.md.erb +107 -107
- data/docs/resources/gem.md.erb +79 -79
- data/docs/resources/group.md.erb +61 -61
- data/docs/resources/grub_conf.md.erb +101 -101
- data/docs/resources/host.md.erb +78 -78
- data/docs/resources/http.md.erb +101 -101
- data/docs/resources/iis_app.md.erb +122 -122
- data/docs/resources/iis_site.md.erb +135 -135
- data/docs/resources/inetd_conf.md.erb +94 -94
- data/docs/resources/ini.md.erb +76 -76
- data/docs/resources/interface.md.erb +58 -58
- data/docs/resources/iptables.md.erb +64 -64
- data/docs/resources/json.md.erb +62 -62
- data/docs/resources/kernel_module.md.erb +107 -107
- data/docs/resources/kernel_parameter.md.erb +53 -53
- data/docs/resources/key_rsa.md.erb +85 -85
- data/docs/resources/launchd_service.md.erb +57 -57
- data/docs/resources/limits_conf.md.erb +75 -75
- data/docs/resources/login_def.md.erb +71 -71
- data/docs/resources/mount.md.erb +69 -69
- data/docs/resources/mssql_session.md.erb +60 -60
- data/docs/resources/mysql_conf.md.erb +99 -99
- data/docs/resources/mysql_session.md.erb +74 -74
- data/docs/resources/nginx.md.erb +79 -79
- data/docs/resources/nginx_conf.md.erb +128 -128
- data/docs/resources/npm.md.erb +60 -60
- data/docs/resources/ntp_conf.md.erb +60 -60
- data/docs/resources/oneget.md.erb +53 -53
- data/docs/resources/oracledb_session.md.erb +52 -52
- data/docs/resources/os.md.erb +141 -141
- data/docs/resources/os_env.md.erb +78 -78
- data/docs/resources/package.md.erb +120 -120
- data/docs/resources/packages.md.erb +67 -67
- data/docs/resources/parse_config.md.erb +103 -103
- data/docs/resources/parse_config_file.md.erb +138 -138
- data/docs/resources/passwd.md.erb +141 -141
- data/docs/resources/pip.md.erb +67 -67
- data/docs/resources/port.md.erb +137 -137
- data/docs/resources/postgres_conf.md.erb +79 -79
- data/docs/resources/postgres_hba_conf.md.erb +93 -93
- data/docs/resources/postgres_ident_conf.md.erb +76 -76
- data/docs/resources/postgres_session.md.erb +69 -69
- data/docs/resources/powershell.md.erb +102 -102
- data/docs/resources/processes.md.erb +109 -109
- data/docs/resources/rabbitmq_config.md.erb +41 -41
- data/docs/resources/registry_key.md.erb +158 -158
- data/docs/resources/runit_service.md.erb +57 -57
- data/docs/resources/security_policy.md.erb +47 -47
- data/docs/resources/service.md.erb +121 -121
- data/docs/resources/shadow.md.erb +144 -144
- data/docs/resources/ssh_config.md.erb +80 -80
- data/docs/resources/sshd_config.md.erb +83 -83
- data/docs/resources/ssl.md.erb +119 -119
- data/docs/resources/sys_info.md.erb +42 -42
- data/docs/resources/systemd_service.md.erb +57 -57
- data/docs/resources/sysv_service.md.erb +57 -57
- data/docs/resources/upstart_service.md.erb +57 -57
- data/docs/resources/user.md.erb +140 -140
- data/docs/resources/users.md.erb +127 -127
- data/docs/resources/vbscript.md.erb +55 -55
- data/docs/resources/virtualization.md.erb +57 -57
- data/docs/resources/windows_feature.md.erb +47 -47
- data/docs/resources/windows_hotfix.md.erb +53 -53
- data/docs/resources/windows_task.md.erb +95 -95
- data/docs/resources/wmi.md.erb +81 -81
- data/docs/resources/x509_certificate.md.erb +151 -151
- data/docs/resources/xinetd_conf.md.erb +156 -156
- data/docs/resources/xml.md.erb +85 -85
- data/docs/resources/yaml.md.erb +69 -69
- data/docs/resources/yum.md.erb +98 -98
- data/docs/resources/zfs_dataset.md.erb +53 -53
- data/docs/resources/zfs_pool.md.erb +47 -47
- data/docs/ruby_usage.md +203 -203
- data/docs/shared/matcher_be.md.erb +1 -1
- data/docs/shared/matcher_cmp.md.erb +43 -43
- data/docs/shared/matcher_eq.md.erb +3 -3
- data/docs/shared/matcher_include.md.erb +1 -1
- data/docs/shared/matcher_match.md.erb +1 -1
- data/docs/shell.md +172 -172
- data/examples/README.md +8 -8
- data/examples/inheritance/README.md +65 -65
- data/examples/inheritance/controls/example.rb +14 -14
- data/examples/inheritance/inspec.yml +15 -15
- data/examples/kitchen-ansible/.kitchen.yml +25 -25
- data/examples/kitchen-ansible/Gemfile +19 -19
- data/examples/kitchen-ansible/README.md +53 -53
- data/examples/kitchen-ansible/files/nginx.repo +6 -6
- data/examples/kitchen-ansible/tasks/main.yml +16 -16
- data/examples/kitchen-ansible/test/integration/default/default.yml +5 -5
- data/examples/kitchen-ansible/test/integration/default/web_spec.rb +28 -28
- data/examples/kitchen-chef/.kitchen.yml +20 -20
- data/examples/kitchen-chef/Berksfile +3 -3
- data/examples/kitchen-chef/Gemfile +19 -19
- data/examples/kitchen-chef/README.md +27 -27
- data/examples/kitchen-chef/metadata.rb +7 -7
- data/examples/kitchen-chef/recipes/default.rb +6 -6
- data/examples/kitchen-chef/recipes/nginx.rb +30 -30
- data/examples/kitchen-chef/test/integration/default/web_spec.rb +28 -28
- data/examples/kitchen-puppet/.kitchen.yml +22 -22
- data/examples/kitchen-puppet/Gemfile +20 -20
- data/examples/kitchen-puppet/Puppetfile +25 -25
- data/examples/kitchen-puppet/README.md +53 -53
- data/examples/kitchen-puppet/manifests/site.pp +33 -33
- data/examples/kitchen-puppet/metadata.json +11 -11
- data/examples/kitchen-puppet/test/integration/default/web_spec.rb +28 -28
- data/examples/meta-profile/README.md +37 -37
- data/examples/meta-profile/controls/example.rb +13 -13
- data/examples/meta-profile/inspec.yml +13 -13
- data/examples/profile-attribute.yml +2 -2
- data/examples/profile-attribute/README.md +14 -14
- data/examples/profile-attribute/controls/example.rb +11 -11
- data/examples/profile-attribute/inspec.yml +8 -8
- data/examples/profile-aws/controls/iam_password_policy_expiration.rb +8 -8
- data/examples/profile-aws/controls/iam_password_policy_max_age.rb +8 -8
- data/examples/profile-aws/controls/iam_root_user_mfa.rb +8 -8
- data/examples/profile-aws/controls/iam_users_access_key_age.rb +8 -8
- data/examples/profile-aws/controls/iam_users_console_users_mfa.rb +8 -8
- data/examples/profile-aws/inspec.yml +11 -11
- data/examples/profile-azure/controls/azure_resource_group_example.rb +24 -24
- data/examples/profile-azure/controls/azure_vm_example.rb +29 -29
- data/examples/profile-azure/inspec.yml +11 -11
- data/examples/profile-sensitive/README.md +29 -29
- data/examples/profile-sensitive/controls/sensitive-failures.rb +9 -9
- data/examples/profile-sensitive/controls/sensitive.rb +9 -9
- data/examples/profile-sensitive/inspec.yml +8 -8
- data/examples/profile/README.md +48 -48
- data/examples/profile/controls/example.rb +23 -23
- data/examples/profile/controls/gordon.rb +36 -36
- data/examples/profile/controls/meta.rb +34 -34
- data/examples/profile/inspec.yml +10 -10
- data/examples/profile/libraries/gordon_config.rb +53 -53
- data/inspec.gemspec +47 -47
- data/lib/bundles/README.md +3 -3
- data/lib/bundles/inspec-artifact.rb +7 -7
- data/lib/bundles/inspec-artifact/README.md +1 -1
- data/lib/bundles/inspec-artifact/cli.rb +277 -277
- data/lib/bundles/inspec-compliance.rb +16 -16
- data/lib/bundles/inspec-compliance/.kitchen.yml +20 -20
- data/lib/bundles/inspec-compliance/README.md +185 -185
- data/lib/bundles/inspec-compliance/api.rb +316 -316
- data/lib/bundles/inspec-compliance/api/login.rb +152 -152
- data/lib/bundles/inspec-compliance/bootstrap.sh +41 -41
- data/lib/bundles/inspec-compliance/cli.rb +254 -254
- data/lib/bundles/inspec-compliance/configuration.rb +103 -103
- data/lib/bundles/inspec-compliance/http.rb +86 -86
- data/lib/bundles/inspec-compliance/support.rb +36 -36
- data/lib/bundles/inspec-compliance/target.rb +98 -98
- data/lib/bundles/inspec-compliance/test/integration/default/cli.rb +93 -93
- data/lib/bundles/inspec-habitat.rb +12 -12
- data/lib/bundles/inspec-habitat/cli.rb +36 -36
- data/lib/bundles/inspec-habitat/log.rb +10 -10
- data/lib/bundles/inspec-habitat/profile.rb +390 -390
- data/lib/bundles/inspec-init.rb +8 -8
- data/lib/bundles/inspec-init/README.md +31 -31
- data/lib/bundles/inspec-init/cli.rb +97 -97
- data/lib/bundles/inspec-init/templates/profile/README.md +3 -3
- data/lib/bundles/inspec-init/templates/profile/controls/example.rb +19 -19
- data/lib/bundles/inspec-init/templates/profile/inspec.yml +8 -8
- data/lib/bundles/inspec-supermarket.rb +13 -13
- data/lib/bundles/inspec-supermarket/README.md +45 -45
- data/lib/bundles/inspec-supermarket/api.rb +84 -84
- data/lib/bundles/inspec-supermarket/cli.rb +73 -73
- data/lib/bundles/inspec-supermarket/target.rb +34 -34
- data/lib/fetchers/git.rb +163 -163
- data/lib/fetchers/local.rb +74 -74
- data/lib/fetchers/mock.rb +35 -35
- data/lib/fetchers/url.rb +204 -204
- data/lib/inspec.rb +24 -24
- data/lib/inspec/archive/tar.rb +29 -29
- data/lib/inspec/archive/zip.rb +19 -19
- data/lib/inspec/backend.rb +92 -92
- data/lib/inspec/base_cli.rb +350 -333
- data/lib/inspec/cached_fetcher.rb +66 -66
- data/lib/inspec/cli.rb +292 -302
- data/lib/inspec/completions/bash.sh.erb +45 -45
- data/lib/inspec/completions/fish.sh.erb +34 -34
- data/lib/inspec/completions/zsh.sh.erb +61 -61
- data/lib/inspec/control_eval_context.rb +179 -179
- data/lib/inspec/dependencies/cache.rb +72 -72
- data/lib/inspec/dependencies/dependency_set.rb +92 -92
- data/lib/inspec/dependencies/lockfile.rb +115 -115
- data/lib/inspec/dependencies/requirement.rb +123 -123
- data/lib/inspec/dependencies/resolver.rb +86 -86
- data/lib/inspec/describe.rb +27 -27
- data/lib/inspec/dsl.rb +66 -66
- data/lib/inspec/dsl_shared.rb +33 -33
- data/lib/inspec/env_printer.rb +157 -157
- data/lib/inspec/errors.rb +13 -13
- data/lib/inspec/exceptions.rb +12 -12
- data/lib/inspec/expect.rb +45 -45
- data/lib/inspec/fetcher.rb +45 -45
- data/lib/inspec/file_provider.rb +275 -275
- data/lib/inspec/formatters.rb +3 -3
- data/lib/inspec/formatters/base.rb +250 -250
- data/lib/inspec/formatters/json_rspec.rb +20 -20
- data/lib/inspec/formatters/show_progress.rb +12 -12
- data/lib/inspec/library_eval_context.rb +58 -58
- data/lib/inspec/log.rb +11 -11
- data/lib/inspec/metadata.rb +247 -247
- data/lib/inspec/method_source.rb +24 -24
- data/lib/inspec/objects.rb +14 -14
- data/lib/inspec/objects/attribute.rb +65 -65
- data/lib/inspec/objects/control.rb +61 -61
- data/lib/inspec/objects/describe.rb +92 -92
- data/lib/inspec/objects/each_loop.rb +36 -36
- data/lib/inspec/objects/list.rb +15 -15
- data/lib/inspec/objects/or_test.rb +40 -40
- data/lib/inspec/objects/ruby_helper.rb +15 -15
- data/lib/inspec/objects/tag.rb +27 -27
- data/lib/inspec/objects/test.rb +87 -87
- data/lib/inspec/objects/value.rb +27 -27
- data/lib/inspec/plugins.rb +60 -60
- data/lib/inspec/plugins/cli.rb +24 -24
- data/lib/inspec/plugins/fetcher.rb +86 -86
- data/lib/inspec/plugins/resource.rb +133 -133
- data/lib/inspec/plugins/secret.rb +15 -15
- data/lib/inspec/plugins/source_reader.rb +40 -40
- data/lib/inspec/polyfill.rb +12 -12
- data/lib/inspec/profile.rb +510 -510
- data/lib/inspec/profile_context.rb +207 -207
- data/lib/inspec/profile_vendor.rb +66 -66
- data/lib/inspec/reporters.rb +50 -50
- data/lib/inspec/reporters/base.rb +24 -24
- data/lib/inspec/reporters/cli.rb +356 -356
- data/lib/inspec/reporters/json.rb +116 -116
- data/lib/inspec/reporters/json_min.rb +48 -48
- data/lib/inspec/reporters/junit.rb +77 -77
- data/lib/inspec/require_loader.rb +33 -33
- data/lib/inspec/resource.rb +186 -186
- data/lib/inspec/rule.rb +266 -266
- data/lib/inspec/runner.rb +344 -344
- data/lib/inspec/runner_mock.rb +41 -41
- data/lib/inspec/runner_rspec.rb +174 -174
- data/lib/inspec/runtime_profile.rb +26 -26
- data/lib/inspec/schema.rb +213 -213
- data/lib/inspec/secrets.rb +19 -19
- data/lib/inspec/secrets/yaml.rb +30 -30
- data/lib/inspec/shell.rb +220 -223
- data/lib/inspec/shell_detector.rb +90 -90
- data/lib/inspec/source_reader.rb +29 -29
- data/lib/inspec/version.rb +8 -8
- data/lib/matchers/matchers.rb +339 -339
- data/lib/resource_support/aws.rb +40 -40
- data/lib/resource_support/aws/aws_backend_base.rb +12 -12
- data/lib/resource_support/aws/aws_backend_factory_mixin.rb +12 -12
- data/lib/resource_support/aws/aws_plural_resource_mixin.rb +21 -21
- data/lib/resource_support/aws/aws_resource_mixin.rb +66 -66
- data/lib/resource_support/aws/aws_singular_resource_mixin.rb +24 -24
- data/lib/resources/aide_conf.rb +160 -160
- data/lib/resources/apache.rb +48 -48
- data/lib/resources/apache_conf.rb +156 -156
- data/lib/resources/apt.rb +149 -149
- data/lib/resources/audit_policy.rb +63 -63
- data/lib/resources/auditd.rb +231 -231
- data/lib/resources/auditd_conf.rb +55 -55
- data/lib/resources/aws/aws_cloudtrail_trail.rb +77 -77
- data/lib/resources/aws/aws_cloudtrail_trails.rb +47 -47
- data/lib/resources/aws/aws_cloudwatch_alarm.rb +62 -62
- data/lib/resources/aws/aws_cloudwatch_log_metric_filter.rb +100 -100
- data/lib/resources/aws/aws_ec2_instance.rb +157 -157
- data/lib/resources/aws/aws_iam_access_key.rb +106 -106
- data/lib/resources/aws/aws_iam_access_keys.rb +144 -144
- data/lib/resources/aws/aws_iam_group.rb +56 -56
- data/lib/resources/aws/aws_iam_groups.rb +45 -45
- data/lib/resources/aws/aws_iam_password_policy.rb +116 -116
- data/lib/resources/aws/aws_iam_policies.rb +46 -46
- data/lib/resources/aws/aws_iam_policy.rb +119 -119
- data/lib/resources/aws/aws_iam_role.rb +51 -51
- data/lib/resources/aws/aws_iam_root_user.rb +60 -60
- data/lib/resources/aws/aws_iam_user.rb +111 -111
- data/lib/resources/aws/aws_iam_users.rb +96 -96
- data/lib/resources/aws/aws_kms_keys.rb +46 -46
- data/lib/resources/aws/aws_route_table.rb +61 -61
- data/lib/resources/aws/aws_s3_bucket.rb +115 -115
- data/lib/resources/aws/aws_security_group.rb +93 -93
- data/lib/resources/aws/aws_security_groups.rb +68 -68
- data/lib/resources/aws/aws_sns_topic.rb +53 -53
- data/lib/resources/aws/aws_subnet.rb +88 -88
- data/lib/resources/aws/aws_subnets.rb +53 -53
- data/lib/resources/aws/aws_vpc.rb +69 -69
- data/lib/resources/aws/aws_vpcs.rb +45 -45
- data/lib/resources/azure/azure_backend.rb +377 -377
- data/lib/resources/azure/azure_generic_resource.rb +59 -59
- data/lib/resources/azure/azure_resource_group.rb +152 -152
- data/lib/resources/azure/azure_virtual_machine.rb +264 -264
- data/lib/resources/azure/azure_virtual_machine_data_disk.rb +136 -136
- data/lib/resources/bash.rb +35 -35
- data/lib/resources/bond.rb +68 -68
- data/lib/resources/bridge.rb +122 -122
- data/lib/resources/command.rb +69 -69
- data/lib/resources/cpan.rb +58 -58
- data/lib/resources/cran.rb +64 -64
- data/lib/resources/crontab.rb +170 -170
- data/lib/resources/csv.rb +60 -60
- data/lib/resources/dh_params.rb +82 -82
- data/lib/resources/directory.rb +25 -25
- data/lib/resources/docker.rb +236 -236
- data/lib/resources/docker_container.rb +89 -89
- data/lib/resources/docker_image.rb +83 -83
- data/lib/resources/docker_object.rb +57 -57
- data/lib/resources/docker_service.rb +90 -90
- data/lib/resources/elasticsearch.rb +169 -169
- data/lib/resources/etc_fstab.rb +102 -102
- data/lib/resources/etc_group.rb +156 -156
- data/lib/resources/etc_hosts.rb +81 -81
- data/lib/resources/etc_hosts_allow_deny.rb +123 -123
- data/lib/resources/file.rb +298 -298
- data/lib/resources/filesystem.rb +31 -31
- data/lib/resources/firewalld.rb +144 -144
- data/lib/resources/gem.rb +70 -70
- data/lib/resources/groups.rb +215 -215
- data/lib/resources/grub_conf.rb +237 -237
- data/lib/resources/host.rb +300 -300
- data/lib/resources/http.rb +250 -250
- data/lib/resources/iis_app.rb +104 -104
- data/lib/resources/iis_site.rb +148 -148
- data/lib/resources/inetd_conf.rb +62 -62
- data/lib/resources/ini.rb +29 -29
- data/lib/resources/interface.rb +129 -129
- data/lib/resources/iptables.rb +69 -69
- data/lib/resources/json.rb +117 -117
- data/lib/resources/kernel_module.rb +107 -107
- data/lib/resources/kernel_parameter.rb +58 -58
- data/lib/resources/key_rsa.rb +67 -67
- data/lib/resources/limits_conf.rb +55 -55
- data/lib/resources/login_def.rb +66 -66
- data/lib/resources/mount.rb +88 -88
- data/lib/resources/mssql_session.rb +101 -101
- data/lib/resources/mysql.rb +81 -81
- data/lib/resources/mysql_conf.rb +134 -134
- data/lib/resources/mysql_session.rb +71 -71
- data/lib/resources/nginx.rb +96 -96
- data/lib/resources/nginx_conf.rb +227 -227
- data/lib/resources/npm.rb +48 -48
- data/lib/resources/ntp_conf.rb +58 -58
- data/lib/resources/oneget.rb +71 -71
- data/lib/resources/oracledb_session.rb +139 -139
- data/lib/resources/os.rb +36 -36
- data/lib/resources/os_env.rb +76 -76
- data/lib/resources/package.rb +363 -363
- data/lib/resources/packages.rb +111 -111
- data/lib/resources/parse_config.rb +116 -116
- data/lib/resources/passwd.rb +74 -74
- data/lib/resources/pip.rb +89 -89
- data/lib/resources/platform.rb +109 -109
- data/lib/resources/port.rb +771 -771
- data/lib/resources/postgres.rb +130 -130
- data/lib/resources/postgres_conf.rb +121 -121
- data/lib/resources/postgres_hba_conf.rb +100 -100
- data/lib/resources/postgres_ident_conf.rb +78 -78
- data/lib/resources/postgres_session.rb +71 -71
- data/lib/resources/powershell.rb +57 -57
- data/lib/resources/processes.rb +204 -204
- data/lib/resources/rabbitmq_conf.rb +52 -52
- data/lib/resources/registry_key.rb +296 -296
- data/lib/resources/security_policy.rb +180 -180
- data/lib/resources/service.rb +789 -789
- data/lib/resources/shadow.rb +140 -140
- data/lib/resources/ssh_conf.rb +102 -102
- data/lib/resources/ssl.rb +99 -99
- data/lib/resources/sys_info.rb +28 -28
- data/lib/resources/toml.rb +32 -32
- data/lib/resources/users.rb +654 -654
- data/lib/resources/vbscript.rb +69 -69
- data/lib/resources/virtualization.rb +251 -251
- data/lib/resources/windows_feature.rb +84 -84
- data/lib/resources/windows_hotfix.rb +35 -35
- data/lib/resources/windows_task.rb +105 -105
- data/lib/resources/wmi.rb +113 -113
- data/lib/resources/x509_certificate.rb +143 -143
- data/lib/resources/xinetd.rb +111 -111
- data/lib/resources/xml.rb +46 -46
- data/lib/resources/yaml.rb +47 -47
- data/lib/resources/yum.rb +180 -180
- data/lib/resources/zfs_dataset.rb +60 -60
- data/lib/resources/zfs_pool.rb +49 -49
- data/lib/source_readers/flat.rb +39 -39
- data/lib/source_readers/inspec.rb +75 -75
- data/lib/utils/command_wrapper.rb +27 -27
- data/lib/utils/convert.rb +12 -12
- data/lib/utils/database_helpers.rb +77 -77
- data/lib/utils/erlang_parser.rb +192 -192
- data/lib/utils/filter.rb +272 -272
- data/lib/utils/filter_array.rb +27 -27
- data/lib/utils/find_files.rb +44 -44
- data/lib/utils/hash.rb +41 -41
- data/lib/utils/json_log.rb +18 -18
- data/lib/utils/latest_version.rb +22 -22
- data/lib/utils/modulator.rb +12 -12
- data/lib/utils/nginx_parser.rb +85 -85
- data/lib/utils/object_traversal.rb +49 -49
- data/lib/utils/parser.rb +274 -274
- data/lib/utils/plugin_registry.rb +93 -93
- data/lib/utils/simpleconfig.rb +120 -120
- data/lib/utils/spdx.rb +13 -13
- data/lib/utils/spdx.txt +343 -343
- metadata +1 -1
|
@@ -1,74 +1,74 @@
|
|
|
1
|
-
---
|
|
2
|
-
title: About the mysql_session Resource
|
|
3
|
-
platform: os
|
|
4
|
-
---
|
|
5
|
-
|
|
6
|
-
# mysql_session
|
|
7
|
-
|
|
8
|
-
Use the `mysql_session` InSpec audit resource to test SQL commands run against a MySQL database.
|
|
9
|
-
|
|
10
|
-
<br>
|
|
11
|
-
|
|
12
|
-
## Syntax
|
|
13
|
-
|
|
14
|
-
A `mysql_session` resource block declares the username and password to use for the session, and then the command to be run:
|
|
15
|
-
|
|
16
|
-
describe mysql_session('username', 'password').query('QUERY') do
|
|
17
|
-
its('stdout') { should match(/expected-result/) }
|
|
18
|
-
end
|
|
19
|
-
|
|
20
|
-
where
|
|
21
|
-
|
|
22
|
-
* `mysql_session` declares a username and password, connecting locally, with permission to run the query
|
|
23
|
-
* `query('QUERY')` contains the query to be run
|
|
24
|
-
* `its('stdout') { should eq(/expected-result/) }` compares the results of the query against the expected result in the test
|
|
25
|
-
|
|
26
|
-
<br>
|
|
27
|
-
|
|
28
|
-
## Examples
|
|
29
|
-
|
|
30
|
-
The following examples show how to use this InSpec audit resource.
|
|
31
|
-
|
|
32
|
-
### Test for matching databases
|
|
33
|
-
|
|
34
|
-
sql = mysql_session('my_user','password')
|
|
35
|
-
|
|
36
|
-
describe sql.query('show databases like \'test\';') do
|
|
37
|
-
its('stdout') { should_not match(/test/) }
|
|
38
|
-
end
|
|
39
|
-
|
|
40
|
-
### Alternate Connection: Different Host
|
|
41
|
-
|
|
42
|
-
sql = mysql_session('my_user','password','db.example.com')
|
|
43
|
-
|
|
44
|
-
### Alternate Connection: Different Port
|
|
45
|
-
|
|
46
|
-
sql = mysql_session('my_user','password','localhost',3307)
|
|
47
|
-
|
|
48
|
-
### Alternate Connection: Using a socket
|
|
49
|
-
|
|
50
|
-
sql = mysql_session('my_user','password', nil, nil, '/var/lib/mysql-default/mysqld.sock')
|
|
51
|
-
|
|
52
|
-
### Test for a successful query
|
|
53
|
-
|
|
54
|
-
describe mysql_session('my_user','password').query('show tables in existing_database;') do
|
|
55
|
-
its('exit_status') { should eq(0) }
|
|
56
|
-
end
|
|
57
|
-
|
|
58
|
-
### Test for a failing query
|
|
59
|
-
|
|
60
|
-
describe mysql_session('my_user','password').query('show tables in non_existent_database;') do
|
|
61
|
-
its('exit_status') { should_not eq(0) }
|
|
62
|
-
end
|
|
63
|
-
|
|
64
|
-
### Test for specific error message
|
|
65
|
-
|
|
66
|
-
describe mysql_session('my_user','password').query('show tables in non_existent_database;') do
|
|
67
|
-
its('stderr') { should match(/Unknown database/) }
|
|
68
|
-
end
|
|
69
|
-
|
|
70
|
-
<br>
|
|
71
|
-
|
|
72
|
-
## Matchers
|
|
73
|
-
|
|
74
|
-
This InSpec audit resource builds a [command](https://www.inspec.io/docs/reference/resources/command) object and returns the the result object. For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
|
1
|
+
---
|
|
2
|
+
title: About the mysql_session Resource
|
|
3
|
+
platform: os
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# mysql_session
|
|
7
|
+
|
|
8
|
+
Use the `mysql_session` InSpec audit resource to test SQL commands run against a MySQL database.
|
|
9
|
+
|
|
10
|
+
<br>
|
|
11
|
+
|
|
12
|
+
## Syntax
|
|
13
|
+
|
|
14
|
+
A `mysql_session` resource block declares the username and password to use for the session, and then the command to be run:
|
|
15
|
+
|
|
16
|
+
describe mysql_session('username', 'password').query('QUERY') do
|
|
17
|
+
its('stdout') { should match(/expected-result/) }
|
|
18
|
+
end
|
|
19
|
+
|
|
20
|
+
where
|
|
21
|
+
|
|
22
|
+
* `mysql_session` declares a username and password, connecting locally, with permission to run the query
|
|
23
|
+
* `query('QUERY')` contains the query to be run
|
|
24
|
+
* `its('stdout') { should eq(/expected-result/) }` compares the results of the query against the expected result in the test
|
|
25
|
+
|
|
26
|
+
<br>
|
|
27
|
+
|
|
28
|
+
## Examples
|
|
29
|
+
|
|
30
|
+
The following examples show how to use this InSpec audit resource.
|
|
31
|
+
|
|
32
|
+
### Test for matching databases
|
|
33
|
+
|
|
34
|
+
sql = mysql_session('my_user','password')
|
|
35
|
+
|
|
36
|
+
describe sql.query('show databases like \'test\';') do
|
|
37
|
+
its('stdout') { should_not match(/test/) }
|
|
38
|
+
end
|
|
39
|
+
|
|
40
|
+
### Alternate Connection: Different Host
|
|
41
|
+
|
|
42
|
+
sql = mysql_session('my_user','password','db.example.com')
|
|
43
|
+
|
|
44
|
+
### Alternate Connection: Different Port
|
|
45
|
+
|
|
46
|
+
sql = mysql_session('my_user','password','localhost',3307)
|
|
47
|
+
|
|
48
|
+
### Alternate Connection: Using a socket
|
|
49
|
+
|
|
50
|
+
sql = mysql_session('my_user','password', nil, nil, '/var/lib/mysql-default/mysqld.sock')
|
|
51
|
+
|
|
52
|
+
### Test for a successful query
|
|
53
|
+
|
|
54
|
+
describe mysql_session('my_user','password').query('show tables in existing_database;') do
|
|
55
|
+
its('exit_status') { should eq(0) }
|
|
56
|
+
end
|
|
57
|
+
|
|
58
|
+
### Test for a failing query
|
|
59
|
+
|
|
60
|
+
describe mysql_session('my_user','password').query('show tables in non_existent_database;') do
|
|
61
|
+
its('exit_status') { should_not eq(0) }
|
|
62
|
+
end
|
|
63
|
+
|
|
64
|
+
### Test for specific error message
|
|
65
|
+
|
|
66
|
+
describe mysql_session('my_user','password').query('show tables in non_existent_database;') do
|
|
67
|
+
its('stderr') { should match(/Unknown database/) }
|
|
68
|
+
end
|
|
69
|
+
|
|
70
|
+
<br>
|
|
71
|
+
|
|
72
|
+
## Matchers
|
|
73
|
+
|
|
74
|
+
This InSpec audit resource builds a [command](https://www.inspec.io/docs/reference/resources/command) object and returns the the result object. For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
data/docs/resources/nginx.md.erb
CHANGED
|
@@ -1,79 +1,79 @@
|
|
|
1
|
-
---
|
|
2
|
-
title: The Nginx Resource
|
|
3
|
-
platform: linux
|
|
4
|
-
---
|
|
5
|
-
|
|
6
|
-
# nginx
|
|
7
|
-
|
|
8
|
-
Use the `nginx` InSpec audit resource to test the fields and validity of nginx.
|
|
9
|
-
|
|
10
|
-
Nginx resource extracts and exposes data reported by the command 'nginx -V'
|
|
11
|
-
|
|
12
|
-
<br>
|
|
13
|
-
|
|
14
|
-
## Syntax
|
|
15
|
-
|
|
16
|
-
An `nginx` InSpec audit resource block extracts configuration settings that should be tested:
|
|
17
|
-
|
|
18
|
-
describe nginx do
|
|
19
|
-
its('attribute') { should eq 'value' }
|
|
20
|
-
end
|
|
21
|
-
|
|
22
|
-
describe nginx('path to nginx') do
|
|
23
|
-
its('attribute') { should eq 'value' }
|
|
24
|
-
end
|
|
25
|
-
|
|
26
|
-
where
|
|
27
|
-
|
|
28
|
-
* `'attribute'` is a configuration parsed from result of the command 'nginx -V'
|
|
29
|
-
* `'value'` is the value that is expected of the attribute
|
|
30
|
-
|
|
31
|
-
<br>
|
|
32
|
-
|
|
33
|
-
## Properties
|
|
34
|
-
|
|
35
|
-
* 'compiler_info', 'error_log_path', 'http_client_body_temp_path', 'http_fastcgi_temp_path', 'http_log_path', 'http_proxy_temp_path', 'http_scgi_temp_path', 'http_uwsgi_temp_path', 'lock_path', 'modules', 'modules_path', 'openssl_version', 'prefix', 'sbin_path', 'service', 'support_info', 'version'
|
|
36
|
-
|
|
37
|
-
<br>
|
|
38
|
-
|
|
39
|
-
## Property Examples
|
|
40
|
-
|
|
41
|
-
### version(String)
|
|
42
|
-
|
|
43
|
-
`version` returns a string of the version of the running nginx instance
|
|
44
|
-
|
|
45
|
-
describe nginx do
|
|
46
|
-
its('version') { should eq '1.12.0' }
|
|
47
|
-
end
|
|
48
|
-
|
|
49
|
-
### modules(String)
|
|
50
|
-
|
|
51
|
-
`modules` returns a array modules in the running nginx instance
|
|
52
|
-
|
|
53
|
-
describe nginx do
|
|
54
|
-
its('modules') { should include 'my_module' }
|
|
55
|
-
end
|
|
56
|
-
|
|
57
|
-
### openssl_version(Hash)
|
|
58
|
-
|
|
59
|
-
`openssl_version ` returns a hash with 'version' and 'date' as keys
|
|
60
|
-
|
|
61
|
-
describe nginx do
|
|
62
|
-
its('openssl_version.date') { should eq '11 Feb 2013' }
|
|
63
|
-
end
|
|
64
|
-
|
|
65
|
-
### compiler_info(Hash)
|
|
66
|
-
|
|
67
|
-
`compiler_info ` returns a hash with 'compiler' , version' and 'date' as keys
|
|
68
|
-
|
|
69
|
-
describe nginx do
|
|
70
|
-
its('compiler_info.compiler') { should eq 'gcc' }
|
|
71
|
-
end
|
|
72
|
-
|
|
73
|
-
### support_info(String)
|
|
74
|
-
|
|
75
|
-
`support_info ` returns a string containing supported protocols
|
|
76
|
-
|
|
77
|
-
describe nginx do
|
|
78
|
-
its('support_info') { should match /TLS/ }
|
|
79
|
-
end
|
|
1
|
+
---
|
|
2
|
+
title: The Nginx Resource
|
|
3
|
+
platform: linux
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# nginx
|
|
7
|
+
|
|
8
|
+
Use the `nginx` InSpec audit resource to test the fields and validity of nginx.
|
|
9
|
+
|
|
10
|
+
Nginx resource extracts and exposes data reported by the command 'nginx -V'
|
|
11
|
+
|
|
12
|
+
<br>
|
|
13
|
+
|
|
14
|
+
## Syntax
|
|
15
|
+
|
|
16
|
+
An `nginx` InSpec audit resource block extracts configuration settings that should be tested:
|
|
17
|
+
|
|
18
|
+
describe nginx do
|
|
19
|
+
its('attribute') { should eq 'value' }
|
|
20
|
+
end
|
|
21
|
+
|
|
22
|
+
describe nginx('path to nginx') do
|
|
23
|
+
its('attribute') { should eq 'value' }
|
|
24
|
+
end
|
|
25
|
+
|
|
26
|
+
where
|
|
27
|
+
|
|
28
|
+
* `'attribute'` is a configuration parsed from result of the command 'nginx -V'
|
|
29
|
+
* `'value'` is the value that is expected of the attribute
|
|
30
|
+
|
|
31
|
+
<br>
|
|
32
|
+
|
|
33
|
+
## Properties
|
|
34
|
+
|
|
35
|
+
* 'compiler_info', 'error_log_path', 'http_client_body_temp_path', 'http_fastcgi_temp_path', 'http_log_path', 'http_proxy_temp_path', 'http_scgi_temp_path', 'http_uwsgi_temp_path', 'lock_path', 'modules', 'modules_path', 'openssl_version', 'prefix', 'sbin_path', 'service', 'support_info', 'version'
|
|
36
|
+
|
|
37
|
+
<br>
|
|
38
|
+
|
|
39
|
+
## Property Examples
|
|
40
|
+
|
|
41
|
+
### version(String)
|
|
42
|
+
|
|
43
|
+
`version` returns a string of the version of the running nginx instance
|
|
44
|
+
|
|
45
|
+
describe nginx do
|
|
46
|
+
its('version') { should eq '1.12.0' }
|
|
47
|
+
end
|
|
48
|
+
|
|
49
|
+
### modules(String)
|
|
50
|
+
|
|
51
|
+
`modules` returns a array modules in the running nginx instance
|
|
52
|
+
|
|
53
|
+
describe nginx do
|
|
54
|
+
its('modules') { should include 'my_module' }
|
|
55
|
+
end
|
|
56
|
+
|
|
57
|
+
### openssl_version(Hash)
|
|
58
|
+
|
|
59
|
+
`openssl_version ` returns a hash with 'version' and 'date' as keys
|
|
60
|
+
|
|
61
|
+
describe nginx do
|
|
62
|
+
its('openssl_version.date') { should eq '11 Feb 2013' }
|
|
63
|
+
end
|
|
64
|
+
|
|
65
|
+
### compiler_info(Hash)
|
|
66
|
+
|
|
67
|
+
`compiler_info ` returns a hash with 'compiler' , version' and 'date' as keys
|
|
68
|
+
|
|
69
|
+
describe nginx do
|
|
70
|
+
its('compiler_info.compiler') { should eq 'gcc' }
|
|
71
|
+
end
|
|
72
|
+
|
|
73
|
+
### support_info(String)
|
|
74
|
+
|
|
75
|
+
`support_info ` returns a string containing supported protocols
|
|
76
|
+
|
|
77
|
+
describe nginx do
|
|
78
|
+
its('support_info') { should match /TLS/ }
|
|
79
|
+
end
|
|
@@ -1,128 +1,128 @@
|
|
|
1
|
-
---
|
|
2
|
-
title: About the nginx_conf Resource
|
|
3
|
-
platform: linux
|
|
4
|
-
---
|
|
5
|
-
|
|
6
|
-
# nginx_conf
|
|
7
|
-
|
|
8
|
-
Use the `nginx_conf` InSpec resource to test configuration data for the NGINX server located at `/etc/nginx/nginx.conf` on Linux and Unix platforms.
|
|
9
|
-
|
|
10
|
-
**Stability: Experimental**
|
|
11
|
-
|
|
12
|
-
<br>
|
|
13
|
-
|
|
14
|
-
## Syntax
|
|
15
|
-
|
|
16
|
-
An `nginx_conf` resource block declares the client NGINX configuration data to be tested:
|
|
17
|
-
|
|
18
|
-
describe nginx_conf.params['pid'] do
|
|
19
|
-
it { should cmp 'logs/nginx.pid' }
|
|
20
|
-
end
|
|
21
|
-
|
|
22
|
-
where
|
|
23
|
-
|
|
24
|
-
* `nginx_conf` is the resource to reference your NGINX configuration
|
|
25
|
-
* `params` accesses all its parameters
|
|
26
|
-
* `params['pid']` selects the `pid` entry from the global NGINX configuration
|
|
27
|
-
* `{ should cmp 'logs/nginx.pid' }` tests if the PID is set to `logs/nginx.pid` (via `cmp` matcher)
|
|
28
|
-
|
|
29
|
-
<br>
|
|
30
|
-
|
|
31
|
-
## Examples
|
|
32
|
-
|
|
33
|
-
The following examples show how to use this InSpec audit resource.
|
|
34
|
-
|
|
35
|
-
### Find a specific server
|
|
36
|
-
|
|
37
|
-
servers = nginx_conf.servers
|
|
38
|
-
domain2 = servers.find { |s| s.params['server_name'].flatten.include? 'domain2.com' }
|
|
39
|
-
describe 'No server serves domain2' do
|
|
40
|
-
subject { domain2 }
|
|
41
|
-
it { should be_nil }
|
|
42
|
-
end
|
|
43
|
-
|
|
44
|
-
### Test a raw parameter
|
|
45
|
-
|
|
46
|
-
describe nginx_conf.params['worker_processes'].flatten do
|
|
47
|
-
it { should cmp 5 }
|
|
48
|
-
end
|
|
49
|
-
|
|
50
|
-
<br>
|
|
51
|
-
|
|
52
|
-
## Matchers
|
|
53
|
-
|
|
54
|
-
For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
|
55
|
-
|
|
56
|
-
### http
|
|
57
|
-
|
|
58
|
-
Retrieves all `http` entries in the configuration file.
|
|
59
|
-
|
|
60
|
-
nginx_conf.http
|
|
61
|
-
=> nginx_conf /etc/nginx/nginx.conf, http entries
|
|
62
|
-
|
|
63
|
-
It provides further access to all individual entries, servers, and locations.
|
|
64
|
-
|
|
65
|
-
nginx_conf.http.entries
|
|
66
|
-
=> [nginx_conf /etc/nginx/nginx.conf, http entry ...]
|
|
67
|
-
|
|
68
|
-
nginx_conf.http.servers
|
|
69
|
-
=> [nginx_conf /etc/nginx/nginx.conf, server entry ...]
|
|
70
|
-
|
|
71
|
-
nginx_conf.http.locations
|
|
72
|
-
=> [nginx_conf /etc/nginx/nginx.conf, location entry ...]
|
|
73
|
-
|
|
74
|
-
You can access each of these from the array and inspect it further (see below).
|
|
75
|
-
|
|
76
|
-
### servers
|
|
77
|
-
|
|
78
|
-
Retrieve all `servers` entries in the configuration:
|
|
79
|
-
|
|
80
|
-
# all servers across all configs aggregated:
|
|
81
|
-
nginx_conf.servers
|
|
82
|
-
=> [nginx_conf /etc/nginx/nginx.conf, server entry ...]
|
|
83
|
-
|
|
84
|
-
# servers that belong to a specific http entry:
|
|
85
|
-
nginx_conf.http.entries[0].servers
|
|
86
|
-
=> [nginx_conf /etc/nginx/nginx.conf, server entry ...]
|
|
87
|
-
|
|
88
|
-
Servers provide access to all their locations, parent http entry, and raw parameters:
|
|
89
|
-
|
|
90
|
-
server = nginx_conf.servers[0]
|
|
91
|
-
|
|
92
|
-
server.locations
|
|
93
|
-
=> [nginx_conf /etc/nginx/nginx.conf, location entry ...]
|
|
94
|
-
|
|
95
|
-
server.parent
|
|
96
|
-
=> nginx_conf /etc/nginx/nginx.conf, http entry
|
|
97
|
-
|
|
98
|
-
server.params
|
|
99
|
-
=> {"listen"=>[["85"]],
|
|
100
|
-
"server_name"=>[["domain1.com", "www.domain1.com"]],
|
|
101
|
-
"root"=>[["html"]],
|
|
102
|
-
"location"=>[{"_"=>["~", "\\.php$"], "fastcgi_pass"=>[["127.0.0.1:1025"]]}]}
|
|
103
|
-
|
|
104
|
-
### locations
|
|
105
|
-
|
|
106
|
-
Retrieve all `location` entries in the configuration:
|
|
107
|
-
|
|
108
|
-
# all locations across all configs aggregated:
|
|
109
|
-
nginx_conf.locations
|
|
110
|
-
=> [nginx_conf /etc/nginx/nginx.conf, location entry ...]
|
|
111
|
-
|
|
112
|
-
# locations of a http entry aggregated:
|
|
113
|
-
nginx_conf.http.entries[0].locations
|
|
114
|
-
=> [nginx_conf /etc/nginx/nginx.conf, location entry ...]
|
|
115
|
-
|
|
116
|
-
# locations of a specific server:
|
|
117
|
-
nginx_conf.servers[0].locations
|
|
118
|
-
=> [nginx_conf /etc/nginx/nginx.conf, location entry ...]
|
|
119
|
-
|
|
120
|
-
Locations provide access to their parent server entry and raw parameters:
|
|
121
|
-
|
|
122
|
-
location = nginx_conf.locations[0]
|
|
123
|
-
|
|
124
|
-
location.parent
|
|
125
|
-
=> nginx_conf /etc/nginx/nginx.conf, server entry
|
|
126
|
-
|
|
127
|
-
location.params
|
|
128
|
-
=> {"_"=>["~", "\\.php$"], "fastcgi_pass"=>[["127.0.0.1:1025"]]}
|
|
1
|
+
---
|
|
2
|
+
title: About the nginx_conf Resource
|
|
3
|
+
platform: linux
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# nginx_conf
|
|
7
|
+
|
|
8
|
+
Use the `nginx_conf` InSpec resource to test configuration data for the NGINX server located at `/etc/nginx/nginx.conf` on Linux and Unix platforms.
|
|
9
|
+
|
|
10
|
+
**Stability: Experimental**
|
|
11
|
+
|
|
12
|
+
<br>
|
|
13
|
+
|
|
14
|
+
## Syntax
|
|
15
|
+
|
|
16
|
+
An `nginx_conf` resource block declares the client NGINX configuration data to be tested:
|
|
17
|
+
|
|
18
|
+
describe nginx_conf.params['pid'] do
|
|
19
|
+
it { should cmp 'logs/nginx.pid' }
|
|
20
|
+
end
|
|
21
|
+
|
|
22
|
+
where
|
|
23
|
+
|
|
24
|
+
* `nginx_conf` is the resource to reference your NGINX configuration
|
|
25
|
+
* `params` accesses all its parameters
|
|
26
|
+
* `params['pid']` selects the `pid` entry from the global NGINX configuration
|
|
27
|
+
* `{ should cmp 'logs/nginx.pid' }` tests if the PID is set to `logs/nginx.pid` (via `cmp` matcher)
|
|
28
|
+
|
|
29
|
+
<br>
|
|
30
|
+
|
|
31
|
+
## Examples
|
|
32
|
+
|
|
33
|
+
The following examples show how to use this InSpec audit resource.
|
|
34
|
+
|
|
35
|
+
### Find a specific server
|
|
36
|
+
|
|
37
|
+
servers = nginx_conf.servers
|
|
38
|
+
domain2 = servers.find { |s| s.params['server_name'].flatten.include? 'domain2.com' }
|
|
39
|
+
describe 'No server serves domain2' do
|
|
40
|
+
subject { domain2 }
|
|
41
|
+
it { should be_nil }
|
|
42
|
+
end
|
|
43
|
+
|
|
44
|
+
### Test a raw parameter
|
|
45
|
+
|
|
46
|
+
describe nginx_conf.params['worker_processes'].flatten do
|
|
47
|
+
it { should cmp 5 }
|
|
48
|
+
end
|
|
49
|
+
|
|
50
|
+
<br>
|
|
51
|
+
|
|
52
|
+
## Matchers
|
|
53
|
+
|
|
54
|
+
For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
|
55
|
+
|
|
56
|
+
### http
|
|
57
|
+
|
|
58
|
+
Retrieves all `http` entries in the configuration file.
|
|
59
|
+
|
|
60
|
+
nginx_conf.http
|
|
61
|
+
=> nginx_conf /etc/nginx/nginx.conf, http entries
|
|
62
|
+
|
|
63
|
+
It provides further access to all individual entries, servers, and locations.
|
|
64
|
+
|
|
65
|
+
nginx_conf.http.entries
|
|
66
|
+
=> [nginx_conf /etc/nginx/nginx.conf, http entry ...]
|
|
67
|
+
|
|
68
|
+
nginx_conf.http.servers
|
|
69
|
+
=> [nginx_conf /etc/nginx/nginx.conf, server entry ...]
|
|
70
|
+
|
|
71
|
+
nginx_conf.http.locations
|
|
72
|
+
=> [nginx_conf /etc/nginx/nginx.conf, location entry ...]
|
|
73
|
+
|
|
74
|
+
You can access each of these from the array and inspect it further (see below).
|
|
75
|
+
|
|
76
|
+
### servers
|
|
77
|
+
|
|
78
|
+
Retrieve all `servers` entries in the configuration:
|
|
79
|
+
|
|
80
|
+
# all servers across all configs aggregated:
|
|
81
|
+
nginx_conf.servers
|
|
82
|
+
=> [nginx_conf /etc/nginx/nginx.conf, server entry ...]
|
|
83
|
+
|
|
84
|
+
# servers that belong to a specific http entry:
|
|
85
|
+
nginx_conf.http.entries[0].servers
|
|
86
|
+
=> [nginx_conf /etc/nginx/nginx.conf, server entry ...]
|
|
87
|
+
|
|
88
|
+
Servers provide access to all their locations, parent http entry, and raw parameters:
|
|
89
|
+
|
|
90
|
+
server = nginx_conf.servers[0]
|
|
91
|
+
|
|
92
|
+
server.locations
|
|
93
|
+
=> [nginx_conf /etc/nginx/nginx.conf, location entry ...]
|
|
94
|
+
|
|
95
|
+
server.parent
|
|
96
|
+
=> nginx_conf /etc/nginx/nginx.conf, http entry
|
|
97
|
+
|
|
98
|
+
server.params
|
|
99
|
+
=> {"listen"=>[["85"]],
|
|
100
|
+
"server_name"=>[["domain1.com", "www.domain1.com"]],
|
|
101
|
+
"root"=>[["html"]],
|
|
102
|
+
"location"=>[{"_"=>["~", "\\.php$"], "fastcgi_pass"=>[["127.0.0.1:1025"]]}]}
|
|
103
|
+
|
|
104
|
+
### locations
|
|
105
|
+
|
|
106
|
+
Retrieve all `location` entries in the configuration:
|
|
107
|
+
|
|
108
|
+
# all locations across all configs aggregated:
|
|
109
|
+
nginx_conf.locations
|
|
110
|
+
=> [nginx_conf /etc/nginx/nginx.conf, location entry ...]
|
|
111
|
+
|
|
112
|
+
# locations of a http entry aggregated:
|
|
113
|
+
nginx_conf.http.entries[0].locations
|
|
114
|
+
=> [nginx_conf /etc/nginx/nginx.conf, location entry ...]
|
|
115
|
+
|
|
116
|
+
# locations of a specific server:
|
|
117
|
+
nginx_conf.servers[0].locations
|
|
118
|
+
=> [nginx_conf /etc/nginx/nginx.conf, location entry ...]
|
|
119
|
+
|
|
120
|
+
Locations provide access to their parent server entry and raw parameters:
|
|
121
|
+
|
|
122
|
+
location = nginx_conf.locations[0]
|
|
123
|
+
|
|
124
|
+
location.parent
|
|
125
|
+
=> nginx_conf /etc/nginx/nginx.conf, server entry
|
|
126
|
+
|
|
127
|
+
location.params
|
|
128
|
+
=> {"_"=>["~", "\\.php$"], "fastcgi_pass"=>[["127.0.0.1:1025"]]}
|