inspec 2.1.21 → 2.1.30
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.rubocop.yml +101 -101
- data/CHANGELOG.md +3062 -3045
- data/Gemfile +56 -56
- data/LICENSE +14 -14
- data/MAINTAINERS.md +33 -33
- data/MAINTAINERS.toml +52 -52
- data/README.md +447 -447
- data/Rakefile +322 -322
- data/bin/inspec +12 -12
- data/docs/.gitignore +2 -2
- data/docs/README.md +40 -40
- data/docs/dsl_inspec.md +258 -258
- data/docs/dsl_resource.md +100 -100
- data/docs/glossary.md +99 -99
- data/docs/habitat.md +191 -191
- data/docs/inspec_and_friends.md +114 -114
- data/docs/matchers.md +169 -169
- data/docs/migration.md +293 -293
- data/docs/platforms.md +118 -118
- data/docs/plugin_kitchen_inspec.md +50 -50
- data/docs/profiles.md +376 -376
- data/docs/reporters.md +105 -105
- data/docs/resources/aide_conf.md.erb +75 -75
- data/docs/resources/apache.md.erb +67 -67
- data/docs/resources/apache_conf.md.erb +68 -68
- data/docs/resources/apt.md.erb +71 -71
- data/docs/resources/audit_policy.md.erb +47 -47
- data/docs/resources/auditd.md.erb +79 -79
- data/docs/resources/auditd_conf.md.erb +68 -68
- data/docs/resources/aws_cloudtrail_trail.md.erb +140 -140
- data/docs/resources/aws_cloudtrail_trails.md.erb +81 -81
- data/docs/resources/aws_cloudwatch_alarm.md.erb +86 -86
- data/docs/resources/aws_cloudwatch_log_metric_filter.md.erb +151 -151
- data/docs/resources/aws_config_delivery_channel.md +79 -79
- data/docs/resources/aws_config_recorder.md.erb +71 -71
- data/docs/resources/aws_ec2_instance.md.erb +106 -106
- data/docs/resources/aws_iam_access_key.md.erb +123 -123
- data/docs/resources/aws_iam_access_keys.md.erb +198 -198
- data/docs/resources/aws_iam_group.md.erb +46 -46
- data/docs/resources/aws_iam_groups.md.erb +43 -43
- data/docs/resources/aws_iam_password_policy.md.erb +76 -76
- data/docs/resources/aws_iam_policies.md.erb +82 -82
- data/docs/resources/aws_iam_policy.md.erb +144 -144
- data/docs/resources/aws_iam_role.md.erb +63 -63
- data/docs/resources/aws_iam_root_user.md.erb +70 -58
- data/docs/resources/aws_iam_user.md.erb +64 -64
- data/docs/resources/aws_iam_users.md.erb +89 -89
- data/docs/resources/aws_kms_key.md.erb +171 -171
- data/docs/resources/aws_kms_keys.md.erb +84 -84
- data/docs/resources/aws_rds_instance.md.erb +60 -60
- data/docs/resources/aws_route_table.md.erb +47 -47
- data/docs/resources/aws_route_tables.md.erb +49 -0
- data/docs/resources/aws_s3_bucket.md.erb +134 -134
- data/docs/resources/aws_s3_bucket_object.md.erb +83 -83
- data/docs/resources/aws_s3_buckets.md.erb +53 -0
- data/docs/resources/aws_security_group.md.erb +151 -151
- data/docs/resources/aws_security_groups.md.erb +91 -91
- data/docs/resources/aws_sns_subscription.md.erb +124 -124
- data/docs/resources/aws_sns_topic.md.erb +63 -63
- data/docs/resources/aws_sns_topics.md.erb +52 -52
- data/docs/resources/aws_subnet.md.erb +134 -134
- data/docs/resources/aws_subnets.md.erb +126 -126
- data/docs/resources/aws_vpc.md.erb +120 -120
- data/docs/resources/aws_vpcs.md.erb +48 -48
- data/docs/resources/azure_generic_resource.md.erb +171 -171
- data/docs/resources/azure_resource_group.md.erb +284 -284
- data/docs/resources/azure_virtual_machine.md.erb +347 -347
- data/docs/resources/azure_virtual_machine_data_disk.md.erb +224 -224
- data/docs/resources/bash.md.erb +75 -75
- data/docs/resources/bond.md.erb +90 -90
- data/docs/resources/bridge.md.erb +57 -57
- data/docs/resources/bsd_service.md.erb +67 -67
- data/docs/resources/chocolatey_package.md.erb +58 -0
- data/docs/resources/command.md.erb +138 -138
- data/docs/resources/cpan.md.erb +79 -79
- data/docs/resources/cran.md.erb +64 -64
- data/docs/resources/crontab.md.erb +89 -89
- data/docs/resources/csv.md.erb +54 -54
- data/docs/resources/dh_params.md.erb +205 -205
- data/docs/resources/directory.md.erb +30 -30
- data/docs/resources/docker.md.erb +219 -219
- data/docs/resources/docker_container.md.erb +103 -103
- data/docs/resources/docker_image.md.erb +94 -94
- data/docs/resources/docker_service.md.erb +114 -114
- data/docs/resources/elasticsearch.md.erb +242 -242
- data/docs/resources/etc_fstab.md.erb +125 -125
- data/docs/resources/etc_group.md.erb +75 -75
- data/docs/resources/etc_hosts.md.erb +78 -78
- data/docs/resources/etc_hosts_allow.md.erb +74 -74
- data/docs/resources/etc_hosts_deny.md.erb +74 -74
- data/docs/resources/file.md.erb +526 -526
- data/docs/resources/filesystem.md.erb +41 -41
- data/docs/resources/firewalld.md.erb +107 -107
- data/docs/resources/gem.md.erb +79 -79
- data/docs/resources/group.md.erb +61 -61
- data/docs/resources/grub_conf.md.erb +101 -101
- data/docs/resources/host.md.erb +86 -86
- data/docs/resources/http.md.erb +196 -196
- data/docs/resources/iis_app.md.erb +122 -122
- data/docs/resources/iis_site.md.erb +135 -135
- data/docs/resources/inetd_conf.md.erb +94 -94
- data/docs/resources/ini.md.erb +76 -76
- data/docs/resources/interface.md.erb +58 -58
- data/docs/resources/iptables.md.erb +64 -64
- data/docs/resources/json.md.erb +63 -63
- data/docs/resources/kernel_module.md.erb +120 -120
- data/docs/resources/kernel_parameter.md.erb +53 -53
- data/docs/resources/key_rsa.md.erb +85 -85
- data/docs/resources/launchd_service.md.erb +57 -57
- data/docs/resources/limits_conf.md.erb +75 -75
- data/docs/resources/login_defs.md.erb +71 -71
- data/docs/resources/mount.md.erb +69 -69
- data/docs/resources/mssql_session.md.erb +60 -60
- data/docs/resources/mysql_conf.md.erb +99 -99
- data/docs/resources/mysql_session.md.erb +74 -74
- data/docs/resources/nginx.md.erb +79 -79
- data/docs/resources/nginx_conf.md.erb +138 -138
- data/docs/resources/npm.md.erb +60 -60
- data/docs/resources/ntp_conf.md.erb +60 -60
- data/docs/resources/oneget.md.erb +53 -53
- data/docs/resources/oracledb_session.md.erb +52 -52
- data/docs/resources/os.md.erb +141 -141
- data/docs/resources/os_env.md.erb +78 -78
- data/docs/resources/package.md.erb +120 -120
- data/docs/resources/packages.md.erb +67 -67
- data/docs/resources/parse_config.md.erb +103 -103
- data/docs/resources/parse_config_file.md.erb +138 -138
- data/docs/resources/passwd.md.erb +141 -141
- data/docs/resources/pip.md.erb +67 -67
- data/docs/resources/port.md.erb +137 -137
- data/docs/resources/postgres_conf.md.erb +79 -79
- data/docs/resources/postgres_hba_conf.md.erb +93 -93
- data/docs/resources/postgres_ident_conf.md.erb +76 -76
- data/docs/resources/postgres_session.md.erb +69 -69
- data/docs/resources/powershell.md.erb +102 -102
- data/docs/resources/processes.md.erb +109 -109
- data/docs/resources/rabbitmq_config.md.erb +41 -41
- data/docs/resources/registry_key.md.erb +158 -158
- data/docs/resources/runit_service.md.erb +57 -57
- data/docs/resources/security_policy.md.erb +47 -47
- data/docs/resources/service.md.erb +121 -121
- data/docs/resources/shadow.md.erb +146 -146
- data/docs/resources/ssh_config.md.erb +73 -73
- data/docs/resources/sshd_config.md.erb +83 -83
- data/docs/resources/ssl.md.erb +119 -119
- data/docs/resources/sys_info.md.erb +42 -42
- data/docs/resources/systemd_service.md.erb +57 -57
- data/docs/resources/sysv_service.md.erb +57 -57
- data/docs/resources/upstart_service.md.erb +57 -57
- data/docs/resources/user.md.erb +140 -140
- data/docs/resources/users.md.erb +127 -127
- data/docs/resources/vbscript.md.erb +55 -55
- data/docs/resources/virtualization.md.erb +57 -57
- data/docs/resources/windows_feature.md.erb +47 -47
- data/docs/resources/windows_hotfix.md.erb +53 -53
- data/docs/resources/windows_task.md.erb +95 -95
- data/docs/resources/wmi.md.erb +81 -81
- data/docs/resources/x509_certificate.md.erb +151 -151
- data/docs/resources/xinetd_conf.md.erb +156 -156
- data/docs/resources/xml.md.erb +85 -85
- data/docs/resources/yaml.md.erb +69 -69
- data/docs/resources/yum.md.erb +98 -98
- data/docs/resources/zfs_dataset.md.erb +53 -53
- data/docs/resources/zfs_pool.md.erb +47 -47
- data/docs/ruby_usage.md +203 -203
- data/docs/shared/matcher_be.md.erb +1 -1
- data/docs/shared/matcher_cmp.md.erb +43 -43
- data/docs/shared/matcher_eq.md.erb +3 -3
- data/docs/shared/matcher_include.md.erb +1 -1
- data/docs/shared/matcher_match.md.erb +1 -1
- data/docs/shell.md +217 -217
- data/examples/README.md +8 -8
- data/examples/inheritance/README.md +65 -65
- data/examples/inheritance/controls/example.rb +14 -14
- data/examples/inheritance/inspec.yml +15 -15
- data/examples/kitchen-ansible/.kitchen.yml +25 -25
- data/examples/kitchen-ansible/Gemfile +19 -19
- data/examples/kitchen-ansible/README.md +53 -53
- data/examples/kitchen-ansible/files/nginx.repo +6 -6
- data/examples/kitchen-ansible/tasks/main.yml +16 -16
- data/examples/kitchen-ansible/test/integration/default/default.yml +5 -5
- data/examples/kitchen-ansible/test/integration/default/web_spec.rb +28 -28
- data/examples/kitchen-chef/.kitchen.yml +20 -20
- data/examples/kitchen-chef/Berksfile +3 -3
- data/examples/kitchen-chef/Gemfile +19 -19
- data/examples/kitchen-chef/README.md +27 -27
- data/examples/kitchen-chef/metadata.rb +7 -7
- data/examples/kitchen-chef/recipes/default.rb +6 -6
- data/examples/kitchen-chef/recipes/nginx.rb +30 -30
- data/examples/kitchen-chef/test/integration/default/web_spec.rb +28 -28
- data/examples/kitchen-puppet/.kitchen.yml +22 -22
- data/examples/kitchen-puppet/Gemfile +20 -20
- data/examples/kitchen-puppet/Puppetfile +25 -25
- data/examples/kitchen-puppet/README.md +53 -53
- data/examples/kitchen-puppet/manifests/site.pp +33 -33
- data/examples/kitchen-puppet/metadata.json +11 -11
- data/examples/kitchen-puppet/test/integration/default/web_spec.rb +28 -28
- data/examples/meta-profile/README.md +37 -37
- data/examples/meta-profile/controls/example.rb +13 -13
- data/examples/meta-profile/inspec.yml +13 -13
- data/examples/profile-attribute.yml +2 -2
- data/examples/profile-attribute/README.md +14 -14
- data/examples/profile-attribute/controls/example.rb +11 -11
- data/examples/profile-attribute/inspec.yml +8 -8
- data/examples/profile-aws/controls/iam_password_policy_expiration.rb +8 -8
- data/examples/profile-aws/controls/iam_password_policy_max_age.rb +8 -8
- data/examples/profile-aws/controls/iam_root_user_mfa.rb +8 -8
- data/examples/profile-aws/controls/iam_users_access_key_age.rb +8 -8
- data/examples/profile-aws/controls/iam_users_console_users_mfa.rb +8 -8
- data/examples/profile-aws/inspec.yml +11 -11
- data/examples/profile-azure/controls/azure_resource_group_example.rb +24 -24
- data/examples/profile-azure/controls/azure_vm_example.rb +29 -29
- data/examples/profile-azure/inspec.yml +11 -11
- data/examples/profile-sensitive/README.md +29 -29
- data/examples/profile-sensitive/controls/sensitive-failures.rb +9 -9
- data/examples/profile-sensitive/controls/sensitive.rb +9 -9
- data/examples/profile-sensitive/inspec.yml +8 -8
- data/examples/profile/README.md +48 -48
- data/examples/profile/controls/example.rb +23 -23
- data/examples/profile/controls/gordon.rb +36 -36
- data/examples/profile/controls/meta.rb +34 -34
- data/examples/profile/inspec.yml +10 -10
- data/examples/profile/libraries/gordon_config.rb +59 -53
- data/inspec.gemspec +47 -47
- data/lib/bundles/README.md +3 -3
- data/lib/bundles/inspec-artifact.rb +7 -7
- data/lib/bundles/inspec-artifact/README.md +1 -1
- data/lib/bundles/inspec-artifact/cli.rb +277 -277
- data/lib/bundles/inspec-compliance.rb +16 -16
- data/lib/bundles/inspec-compliance/.kitchen.yml +20 -20
- data/lib/bundles/inspec-compliance/README.md +185 -185
- data/lib/bundles/inspec-compliance/api.rb +316 -316
- data/lib/bundles/inspec-compliance/api/login.rb +152 -152
- data/lib/bundles/inspec-compliance/bootstrap.sh +41 -41
- data/lib/bundles/inspec-compliance/cli.rb +254 -254
- data/lib/bundles/inspec-compliance/configuration.rb +103 -103
- data/lib/bundles/inspec-compliance/http.rb +86 -86
- data/lib/bundles/inspec-compliance/support.rb +36 -36
- data/lib/bundles/inspec-compliance/target.rb +98 -98
- data/lib/bundles/inspec-compliance/test/integration/default/cli.rb +93 -93
- data/lib/bundles/inspec-habitat.rb +12 -12
- data/lib/bundles/inspec-habitat/cli.rb +36 -36
- data/lib/bundles/inspec-habitat/log.rb +10 -10
- data/lib/bundles/inspec-habitat/profile.rb +391 -391
- data/lib/bundles/inspec-init.rb +8 -8
- data/lib/bundles/inspec-init/README.md +31 -31
- data/lib/bundles/inspec-init/cli.rb +97 -97
- data/lib/bundles/inspec-init/templates/profile/README.md +3 -3
- data/lib/bundles/inspec-init/templates/profile/controls/example.rb +19 -19
- data/lib/bundles/inspec-init/templates/profile/inspec.yml +8 -8
- data/lib/bundles/inspec-supermarket.rb +13 -13
- data/lib/bundles/inspec-supermarket/README.md +45 -45
- data/lib/bundles/inspec-supermarket/api.rb +84 -84
- data/lib/bundles/inspec-supermarket/cli.rb +73 -73
- data/lib/bundles/inspec-supermarket/target.rb +34 -34
- data/lib/fetchers/git.rb +163 -163
- data/lib/fetchers/local.rb +74 -74
- data/lib/fetchers/mock.rb +35 -35
- data/lib/fetchers/url.rb +204 -204
- data/lib/inspec.rb +24 -24
- data/lib/inspec/archive/tar.rb +29 -29
- data/lib/inspec/archive/zip.rb +19 -19
- data/lib/inspec/backend.rb +93 -93
- data/lib/inspec/base_cli.rb +363 -357
- data/lib/inspec/cached_fetcher.rb +66 -66
- data/lib/inspec/cli.rb +292 -292
- data/lib/inspec/completions/bash.sh.erb +45 -45
- data/lib/inspec/completions/fish.sh.erb +34 -34
- data/lib/inspec/completions/zsh.sh.erb +61 -61
- data/lib/inspec/control_eval_context.rb +179 -179
- data/lib/inspec/dependencies/cache.rb +72 -72
- data/lib/inspec/dependencies/dependency_set.rb +92 -92
- data/lib/inspec/dependencies/lockfile.rb +115 -115
- data/lib/inspec/dependencies/requirement.rb +123 -123
- data/lib/inspec/dependencies/resolver.rb +86 -86
- data/lib/inspec/describe.rb +27 -27
- data/lib/inspec/dsl.rb +66 -66
- data/lib/inspec/dsl_shared.rb +33 -33
- data/lib/inspec/env_printer.rb +157 -157
- data/lib/inspec/errors.rb +14 -13
- data/lib/inspec/exceptions.rb +12 -12
- data/lib/inspec/expect.rb +45 -45
- data/lib/inspec/fetcher.rb +45 -45
- data/lib/inspec/file_provider.rb +275 -275
- data/lib/inspec/formatters.rb +3 -3
- data/lib/inspec/formatters/base.rb +259 -250
- data/lib/inspec/formatters/json_rspec.rb +20 -20
- data/lib/inspec/formatters/show_progress.rb +12 -12
- data/lib/inspec/library_eval_context.rb +58 -58
- data/lib/inspec/log.rb +11 -11
- data/lib/inspec/metadata.rb +247 -247
- data/lib/inspec/method_source.rb +24 -24
- data/lib/inspec/objects.rb +14 -14
- data/lib/inspec/objects/attribute.rb +65 -65
- data/lib/inspec/objects/control.rb +61 -61
- data/lib/inspec/objects/describe.rb +92 -92
- data/lib/inspec/objects/each_loop.rb +36 -36
- data/lib/inspec/objects/list.rb +15 -15
- data/lib/inspec/objects/or_test.rb +40 -40
- data/lib/inspec/objects/ruby_helper.rb +15 -15
- data/lib/inspec/objects/tag.rb +27 -27
- data/lib/inspec/objects/test.rb +87 -87
- data/lib/inspec/objects/value.rb +27 -27
- data/lib/inspec/plugins.rb +60 -60
- data/lib/inspec/plugins/cli.rb +24 -24
- data/lib/inspec/plugins/fetcher.rb +86 -86
- data/lib/inspec/plugins/resource.rb +135 -135
- data/lib/inspec/plugins/secret.rb +15 -15
- data/lib/inspec/plugins/source_reader.rb +40 -40
- data/lib/inspec/polyfill.rb +12 -12
- data/lib/inspec/profile.rb +513 -513
- data/lib/inspec/profile_context.rb +208 -208
- data/lib/inspec/profile_vendor.rb +66 -66
- data/lib/inspec/reporters.rb +60 -54
- data/lib/inspec/reporters/automate.rb +76 -0
- data/lib/inspec/reporters/base.rb +25 -24
- data/lib/inspec/reporters/cli.rb +356 -356
- data/lib/inspec/reporters/json.rb +116 -116
- data/lib/inspec/reporters/json_min.rb +48 -48
- data/lib/inspec/reporters/junit.rb +77 -77
- data/lib/inspec/require_loader.rb +33 -33
- data/lib/inspec/resource.rb +187 -186
- data/lib/inspec/rule.rb +266 -266
- data/lib/inspec/runner.rb +345 -345
- data/lib/inspec/runner_mock.rb +41 -41
- data/lib/inspec/runner_rspec.rb +175 -175
- data/lib/inspec/runtime_profile.rb +26 -26
- data/lib/inspec/schema.rb +213 -213
- data/lib/inspec/secrets.rb +19 -19
- data/lib/inspec/secrets/yaml.rb +30 -30
- data/lib/inspec/shell.rb +220 -220
- data/lib/inspec/shell_detector.rb +90 -90
- data/lib/inspec/source_reader.rb +29 -29
- data/lib/inspec/version.rb +8 -8
- data/lib/matchers/matchers.rb +339 -339
- data/lib/resource_support/aws.rb +49 -47
- data/lib/resource_support/aws/aws_backend_base.rb +12 -12
- data/lib/resource_support/aws/aws_backend_factory_mixin.rb +12 -12
- data/lib/resource_support/aws/aws_plural_resource_mixin.rb +21 -21
- data/lib/resource_support/aws/aws_resource_mixin.rb +66 -66
- data/lib/resource_support/aws/aws_singular_resource_mixin.rb +24 -24
- data/lib/resources/aide_conf.rb +151 -151
- data/lib/resources/apache.rb +48 -48
- data/lib/resources/apache_conf.rb +149 -149
- data/lib/resources/apt.rb +149 -149
- data/lib/resources/audit_policy.rb +63 -63
- data/lib/resources/auditd.rb +231 -231
- data/lib/resources/auditd_conf.rb +46 -46
- data/lib/resources/aws/aws_cloudtrail_trail.rb +77 -77
- data/lib/resources/aws/aws_cloudtrail_trails.rb +47 -47
- data/lib/resources/aws/aws_cloudwatch_alarm.rb +62 -62
- data/lib/resources/aws/aws_cloudwatch_log_metric_filter.rb +100 -100
- data/lib/resources/aws/aws_config_delivery_channel.rb +76 -76
- data/lib/resources/aws/aws_config_recorder.rb +98 -98
- data/lib/resources/aws/aws_ec2_instance.rb +157 -157
- data/lib/resources/aws/aws_iam_access_key.rb +106 -106
- data/lib/resources/aws/aws_iam_access_keys.rb +149 -149
- data/lib/resources/aws/aws_iam_group.rb +56 -56
- data/lib/resources/aws/aws_iam_groups.rb +52 -52
- data/lib/resources/aws/aws_iam_password_policy.rb +116 -116
- data/lib/resources/aws/aws_iam_policies.rb +53 -53
- data/lib/resources/aws/aws_iam_policy.rb +125 -125
- data/lib/resources/aws/aws_iam_role.rb +51 -51
- data/lib/resources/aws/aws_iam_root_user.rb +78 -60
- data/lib/resources/aws/aws_iam_user.rb +111 -111
- data/lib/resources/aws/aws_iam_users.rb +108 -108
- data/lib/resources/aws/aws_kms_key.rb +96 -96
- data/lib/resources/aws/aws_kms_keys.rb +53 -53
- data/lib/resources/aws/aws_rds_instance.rb +71 -71
- data/lib/resources/aws/aws_route_table.rb +63 -63
- data/lib/resources/aws/aws_route_tables.rb +60 -0
- data/lib/resources/aws/aws_s3_bucket.rb +115 -115
- data/lib/resources/aws/aws_s3_bucket_object.rb +82 -82
- data/lib/resources/aws/aws_s3_buckets.rb +51 -0
- data/lib/resources/aws/aws_security_group.rb +93 -93
- data/lib/resources/aws/aws_security_groups.rb +68 -68
- data/lib/resources/aws/aws_sns_subscription.rb +78 -78
- data/lib/resources/aws/aws_sns_topic.rb +53 -53
- data/lib/resources/aws/aws_sns_topics.rb +56 -56
- data/lib/resources/aws/aws_subnet.rb +88 -88
- data/lib/resources/aws/aws_subnets.rb +53 -53
- data/lib/resources/aws/aws_vpc.rb +69 -69
- data/lib/resources/aws/aws_vpcs.rb +45 -45
- data/lib/resources/azure/azure_backend.rb +377 -377
- data/lib/resources/azure/azure_generic_resource.rb +59 -59
- data/lib/resources/azure/azure_resource_group.rb +152 -152
- data/lib/resources/azure/azure_virtual_machine.rb +264 -264
- data/lib/resources/azure/azure_virtual_machine_data_disk.rb +134 -134
- data/lib/resources/bash.rb +35 -35
- data/lib/resources/bond.rb +69 -69
- data/lib/resources/bridge.rb +122 -122
- data/lib/resources/chocolatey_package.rb +78 -0
- data/lib/resources/command.rb +73 -73
- data/lib/resources/cpan.rb +58 -58
- data/lib/resources/cran.rb +64 -64
- data/lib/resources/crontab.rb +169 -169
- data/lib/resources/csv.rb +56 -56
- data/lib/resources/dh_params.rb +77 -77
- data/lib/resources/directory.rb +25 -25
- data/lib/resources/docker.rb +236 -236
- data/lib/resources/docker_container.rb +89 -89
- data/lib/resources/docker_image.rb +83 -83
- data/lib/resources/docker_object.rb +57 -57
- data/lib/resources/docker_service.rb +90 -90
- data/lib/resources/elasticsearch.rb +169 -169
- data/lib/resources/etc_fstab.rb +94 -94
- data/lib/resources/etc_group.rb +152 -152
- data/lib/resources/etc_hosts.rb +66 -66
- data/lib/resources/etc_hosts_allow_deny.rb +112 -112
- data/lib/resources/file.rb +298 -298
- data/lib/resources/filesystem.rb +31 -31
- data/lib/resources/firewalld.rb +143 -143
- data/lib/resources/gem.rb +70 -70
- data/lib/resources/groups.rb +215 -215
- data/lib/resources/grub_conf.rb +227 -227
- data/lib/resources/host.rb +306 -306
- data/lib/resources/http.rb +253 -253
- data/lib/resources/iis_app.rb +101 -101
- data/lib/resources/iis_site.rb +148 -148
- data/lib/resources/inetd_conf.rb +54 -54
- data/lib/resources/ini.rb +29 -29
- data/lib/resources/interface.rb +129 -129
- data/lib/resources/iptables.rb +80 -80
- data/lib/resources/json.rb +107 -107
- data/lib/resources/kernel_module.rb +107 -107
- data/lib/resources/kernel_parameter.rb +58 -58
- data/lib/resources/key_rsa.rb +61 -61
- data/lib/resources/limits_conf.rb +46 -46
- data/lib/resources/login_def.rb +57 -57
- data/lib/resources/mount.rb +88 -88
- data/lib/resources/mssql_session.rb +101 -101
- data/lib/resources/mysql.rb +82 -81
- data/lib/resources/mysql_conf.rb +127 -127
- data/lib/resources/mysql_session.rb +85 -85
- data/lib/resources/nginx.rb +96 -96
- data/lib/resources/nginx_conf.rb +226 -226
- data/lib/resources/npm.rb +48 -48
- data/lib/resources/ntp_conf.rb +51 -51
- data/lib/resources/oneget.rb +71 -71
- data/lib/resources/oracledb_session.rb +139 -139
- data/lib/resources/os.rb +36 -36
- data/lib/resources/os_env.rb +75 -75
- data/lib/resources/package.rb +370 -370
- data/lib/resources/packages.rb +111 -111
- data/lib/resources/parse_config.rb +112 -112
- data/lib/resources/passwd.rb +76 -76
- data/lib/resources/pip.rb +130 -130
- data/lib/resources/platform.rb +109 -109
- data/lib/resources/port.rb +771 -771
- data/lib/resources/postgres.rb +131 -130
- data/lib/resources/postgres_conf.rb +114 -114
- data/lib/resources/postgres_hba_conf.rb +90 -90
- data/lib/resources/postgres_ident_conf.rb +79 -79
- data/lib/resources/postgres_session.rb +71 -71
- data/lib/resources/powershell.rb +66 -66
- data/lib/resources/processes.rb +204 -204
- data/lib/resources/rabbitmq_conf.rb +51 -51
- data/lib/resources/registry_key.rb +297 -297
- data/lib/resources/security_policy.rb +180 -180
- data/lib/resources/service.rb +794 -790
- data/lib/resources/shadow.rb +149 -149
- data/lib/resources/ssh_conf.rb +97 -97
- data/lib/resources/ssl.rb +99 -99
- data/lib/resources/sys_info.rb +28 -28
- data/lib/resources/toml.rb +32 -32
- data/lib/resources/users.rb +654 -654
- data/lib/resources/vbscript.rb +68 -68
- data/lib/resources/virtualization.rb +247 -247
- data/lib/resources/windows_feature.rb +84 -84
- data/lib/resources/windows_hotfix.rb +35 -35
- data/lib/resources/windows_task.rb +102 -102
- data/lib/resources/wmi.rb +110 -110
- data/lib/resources/x509_certificate.rb +137 -137
- data/lib/resources/xinetd.rb +106 -106
- data/lib/resources/xml.rb +46 -46
- data/lib/resources/yaml.rb +43 -43
- data/lib/resources/yum.rb +180 -180
- data/lib/resources/zfs_dataset.rb +60 -60
- data/lib/resources/zfs_pool.rb +49 -49
- data/lib/source_readers/flat.rb +39 -39
- data/lib/source_readers/inspec.rb +75 -75
- data/lib/utils/command_wrapper.rb +27 -27
- data/lib/utils/convert.rb +12 -12
- data/lib/utils/database_helpers.rb +77 -77
- data/lib/utils/erlang_parser.rb +192 -192
- data/lib/utils/file_reader.rb +25 -25
- data/lib/utils/filter.rb +273 -273
- data/lib/utils/filter_array.rb +27 -27
- data/lib/utils/find_files.rb +44 -44
- data/lib/utils/hash.rb +41 -41
- data/lib/utils/json_log.rb +18 -18
- data/lib/utils/latest_version.rb +22 -22
- data/lib/utils/modulator.rb +12 -12
- data/lib/utils/nginx_parser.rb +85 -85
- data/lib/utils/object_traversal.rb +49 -49
- data/lib/utils/parser.rb +274 -274
- data/lib/utils/plugin_registry.rb +93 -93
- data/lib/utils/simpleconfig.rb +120 -120
- data/lib/utils/spdx.rb +13 -13
- data/lib/utils/spdx.txt +343 -343
- metadata +9 -2
|
@@ -1,89 +1,89 @@
|
|
|
1
|
-
---
|
|
2
|
-
title: About the crontab Resource
|
|
3
|
-
platform: linux
|
|
4
|
-
---
|
|
5
|
-
|
|
6
|
-
# crontab
|
|
7
|
-
|
|
8
|
-
Use the `crontab` InSpec audit resource to test the crontab entries for a particular user on the system. It recognizes special time strings (@yearly, @weekly, etc).
|
|
9
|
-
|
|
10
|
-
<br>
|
|
11
|
-
|
|
12
|
-
## Syntax
|
|
13
|
-
|
|
14
|
-
A `crontab` resource block declares a user (which defaults to the current user, if not specified), and then the details to be tested, such as the schedule elements for each crontab entry or the commands itself:
|
|
15
|
-
|
|
16
|
-
describe crontab do
|
|
17
|
-
its('commands') { should include '/some/scheduled/task.sh' }
|
|
18
|
-
end
|
|
19
|
-
|
|
20
|
-
<br>
|
|
21
|
-
|
|
22
|
-
## Examples
|
|
23
|
-
|
|
24
|
-
The following examples show how to use this InSpec audit resource.
|
|
25
|
-
|
|
26
|
-
### Test that root's crontab has a particular command
|
|
27
|
-
|
|
28
|
-
describe crontab('root') do
|
|
29
|
-
its('commands') { should include '/path/to/some/script' }
|
|
30
|
-
end
|
|
31
|
-
|
|
32
|
-
### Test that myuser's crontab entry for command '/home/myuser/build.sh' runs every minute
|
|
33
|
-
|
|
34
|
-
describe crontab('myuser').commands('/home/myuser/build.sh') do
|
|
35
|
-
its('hours') { should cmp '*' }
|
|
36
|
-
its('minutes') { should cmp '*' }
|
|
37
|
-
end
|
|
38
|
-
|
|
39
|
-
### Test that the logged-in user's crontab has no tasks set to run on every hour and every minute
|
|
40
|
-
|
|
41
|
-
describe crontab.where({'hour' => '*', 'minute' => '*'}) do
|
|
42
|
-
its('entries.length') { should cmp '0' }
|
|
43
|
-
end
|
|
44
|
-
|
|
45
|
-
### Test that the logged-in user's crontab contains a single command that matches a pattern
|
|
46
|
-
|
|
47
|
-
describe crontab.where { command =~ /a partial command string/ } do
|
|
48
|
-
its('entries.length') { should cmp 1 }
|
|
49
|
-
end
|
|
50
|
-
|
|
51
|
-
### Test a special time string (i.e., @yearly /root/annual_report.sh)
|
|
52
|
-
|
|
53
|
-
describe crontab.commands('/root/annual_report.sh') do
|
|
54
|
-
its('hours') { should cmp '0' }
|
|
55
|
-
its('minutes') { should cmp '0' }
|
|
56
|
-
its('days') { should cmp '1' }
|
|
57
|
-
its('months') { should cmp '1' }
|
|
58
|
-
end
|
|
59
|
-
|
|
60
|
-
### Test @reboot case
|
|
61
|
-
|
|
62
|
-
describe crontab.commands('/root/reboot.sh') do
|
|
63
|
-
its('hours') { should cmp '-1' }
|
|
64
|
-
its('minutes') { should cmp '-1' }
|
|
65
|
-
end
|
|
66
|
-
|
|
67
|
-
<br>
|
|
68
|
-
|
|
69
|
-
## Property Examples
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
### Test a special time string
|
|
73
|
-
|
|
74
|
-
describe crontab do
|
|
75
|
-
its('minutes') { should cmp '0' }
|
|
76
|
-
its('hours') { should cmp '0' }
|
|
77
|
-
its('days') { should cmp '1' }
|
|
78
|
-
its('weekdays') { should cmp '1' }
|
|
79
|
-
its('user') { should include 'username'}
|
|
80
|
-
its('commands') { should include '/some/scheduled/task.sh' }
|
|
81
|
-
end
|
|
82
|
-
|
|
83
|
-
InSpec will automatically interpret crontab-supported special time strings. For example, a crontab entry set to run `@yearly` can be tested as if the entry was manually configured to run on January 1, 12 AM.
|
|
84
|
-
|
|
85
|
-
<br>
|
|
86
|
-
|
|
87
|
-
## Matchers
|
|
88
|
-
|
|
89
|
-
For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
|
1
|
+
---
|
|
2
|
+
title: About the crontab Resource
|
|
3
|
+
platform: linux
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# crontab
|
|
7
|
+
|
|
8
|
+
Use the `crontab` InSpec audit resource to test the crontab entries for a particular user on the system. It recognizes special time strings (@yearly, @weekly, etc).
|
|
9
|
+
|
|
10
|
+
<br>
|
|
11
|
+
|
|
12
|
+
## Syntax
|
|
13
|
+
|
|
14
|
+
A `crontab` resource block declares a user (which defaults to the current user, if not specified), and then the details to be tested, such as the schedule elements for each crontab entry or the commands itself:
|
|
15
|
+
|
|
16
|
+
describe crontab do
|
|
17
|
+
its('commands') { should include '/some/scheduled/task.sh' }
|
|
18
|
+
end
|
|
19
|
+
|
|
20
|
+
<br>
|
|
21
|
+
|
|
22
|
+
## Examples
|
|
23
|
+
|
|
24
|
+
The following examples show how to use this InSpec audit resource.
|
|
25
|
+
|
|
26
|
+
### Test that root's crontab has a particular command
|
|
27
|
+
|
|
28
|
+
describe crontab('root') do
|
|
29
|
+
its('commands') { should include '/path/to/some/script' }
|
|
30
|
+
end
|
|
31
|
+
|
|
32
|
+
### Test that myuser's crontab entry for command '/home/myuser/build.sh' runs every minute
|
|
33
|
+
|
|
34
|
+
describe crontab('myuser').commands('/home/myuser/build.sh') do
|
|
35
|
+
its('hours') { should cmp '*' }
|
|
36
|
+
its('minutes') { should cmp '*' }
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
### Test that the logged-in user's crontab has no tasks set to run on every hour and every minute
|
|
40
|
+
|
|
41
|
+
describe crontab.where({'hour' => '*', 'minute' => '*'}) do
|
|
42
|
+
its('entries.length') { should cmp '0' }
|
|
43
|
+
end
|
|
44
|
+
|
|
45
|
+
### Test that the logged-in user's crontab contains a single command that matches a pattern
|
|
46
|
+
|
|
47
|
+
describe crontab.where { command =~ /a partial command string/ } do
|
|
48
|
+
its('entries.length') { should cmp 1 }
|
|
49
|
+
end
|
|
50
|
+
|
|
51
|
+
### Test a special time string (i.e., @yearly /root/annual_report.sh)
|
|
52
|
+
|
|
53
|
+
describe crontab.commands('/root/annual_report.sh') do
|
|
54
|
+
its('hours') { should cmp '0' }
|
|
55
|
+
its('minutes') { should cmp '0' }
|
|
56
|
+
its('days') { should cmp '1' }
|
|
57
|
+
its('months') { should cmp '1' }
|
|
58
|
+
end
|
|
59
|
+
|
|
60
|
+
### Test @reboot case
|
|
61
|
+
|
|
62
|
+
describe crontab.commands('/root/reboot.sh') do
|
|
63
|
+
its('hours') { should cmp '-1' }
|
|
64
|
+
its('minutes') { should cmp '-1' }
|
|
65
|
+
end
|
|
66
|
+
|
|
67
|
+
<br>
|
|
68
|
+
|
|
69
|
+
## Property Examples
|
|
70
|
+
|
|
71
|
+
|
|
72
|
+
### Test a special time string
|
|
73
|
+
|
|
74
|
+
describe crontab do
|
|
75
|
+
its('minutes') { should cmp '0' }
|
|
76
|
+
its('hours') { should cmp '0' }
|
|
77
|
+
its('days') { should cmp '1' }
|
|
78
|
+
its('weekdays') { should cmp '1' }
|
|
79
|
+
its('user') { should include 'username'}
|
|
80
|
+
its('commands') { should include '/some/scheduled/task.sh' }
|
|
81
|
+
end
|
|
82
|
+
|
|
83
|
+
InSpec will automatically interpret crontab-supported special time strings. For example, a crontab entry set to run `@yearly` can be tested as if the entry was manually configured to run on January 1, 12 AM.
|
|
84
|
+
|
|
85
|
+
<br>
|
|
86
|
+
|
|
87
|
+
## Matchers
|
|
88
|
+
|
|
89
|
+
For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
data/docs/resources/csv.md.erb
CHANGED
|
@@ -1,54 +1,54 @@
|
|
|
1
|
-
---
|
|
2
|
-
title: About the csv Resource
|
|
3
|
-
platform: os
|
|
4
|
-
---
|
|
5
|
-
|
|
6
|
-
# csv
|
|
7
|
-
|
|
8
|
-
Use the `csv` InSpec audit resource to test configuration data in a CSV file.
|
|
9
|
-
|
|
10
|
-
<br>
|
|
11
|
-
|
|
12
|
-
## Syntax
|
|
13
|
-
|
|
14
|
-
A `csv` resource block declares the configuration data to be tested:
|
|
15
|
-
|
|
16
|
-
describe csv('file') do
|
|
17
|
-
its('name') { should cmp 'foo' }
|
|
18
|
-
end
|
|
19
|
-
|
|
20
|
-
where
|
|
21
|
-
|
|
22
|
-
* `'file'` is the path to a CSV file
|
|
23
|
-
* `name` is a configuration setting in a CSV file
|
|
24
|
-
* `should eq 'foo'` tests a value of `name` as read from a CSV file versus the value declared in the test
|
|
25
|
-
|
|
26
|
-
<br>
|
|
27
|
-
|
|
28
|
-
## Examples
|
|
29
|
-
|
|
30
|
-
The following examples show how to use this InSpec audit resource.
|
|
31
|
-
|
|
32
|
-
### Test a CSV file
|
|
33
|
-
|
|
34
|
-
describe csv('some_file.csv') do
|
|
35
|
-
its('setting') { should eq 1 }
|
|
36
|
-
end
|
|
37
|
-
|
|
38
|
-
<br>
|
|
39
|
-
|
|
40
|
-
## Property Examples
|
|
41
|
-
|
|
42
|
-
### name
|
|
43
|
-
|
|
44
|
-
The `name` property tests the value of `name` as read from a CSV file compared to the value declared in the test.
|
|
45
|
-
|
|
46
|
-
its('name') { should cmp 'foo' }
|
|
47
|
-
|
|
48
|
-
<br>
|
|
49
|
-
|
|
50
|
-
## Matchers
|
|
51
|
-
|
|
52
|
-
For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
|
53
|
-
|
|
54
|
-
|
|
1
|
+
---
|
|
2
|
+
title: About the csv Resource
|
|
3
|
+
platform: os
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# csv
|
|
7
|
+
|
|
8
|
+
Use the `csv` InSpec audit resource to test configuration data in a CSV file.
|
|
9
|
+
|
|
10
|
+
<br>
|
|
11
|
+
|
|
12
|
+
## Syntax
|
|
13
|
+
|
|
14
|
+
A `csv` resource block declares the configuration data to be tested:
|
|
15
|
+
|
|
16
|
+
describe csv('file') do
|
|
17
|
+
its('name') { should cmp 'foo' }
|
|
18
|
+
end
|
|
19
|
+
|
|
20
|
+
where
|
|
21
|
+
|
|
22
|
+
* `'file'` is the path to a CSV file
|
|
23
|
+
* `name` is a configuration setting in a CSV file
|
|
24
|
+
* `should eq 'foo'` tests a value of `name` as read from a CSV file versus the value declared in the test
|
|
25
|
+
|
|
26
|
+
<br>
|
|
27
|
+
|
|
28
|
+
## Examples
|
|
29
|
+
|
|
30
|
+
The following examples show how to use this InSpec audit resource.
|
|
31
|
+
|
|
32
|
+
### Test a CSV file
|
|
33
|
+
|
|
34
|
+
describe csv('some_file.csv') do
|
|
35
|
+
its('setting') { should eq 1 }
|
|
36
|
+
end
|
|
37
|
+
|
|
38
|
+
<br>
|
|
39
|
+
|
|
40
|
+
## Property Examples
|
|
41
|
+
|
|
42
|
+
### name
|
|
43
|
+
|
|
44
|
+
The `name` property tests the value of `name` as read from a CSV file compared to the value declared in the test.
|
|
45
|
+
|
|
46
|
+
its('name') { should cmp 'foo' }
|
|
47
|
+
|
|
48
|
+
<br>
|
|
49
|
+
|
|
50
|
+
## Matchers
|
|
51
|
+
|
|
52
|
+
For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
|
53
|
+
|
|
54
|
+
|
|
@@ -1,205 +1,205 @@
|
|
|
1
|
-
---
|
|
2
|
-
title: The dh_params Resource
|
|
3
|
-
platform: linux
|
|
4
|
-
---
|
|
5
|
-
|
|
6
|
-
# dh_params
|
|
7
|
-
|
|
8
|
-
Use the `dh_params` InSpec audit resource to test Diffie-Hellman (DH) parameters.
|
|
9
|
-
|
|
10
|
-
<br>
|
|
11
|
-
|
|
12
|
-
## Syntax
|
|
13
|
-
|
|
14
|
-
A `dh_params` resource block declares a parameter file to be tested.
|
|
15
|
-
|
|
16
|
-
describe dh_params('/path/to/file.dh_pem') do
|
|
17
|
-
it { should be_dh_params }
|
|
18
|
-
it { should be_valid }
|
|
19
|
-
its('generator') { should eq 2 }
|
|
20
|
-
its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
|
|
21
|
-
its('prime_length') { should eq 2048 }
|
|
22
|
-
its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
|
|
23
|
-
its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
|
|
24
|
-
end
|
|
25
|
-
|
|
26
|
-
<br>
|
|
27
|
-
|
|
28
|
-
## Properties
|
|
29
|
-
|
|
30
|
-
* `generator`, `modulus`, `prime_length`, `pem`, `text`
|
|
31
|
-
|
|
32
|
-
<br>
|
|
33
|
-
|
|
34
|
-
## Property Examples
|
|
35
|
-
|
|
36
|
-
### generator (Integer)
|
|
37
|
-
|
|
38
|
-
Verify generator used for the Diffie-Hellman operation:
|
|
39
|
-
|
|
40
|
-
describe dh_params('/path/to/file.dh_pem') do
|
|
41
|
-
its('generator') { should eq 2 }
|
|
42
|
-
end
|
|
43
|
-
|
|
44
|
-
### modulus (String)
|
|
45
|
-
|
|
46
|
-
Verify prime modulus used for the Diffie-Hellman operation:
|
|
47
|
-
|
|
48
|
-
describe dh_params('/path/to/file.dh_pem') do
|
|
49
|
-
its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
|
|
50
|
-
end
|
|
51
|
-
|
|
52
|
-
Example using multi-line string:
|
|
53
|
-
|
|
54
|
-
describe dh_params('/path/to/file.dh_pem') do
|
|
55
|
-
its('modulus') do
|
|
56
|
-
# regex removes all whitespace
|
|
57
|
-
should eq <<-EOF.gsub(/[[:space:]]+/, '')
|
|
58
|
-
00:91:a0:15:89:e5:bc:38:93:12:02:fc:91:a2:85:
|
|
59
|
-
f7:f7:29:63:2e:d3:4e:7a:86:f7:ee:84:fe:42:d0:
|
|
60
|
-
48:bc:9c:91:d5:54:f8:78:1d:c0:41:78:a2:c4:ac:
|
|
61
|
-
1a:24:8b:9d:88:55:98:0b:ac:a7:23:eb:c2:aa:2b:
|
|
62
|
-
2e:a9:f9:af:d4:8e:4e:11:bc:7f:35:a2:ac:da:3a:
|
|
63
|
-
ef:f0:25:6c:9a:a4:fd:00:28:76:86:2c:57:87:67:
|
|
64
|
-
30:5d:b1:d6:5b:22:8f:72:a1:ea:de:8b:ef:9e:33:
|
|
65
|
-
1a:40:92:68:85:02:54:02:09:fa:c0:60:c1:3c:4e:
|
|
66
|
-
28:26:db:ed:25:8e:38:21:56:40:dc:c0:c0:66:1f:
|
|
67
|
-
2b:32:c3:b4:78:a9:26:94:ea:f7:41:28:b2:f5:5b:
|
|
68
|
-
01:38:0c:46:09:85:26:4d:69:12:8d:95:0f:35:e2:
|
|
69
|
-
e6:4e:47:3a:86:dd:8a:b2:fe:45:15:27:d8:59:c2:
|
|
70
|
-
3c:f4:62:ff:5f:74:e9:77:92:50:47:36:2b:05:57:
|
|
71
|
-
60:ee:7b:a1:60:cc:1c:7a:2b:77:18:8a:37:f7:c7:
|
|
72
|
-
31:3e:15:cb:15:7f:7b:66:96:fb:c6:be:7d:d6:03:
|
|
73
|
-
5e:0d:60:75:2b:5b:62:2a:a3:37:b6:34:f9:fe:96:
|
|
74
|
-
4c:f6:c5:e3:a1:52:af:01:c1:4f:c7:42:a0:be:ed:
|
|
75
|
-
cd:13
|
|
76
|
-
EOF
|
|
77
|
-
end
|
|
78
|
-
end
|
|
79
|
-
|
|
80
|
-
### prime_length (Integer)
|
|
81
|
-
|
|
82
|
-
Verify length of prime modulus used for the Diffie-Hellman operation:
|
|
83
|
-
|
|
84
|
-
describe dh_params('/path/to/file.dh_pem') do
|
|
85
|
-
its('prime_length') { should eq 2048 }
|
|
86
|
-
end
|
|
87
|
-
|
|
88
|
-
### pem (String)
|
|
89
|
-
|
|
90
|
-
Verify `pem` output of DH parameters:
|
|
91
|
-
|
|
92
|
-
describe dh_params('/path/to/file.dh_pem') do
|
|
93
|
-
its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
|
|
94
|
-
end
|
|
95
|
-
|
|
96
|
-
Example using multi-line string:
|
|
97
|
-
|
|
98
|
-
its('pem') do
|
|
99
|
-
# regex removes all leading spaces
|
|
100
|
-
should eq <<-EOF.gsub(/^[[:blank:]]+/, '')
|
|
101
|
-
-----BEGIN DH PARAMETERS-----
|
|
102
|
-
MIIBCAKCAQEAkaAVieW8OJMSAvyRooX39yljLtNOeob37oT+QtBIvJyR1VT4eB3A
|
|
103
|
-
QXiixKwaJIudiFWYC6ynI+vCqisuqfmv1I5OEbx/NaKs2jrv8CVsmqT9ACh2hixX
|
|
104
|
-
h2cwXbHWWyKPcqHq3ovvnjMaQJJohQJUAgn6wGDBPE4oJtvtJY44IVZA3MDAZh8r
|
|
105
|
-
MsO0eKkmlOr3QSiy9VsBOAxGCYUmTWkSjZUPNeLmTkc6ht2Ksv5FFSfYWcI89GL/
|
|
106
|
-
X3Tpd5JQRzYrBVdg7nuhYMwceit3GIo398cxPhXLFX97Zpb7xr591gNeDWB1K1ti
|
|
107
|
-
KqM3tjT5/pZM9sXjoVKvAcFPx0Kgvu3NEwIBAg==
|
|
108
|
-
-----END DH PARAMETERS-----
|
|
109
|
-
EOF
|
|
110
|
-
end
|
|
111
|
-
|
|
112
|
-
Verify via `openssl dhparam` command:
|
|
113
|
-
|
|
114
|
-
$ openssl dhparam -in /path/to/file.dh_pem
|
|
115
|
-
-----BEGIN DH PARAMETERS-----
|
|
116
|
-
MIIBCAKCAQEAkaAVieW8OJMSAvyRooX39yljLtNOeob37oT+QtBIvJyR1VT4eB3A
|
|
117
|
-
QXiixKwaJIudiFWYC6ynI+vCqisuqfmv1I5OEbx/NaKs2jrv8CVsmqT9ACh2hixX
|
|
118
|
-
h2cwXbHWWyKPcqHq3ovvnjMaQJJohQJUAgn6wGDBPE4oJtvtJY44IVZA3MDAZh8r
|
|
119
|
-
MsO0eKkmlOr3QSiy9VsBOAxGCYUmTWkSjZUPNeLmTkc6ht2Ksv5FFSfYWcI89GL/
|
|
120
|
-
X3Tpd5JQRzYrBVdg7nuhYMwceit3GIo398cxPhXLFX97Zpb7xr591gNeDWB1K1ti
|
|
121
|
-
KqM3tjT5/pZM9sXjoVKvAcFPx0Kgvu3NEwIBAg==
|
|
122
|
-
-----END DH PARAMETERS-----
|
|
123
|
-
|
|
124
|
-
### text (String)
|
|
125
|
-
|
|
126
|
-
Verify human-readable text output of DH parameters:
|
|
127
|
-
|
|
128
|
-
describe dh_params('/path/to/file.dh_pem') do
|
|
129
|
-
its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
|
|
130
|
-
end
|
|
131
|
-
|
|
132
|
-
Example using multi-line string:
|
|
133
|
-
|
|
134
|
-
its('text') do
|
|
135
|
-
# regex removes 2 leading spaces
|
|
136
|
-
should eq <<-EOF.gsub(/^[[:blank:]]{2}/, '')
|
|
137
|
-
PKCS#3 DH Parameters: (2048 bit)
|
|
138
|
-
prime:
|
|
139
|
-
00:91:a0:15:89:e5:bc:38:93:12:02:fc:91:a2:85:
|
|
140
|
-
f7:f7:29:63:2e:d3:4e:7a:86:f7:ee:84:fe:42:d0:
|
|
141
|
-
48:bc:9c:91:d5:54:f8:78:1d:c0:41:78:a2:c4:ac:
|
|
142
|
-
1a:24:8b:9d:88:55:98:0b:ac:a7:23:eb:c2:aa:2b:
|
|
143
|
-
2e:a9:f9:af:d4:8e:4e:11:bc:7f:35:a2:ac:da:3a:
|
|
144
|
-
ef:f0:25:6c:9a:a4:fd:00:28:76:86:2c:57:87:67:
|
|
145
|
-
30:5d:b1:d6:5b:22:8f:72:a1:ea:de:8b:ef:9e:33:
|
|
146
|
-
1a:40:92:68:85:02:54:02:09:fa:c0:60:c1:3c:4e:
|
|
147
|
-
28:26:db:ed:25:8e:38:21:56:40:dc:c0:c0:66:1f:
|
|
148
|
-
2b:32:c3:b4:78:a9:26:94:ea:f7:41:28:b2:f5:5b:
|
|
149
|
-
01:38:0c:46:09:85:26:4d:69:12:8d:95:0f:35:e2:
|
|
150
|
-
e6:4e:47:3a:86:dd:8a:b2:fe:45:15:27:d8:59:c2:
|
|
151
|
-
3c:f4:62:ff:5f:74:e9:77:92:50:47:36:2b:05:57:
|
|
152
|
-
60:ee:7b:a1:60:cc:1c:7a:2b:77:18:8a:37:f7:c7:
|
|
153
|
-
31:3e:15:cb:15:7f:7b:66:96:fb:c6:be:7d:d6:03:
|
|
154
|
-
5e:0d:60:75:2b:5b:62:2a:a3:37:b6:34:f9:fe:96:
|
|
155
|
-
4c:f6:c5:e3:a1:52:af:01:c1:4f:c7:42:a0:be:ed:
|
|
156
|
-
cd:13
|
|
157
|
-
generator: 2 (0x2)
|
|
158
|
-
EOF
|
|
159
|
-
end
|
|
160
|
-
|
|
161
|
-
Verify via `openssl dhparam` command:
|
|
162
|
-
|
|
163
|
-
$ openssl dhparam -in /path/to/file.dh_pem -noout -text
|
|
164
|
-
PKCS#3 DH Parameters: (2048 bit)
|
|
165
|
-
prime:
|
|
166
|
-
00:91:a0:15:89:e5:bc:38:93:12:02:fc:91:a2:85:
|
|
167
|
-
f7:f7:29:63:2e:d3:4e:7a:86:f7:ee:84:fe:42:d0:
|
|
168
|
-
48:bc:9c:91:d5:54:f8:78:1d:c0:41:78:a2:c4:ac:
|
|
169
|
-
1a:24:8b:9d:88:55:98:0b:ac:a7:23:eb:c2:aa:2b:
|
|
170
|
-
2e:a9:f9:af:d4:8e:4e:11:bc:7f:35:a2:ac:da:3a:
|
|
171
|
-
ef:f0:25:6c:9a:a4:fd:00:28:76:86:2c:57:87:67:
|
|
172
|
-
30:5d:b1:d6:5b:22:8f:72:a1:ea:de:8b:ef:9e:33:
|
|
173
|
-
1a:40:92:68:85:02:54:02:09:fa:c0:60:c1:3c:4e:
|
|
174
|
-
28:26:db:ed:25:8e:38:21:56:40:dc:c0:c0:66:1f:
|
|
175
|
-
2b:32:c3:b4:78:a9:26:94:ea:f7:41:28:b2:f5:5b:
|
|
176
|
-
01:38:0c:46:09:85:26:4d:69:12:8d:95:0f:35:e2:
|
|
177
|
-
e6:4e:47:3a:86:dd:8a:b2:fe:45:15:27:d8:59:c2:
|
|
178
|
-
3c:f4:62:ff:5f:74:e9:77:92:50:47:36:2b:05:57:
|
|
179
|
-
60:ee:7b:a1:60:cc:1c:7a:2b:77:18:8a:37:f7:c7:
|
|
180
|
-
31:3e:15:cb:15:7f:7b:66:96:fb:c6:be:7d:d6:03:
|
|
181
|
-
5e:0d:60:75:2b:5b:62:2a:a3:37:b6:34:f9:fe:96:
|
|
182
|
-
4c:f6:c5:e3:a1:52:af:01:c1:4f:c7:42:a0:be:ed:
|
|
183
|
-
cd:13
|
|
184
|
-
generator: 2 (0x2)
|
|
185
|
-
|
|
186
|
-
<br>
|
|
187
|
-
|
|
188
|
-
## Matchers
|
|
189
|
-
|
|
190
|
-
For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
|
191
|
-
|
|
192
|
-
### valid?
|
|
193
|
-
|
|
194
|
-
Verify whether DH parameters are valid:
|
|
195
|
-
|
|
196
|
-
describe dh_params('/path/to/file.dh_pem') do
|
|
197
|
-
it { should be_valid }
|
|
198
|
-
end
|
|
199
|
-
|
|
200
|
-
### be\_dh\_params
|
|
201
|
-
|
|
202
|
-
describe dh_params('/path/to/file.dh_pem') do
|
|
203
|
-
it { should be_dh_params}
|
|
204
|
-
end
|
|
205
|
-
|
|
1
|
+
---
|
|
2
|
+
title: The dh_params Resource
|
|
3
|
+
platform: linux
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# dh_params
|
|
7
|
+
|
|
8
|
+
Use the `dh_params` InSpec audit resource to test Diffie-Hellman (DH) parameters.
|
|
9
|
+
|
|
10
|
+
<br>
|
|
11
|
+
|
|
12
|
+
## Syntax
|
|
13
|
+
|
|
14
|
+
A `dh_params` resource block declares a parameter file to be tested.
|
|
15
|
+
|
|
16
|
+
describe dh_params('/path/to/file.dh_pem') do
|
|
17
|
+
it { should be_dh_params }
|
|
18
|
+
it { should be_valid }
|
|
19
|
+
its('generator') { should eq 2 }
|
|
20
|
+
its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
|
|
21
|
+
its('prime_length') { should eq 2048 }
|
|
22
|
+
its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
|
|
23
|
+
its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
|
|
24
|
+
end
|
|
25
|
+
|
|
26
|
+
<br>
|
|
27
|
+
|
|
28
|
+
## Properties
|
|
29
|
+
|
|
30
|
+
* `generator`, `modulus`, `prime_length`, `pem`, `text`
|
|
31
|
+
|
|
32
|
+
<br>
|
|
33
|
+
|
|
34
|
+
## Property Examples
|
|
35
|
+
|
|
36
|
+
### generator (Integer)
|
|
37
|
+
|
|
38
|
+
Verify generator used for the Diffie-Hellman operation:
|
|
39
|
+
|
|
40
|
+
describe dh_params('/path/to/file.dh_pem') do
|
|
41
|
+
its('generator') { should eq 2 }
|
|
42
|
+
end
|
|
43
|
+
|
|
44
|
+
### modulus (String)
|
|
45
|
+
|
|
46
|
+
Verify prime modulus used for the Diffie-Hellman operation:
|
|
47
|
+
|
|
48
|
+
describe dh_params('/path/to/file.dh_pem') do
|
|
49
|
+
its('modulus') { should eq '00:91:a0:15:89:e5:bc:38:93:12:02:fc:...' }
|
|
50
|
+
end
|
|
51
|
+
|
|
52
|
+
Example using multi-line string:
|
|
53
|
+
|
|
54
|
+
describe dh_params('/path/to/file.dh_pem') do
|
|
55
|
+
its('modulus') do
|
|
56
|
+
# regex removes all whitespace
|
|
57
|
+
should eq <<-EOF.gsub(/[[:space:]]+/, '')
|
|
58
|
+
00:91:a0:15:89:e5:bc:38:93:12:02:fc:91:a2:85:
|
|
59
|
+
f7:f7:29:63:2e:d3:4e:7a:86:f7:ee:84:fe:42:d0:
|
|
60
|
+
48:bc:9c:91:d5:54:f8:78:1d:c0:41:78:a2:c4:ac:
|
|
61
|
+
1a:24:8b:9d:88:55:98:0b:ac:a7:23:eb:c2:aa:2b:
|
|
62
|
+
2e:a9:f9:af:d4:8e:4e:11:bc:7f:35:a2:ac:da:3a:
|
|
63
|
+
ef:f0:25:6c:9a:a4:fd:00:28:76:86:2c:57:87:67:
|
|
64
|
+
30:5d:b1:d6:5b:22:8f:72:a1:ea:de:8b:ef:9e:33:
|
|
65
|
+
1a:40:92:68:85:02:54:02:09:fa:c0:60:c1:3c:4e:
|
|
66
|
+
28:26:db:ed:25:8e:38:21:56:40:dc:c0:c0:66:1f:
|
|
67
|
+
2b:32:c3:b4:78:a9:26:94:ea:f7:41:28:b2:f5:5b:
|
|
68
|
+
01:38:0c:46:09:85:26:4d:69:12:8d:95:0f:35:e2:
|
|
69
|
+
e6:4e:47:3a:86:dd:8a:b2:fe:45:15:27:d8:59:c2:
|
|
70
|
+
3c:f4:62:ff:5f:74:e9:77:92:50:47:36:2b:05:57:
|
|
71
|
+
60:ee:7b:a1:60:cc:1c:7a:2b:77:18:8a:37:f7:c7:
|
|
72
|
+
31:3e:15:cb:15:7f:7b:66:96:fb:c6:be:7d:d6:03:
|
|
73
|
+
5e:0d:60:75:2b:5b:62:2a:a3:37:b6:34:f9:fe:96:
|
|
74
|
+
4c:f6:c5:e3:a1:52:af:01:c1:4f:c7:42:a0:be:ed:
|
|
75
|
+
cd:13
|
|
76
|
+
EOF
|
|
77
|
+
end
|
|
78
|
+
end
|
|
79
|
+
|
|
80
|
+
### prime_length (Integer)
|
|
81
|
+
|
|
82
|
+
Verify length of prime modulus used for the Diffie-Hellman operation:
|
|
83
|
+
|
|
84
|
+
describe dh_params('/path/to/file.dh_pem') do
|
|
85
|
+
its('prime_length') { should eq 2048 }
|
|
86
|
+
end
|
|
87
|
+
|
|
88
|
+
### pem (String)
|
|
89
|
+
|
|
90
|
+
Verify `pem` output of DH parameters:
|
|
91
|
+
|
|
92
|
+
describe dh_params('/path/to/file.dh_pem') do
|
|
93
|
+
its('pem') { should eq '-----BEGIN DH PARAMETERS...' }
|
|
94
|
+
end
|
|
95
|
+
|
|
96
|
+
Example using multi-line string:
|
|
97
|
+
|
|
98
|
+
its('pem') do
|
|
99
|
+
# regex removes all leading spaces
|
|
100
|
+
should eq <<-EOF.gsub(/^[[:blank:]]+/, '')
|
|
101
|
+
-----BEGIN DH PARAMETERS-----
|
|
102
|
+
MIIBCAKCAQEAkaAVieW8OJMSAvyRooX39yljLtNOeob37oT+QtBIvJyR1VT4eB3A
|
|
103
|
+
QXiixKwaJIudiFWYC6ynI+vCqisuqfmv1I5OEbx/NaKs2jrv8CVsmqT9ACh2hixX
|
|
104
|
+
h2cwXbHWWyKPcqHq3ovvnjMaQJJohQJUAgn6wGDBPE4oJtvtJY44IVZA3MDAZh8r
|
|
105
|
+
MsO0eKkmlOr3QSiy9VsBOAxGCYUmTWkSjZUPNeLmTkc6ht2Ksv5FFSfYWcI89GL/
|
|
106
|
+
X3Tpd5JQRzYrBVdg7nuhYMwceit3GIo398cxPhXLFX97Zpb7xr591gNeDWB1K1ti
|
|
107
|
+
KqM3tjT5/pZM9sXjoVKvAcFPx0Kgvu3NEwIBAg==
|
|
108
|
+
-----END DH PARAMETERS-----
|
|
109
|
+
EOF
|
|
110
|
+
end
|
|
111
|
+
|
|
112
|
+
Verify via `openssl dhparam` command:
|
|
113
|
+
|
|
114
|
+
$ openssl dhparam -in /path/to/file.dh_pem
|
|
115
|
+
-----BEGIN DH PARAMETERS-----
|
|
116
|
+
MIIBCAKCAQEAkaAVieW8OJMSAvyRooX39yljLtNOeob37oT+QtBIvJyR1VT4eB3A
|
|
117
|
+
QXiixKwaJIudiFWYC6ynI+vCqisuqfmv1I5OEbx/NaKs2jrv8CVsmqT9ACh2hixX
|
|
118
|
+
h2cwXbHWWyKPcqHq3ovvnjMaQJJohQJUAgn6wGDBPE4oJtvtJY44IVZA3MDAZh8r
|
|
119
|
+
MsO0eKkmlOr3QSiy9VsBOAxGCYUmTWkSjZUPNeLmTkc6ht2Ksv5FFSfYWcI89GL/
|
|
120
|
+
X3Tpd5JQRzYrBVdg7nuhYMwceit3GIo398cxPhXLFX97Zpb7xr591gNeDWB1K1ti
|
|
121
|
+
KqM3tjT5/pZM9sXjoVKvAcFPx0Kgvu3NEwIBAg==
|
|
122
|
+
-----END DH PARAMETERS-----
|
|
123
|
+
|
|
124
|
+
### text (String)
|
|
125
|
+
|
|
126
|
+
Verify human-readable text output of DH parameters:
|
|
127
|
+
|
|
128
|
+
describe dh_params('/path/to/file.dh_pem') do
|
|
129
|
+
its('text') { should eq 'PKCS#3 DH Parameters: (2048 bit)...' }
|
|
130
|
+
end
|
|
131
|
+
|
|
132
|
+
Example using multi-line string:
|
|
133
|
+
|
|
134
|
+
its('text') do
|
|
135
|
+
# regex removes 2 leading spaces
|
|
136
|
+
should eq <<-EOF.gsub(/^[[:blank:]]{2}/, '')
|
|
137
|
+
PKCS#3 DH Parameters: (2048 bit)
|
|
138
|
+
prime:
|
|
139
|
+
00:91:a0:15:89:e5:bc:38:93:12:02:fc:91:a2:85:
|
|
140
|
+
f7:f7:29:63:2e:d3:4e:7a:86:f7:ee:84:fe:42:d0:
|
|
141
|
+
48:bc:9c:91:d5:54:f8:78:1d:c0:41:78:a2:c4:ac:
|
|
142
|
+
1a:24:8b:9d:88:55:98:0b:ac:a7:23:eb:c2:aa:2b:
|
|
143
|
+
2e:a9:f9:af:d4:8e:4e:11:bc:7f:35:a2:ac:da:3a:
|
|
144
|
+
ef:f0:25:6c:9a:a4:fd:00:28:76:86:2c:57:87:67:
|
|
145
|
+
30:5d:b1:d6:5b:22:8f:72:a1:ea:de:8b:ef:9e:33:
|
|
146
|
+
1a:40:92:68:85:02:54:02:09:fa:c0:60:c1:3c:4e:
|
|
147
|
+
28:26:db:ed:25:8e:38:21:56:40:dc:c0:c0:66:1f:
|
|
148
|
+
2b:32:c3:b4:78:a9:26:94:ea:f7:41:28:b2:f5:5b:
|
|
149
|
+
01:38:0c:46:09:85:26:4d:69:12:8d:95:0f:35:e2:
|
|
150
|
+
e6:4e:47:3a:86:dd:8a:b2:fe:45:15:27:d8:59:c2:
|
|
151
|
+
3c:f4:62:ff:5f:74:e9:77:92:50:47:36:2b:05:57:
|
|
152
|
+
60:ee:7b:a1:60:cc:1c:7a:2b:77:18:8a:37:f7:c7:
|
|
153
|
+
31:3e:15:cb:15:7f:7b:66:96:fb:c6:be:7d:d6:03:
|
|
154
|
+
5e:0d:60:75:2b:5b:62:2a:a3:37:b6:34:f9:fe:96:
|
|
155
|
+
4c:f6:c5:e3:a1:52:af:01:c1:4f:c7:42:a0:be:ed:
|
|
156
|
+
cd:13
|
|
157
|
+
generator: 2 (0x2)
|
|
158
|
+
EOF
|
|
159
|
+
end
|
|
160
|
+
|
|
161
|
+
Verify via `openssl dhparam` command:
|
|
162
|
+
|
|
163
|
+
$ openssl dhparam -in /path/to/file.dh_pem -noout -text
|
|
164
|
+
PKCS#3 DH Parameters: (2048 bit)
|
|
165
|
+
prime:
|
|
166
|
+
00:91:a0:15:89:e5:bc:38:93:12:02:fc:91:a2:85:
|
|
167
|
+
f7:f7:29:63:2e:d3:4e:7a:86:f7:ee:84:fe:42:d0:
|
|
168
|
+
48:bc:9c:91:d5:54:f8:78:1d:c0:41:78:a2:c4:ac:
|
|
169
|
+
1a:24:8b:9d:88:55:98:0b:ac:a7:23:eb:c2:aa:2b:
|
|
170
|
+
2e:a9:f9:af:d4:8e:4e:11:bc:7f:35:a2:ac:da:3a:
|
|
171
|
+
ef:f0:25:6c:9a:a4:fd:00:28:76:86:2c:57:87:67:
|
|
172
|
+
30:5d:b1:d6:5b:22:8f:72:a1:ea:de:8b:ef:9e:33:
|
|
173
|
+
1a:40:92:68:85:02:54:02:09:fa:c0:60:c1:3c:4e:
|
|
174
|
+
28:26:db:ed:25:8e:38:21:56:40:dc:c0:c0:66:1f:
|
|
175
|
+
2b:32:c3:b4:78:a9:26:94:ea:f7:41:28:b2:f5:5b:
|
|
176
|
+
01:38:0c:46:09:85:26:4d:69:12:8d:95:0f:35:e2:
|
|
177
|
+
e6:4e:47:3a:86:dd:8a:b2:fe:45:15:27:d8:59:c2:
|
|
178
|
+
3c:f4:62:ff:5f:74:e9:77:92:50:47:36:2b:05:57:
|
|
179
|
+
60:ee:7b:a1:60:cc:1c:7a:2b:77:18:8a:37:f7:c7:
|
|
180
|
+
31:3e:15:cb:15:7f:7b:66:96:fb:c6:be:7d:d6:03:
|
|
181
|
+
5e:0d:60:75:2b:5b:62:2a:a3:37:b6:34:f9:fe:96:
|
|
182
|
+
4c:f6:c5:e3:a1:52:af:01:c1:4f:c7:42:a0:be:ed:
|
|
183
|
+
cd:13
|
|
184
|
+
generator: 2 (0x2)
|
|
185
|
+
|
|
186
|
+
<br>
|
|
187
|
+
|
|
188
|
+
## Matchers
|
|
189
|
+
|
|
190
|
+
For a full list of available matchers, please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
|
191
|
+
|
|
192
|
+
### valid?
|
|
193
|
+
|
|
194
|
+
Verify whether DH parameters are valid:
|
|
195
|
+
|
|
196
|
+
describe dh_params('/path/to/file.dh_pem') do
|
|
197
|
+
it { should be_valid }
|
|
198
|
+
end
|
|
199
|
+
|
|
200
|
+
### be\_dh\_params
|
|
201
|
+
|
|
202
|
+
describe dh_params('/path/to/file.dh_pem') do
|
|
203
|
+
it { should be_dh_params}
|
|
204
|
+
end
|
|
205
|
+
|