inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/postfix_conf.rb

@@ -1,35 +0,0 @@
-require "inspec/resources/ini"
-require "inspec/utils/simpleconfig"
-
-module Inspec::Resources
-  class PostfixConf < IniConfig
-    name "postfix_conf"
-    supports platform: "linux"
-    desc "Use the postfix_conf Inspec audit resource to test the configuration of the Postfix Mail Transfer Agent"
-
-    # Allow user to specify a custom configuration path, use default Postfix configuration path if no custom path is provided
-    def initialize(*opts)
-      @params = {}
-      if opts.length == 1
-        @raw_content = load_raw_content(opts[0])
-      else
-        @raw_content = load_raw_content("/etc/postfix/main.cf")
-      end
-      @params = parse(@raw_content)
-    end
-
-    def parse(content)
-      SimpleConfig.new(content).params
-    end
-
-    def to_s
-      "Postfix Mail Transfer Agent"
-    end
-
-    private
-
-    def resource_base_name
-      "Postfix Config"
-    end
-  end
-end

data/lib/inspec/resources/postgres.rb

@@ -1,152 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-module Inspec::Resources
-  class Postgres < Inspec.resource(1)
-    name "postgres"
-    supports platform: "unix"
-    desc "The 'postgres' resource is a helper for the 'postgres_conf', 'postgres_hba_conf', 'postgres_ident_conf' & 'postgres_session' resources.  Please use those instead."
-
-    attr_reader :service, :data_dir, :conf_dir, :conf_path, :version, :cluster
-    def initialize
-      # determine dirs and service based on versions
-      determine_dirs
-      determine_service
-
-      # print warnings if the dirs do not exist
-      verify_dirs
-
-      if !@version.to_s.empty? && !@conf_dir.to_s.empty?
-        @conf_path = File.join @conf_dir, "postgresql.conf"
-      else
-        @conf_path = nil
-        return skip_resource "Seems like PostgreSQL is not installed on your system"
-      end
-    end
-
-    def to_s
-      "PostgreSQL"
-    end
-
-    private
-
-    def determine_dirs
-      if inspec.os.debian?
-        #
-        # https://wiki.debian.org/PostgreSql
-        #
-        # Debian allows multiple versions of postgresql to be
-        # installed as well as multiple "clusters" to be configured.
-        #
-        @version = version_from_psql || version_from_dir("/etc/postgresql")
-        unless @version.to_s.empty?
-          @cluster = cluster_from_dir("/etc/postgresql/#{@version}")
-          @conf_dir = "/etc/postgresql/#{@version}/#{@cluster}"
-          @data_dir = "/var/lib/postgresql/#{@version}/#{@cluster}"
-        end
-      else
-        @version = version_from_psql
-        if @version.to_s.empty?
-          if inspec.directory("/var/lib/pgsql/data").exist?
-            warn "Unable to determine PostgreSQL version: psql did not return" \
-                 "a version number and unversioned data directories were found."
-          else
-            @version = version_from_dir("/var/lib/pgsql")
-          end
-        end
-        @data_dir = locate_data_dir_location_by_version(@version)
-      end
-      @conf_dir ||= @data_dir
-    end
-
-    def determine_service
-      @service = "postgresql"
-      if @version.to_i >= 10
-        @service += "-#{@version.to_i}"
-      elsif @version.to_f >= 9.4
-        @service += "-#{@version}"
-      end
-    end
-
-    def verify_dirs
-      unless inspec.directory(@conf_dir).exist?
-        warn "Default postgresql configuration directory: #{@conf_dir} does not exist. " \
-          "Postgresql may not be installed or we've misidentified the configuration " \
-          "directory."
-      end
-
-      unless inspec.directory(@data_dir).exist?
-        warn "Default postgresql data directory: #{@data_dir} does not exist. " \
-          "Postgresql may not be installed or we've misidentified the data " \
-          "directory."
-      end
-    end
-
-    def version_from_psql
-      return unless inspec.command("psql").exist?
-
-      inspec.command("psql --version | awk '{ print $NF }' | awk -F. '{ print $1\".\"$2 }'").stdout.strip
-    end
-
-    def locate_data_dir_location_by_version(ver = @version)
-      dir_list = [
-        "/var/lib/pgsql/#{ver}/data",
-        # for 10, the versions are just stored in `10` although their version `10.7`
-        "/var/lib/pgsql/#{ver.to_i}/data",
-        "/var/lib/pgsql/data",
-        "/var/lib/postgres/data",
-        "/var/lib/postgresql/data",
-      ]
-
-      data_dir_loc = dir_list.detect { |i| inspec.directory(i).exist? }
-
-      if data_dir_loc.nil?
-        warn 'Unable to find the PostgreSQL data_dir in expected location(s), please
-        execute "psql -t -A -p <port> -h <host> -c "show hba_file";" as the PostgreSQL
-        DBA to find the non-standard data_dir location.'
-      end
-      data_dir_loc
-    end
-
-    def version_from_dir(dir)
-      dirs = inspec.command("ls -d #{dir}/*/").stdout
-      entries = dirs.lines.count
-      case entries
-      when 0
-        warn "Could not determine version of installed postgresql by inspecting #{dir}"
-        nil
-      when 1
-        warn "Using #{dirs}: #{dir_to_version(dirs)}"
-        dir_to_version(dirs)
-      else
-        warn "Multiple versions of postgresql installed or incorrect base dir #{dir}"
-        first = dir_to_version(dirs.lines.first)
-        warn "Using the first version found: #{first}"
-        first
-      end
-    end
-
-    def dir_to_version(dir)
-      dir.chomp.split("/").last
-    end
-
-    def cluster_from_dir(dir)
-      # Main is the default cluster name on debian use it if it
-      # exists.
-      if inspec.directory("#{dir}/main").exist?
-        "main"
-      else
-        dirs = inspec.command("ls -d #{dir}/*/").stdout.lines
-        if dirs.empty?
-          warn "No postgresql clusters configured or incorrect base dir #{dir}"
-          return nil
-        end
-        first = dirs.first.chomp.split("/").last
-        if dirs.count > 1
-          warn "Multiple postgresql clusters configured or incorrect base dir #{dir}"
-          warn "Using the first directory found: #{first}"
-        end
-        first
-      end
-    end
-  end
-end

data/lib/inspec/resources/postgres_conf.rb

@@ -1,116 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-require "inspec/utils/object_traversal"
-require "inspec/utils/simpleconfig"
-require "inspec/utils/find_files"
-require "inspec/utils/file_reader"
-require "inspec/resources/postgres"
-
-module Inspec::Resources
-  class PostgresConf < Inspec.resource(1)
-    name "postgres_conf"
-    supports platform: "unix"
-    supports platform: "windows"
-    desc "Use the postgres_conf InSpec audit resource to test the contents of the configuration file for PostgreSQL, typically located at /etc/postgresql/<version>/main/postgresql.conf or /var/lib/postgres/data/postgresql.conf, depending on the platform."
-    example <<~EXAMPLE
-      describe postgres_conf do
-        its('max_connections') { should eq '5' }
-      end
-    EXAMPLE
-
-    include FindFiles
-    include FileReader
-    include ObjectTraverser
-
-    def initialize(conf_path = nil)
-      @conf_path = conf_path || inspec.postgres.conf_path
-      if @conf_path.nil?
-        return skip_resource "PostgreSQL conf path is not set"
-      end
-
-      @conf_dir = File.expand_path(File.dirname(@conf_path))
-      @files_contents = {}
-      @content = nil
-      @params = nil
-      read_content
-    end
-
-    def content
-      @content ||= read_content
-    end
-
-    def params(*opts)
-      @params || read_content
-      res = @params
-      opts.each do |opt|
-        res = res[opt] unless res.nil?
-      end
-      res
-    end
-
-    def value(key)
-      extract_value(key, @params)
-    end
-
-    def method_missing(*keys)
-      keys.shift if keys.is_a?(Array) && keys[0] == :[]
-      param = value(keys)
-      return nil if param.nil?
-      # extract first value if we have only one value in array
-      return param[0] if param.length == 1
-
-      param
-    end
-
-    def to_s
-      "PostgreSQL Configuration"
-    end
-
-    private
-
-    def read_content
-      @content = ""
-      @params = {}
-
-      to_read = [@conf_path]
-      until to_read.empty?
-        base_dir = File.dirname(to_read[0])
-        raw_conf = read_file(to_read[0])
-        @content += raw_conf
-
-        opts = {
-          assignment_regex: /^\s*([^=]*?)\s*=\s*[']?\s*(.*?)\s*[']?\s*$/,
-        }
-        params = SimpleConfig.new(raw_conf, opts).params
-        @params.merge!(params)
-
-        to_read = to_read.drop(1)
-        # see if there is more config files to include
-
-        to_read += include_files(params, base_dir).find_all do |fp|
-          not @files_contents.key? fp
-        end
-      end
-      @content
-    end
-
-    def include_files(params, base_dir)
-      include_files = Array(params["include"]) || []
-      include_files += Array(params["include_if_exists"]) || []
-      include_files.map! do |f|
-        Pathname.new(f).absolute? ? f : File.join(base_dir, f)
-      end
-
-      dirs = Array(params["include_dir"]) || []
-      dirs.each do |dir|
-        dir = File.join(base_dir, dir) if dir[0] != "/"
-        include_files += find_files(dir, depth: 1, type: "file")
-      end
-      include_files
-    end
-
-    def read_file(path)
-      @files_contents[path] ||= read_file_content(path)
-    end
-  end
-end

data/lib/inspec/resources/postgres_hba_conf.rb

@@ -1,86 +0,0 @@
-require "inspec/resources/postgres"
-require "inspec/utils/file_reader"
-
-module Inspec::Resources
-  class PostgresHbaConf < Inspec.resource(1)
-    name "postgres_hba_conf"
-    supports platform: "unix"
-    desc 'Use the `postgres_hba_conf` InSpec audit resource to test the client
-          authentication data defined in the pg_hba.conf file.'
-    example <<~EXAMPLE
-      describe postgres_hba_conf.where { type == 'local' } do
-        its('auth_method') { should eq ['peer'] }
-      end
-    EXAMPLE
-
-    include FileReader
-
-    attr_reader :conf_file, :params
-
-    # @todo add checks to ensure that we have data in our file
-    def initialize(hba_conf_path = nil)
-      @conf_file = hba_conf_path || File.expand_path("pg_hba.conf", inspec.postgres.conf_dir)
-      @content = ""
-      @params = {}
-      read_content
-    end
-
-    filter = FilterTable.create
-    filter.register_column(:type, field: "type")
-      .register_column(:database, field: "database")
-      .register_column(:user,     field: "user")
-      .register_column(:address,  field: "address")
-      .register_column(:auth_method, field: "auth_method")
-      .register_column(:auth_params, field: "auth_params")
-
-    filter.install_filter_methods_on_resource(self, :params)
-
-    def to_s
-      "Postgres Hba Config #{@conf_file}"
-    end
-
-    private
-
-    def clean_conf_file(conf_file = @conf_file)
-      data = read_file_content(conf_file).to_s.lines
-      content = []
-      data.each do |line|
-        line.chomp!
-        content << line unless line.match(/^\s*#/) || line.empty?
-      end
-      content
-    end
-
-    def read_content(config_file = @conf_file)
-      # @todo use SimpleConfig here if we can
-      # ^\s*(\S+)\s+(\S+)\s+(\S+)\s(?:(\d*.\d*.\d*.\d*\/\d*)|(::\/\d+))\s+(\S+)\s*(.*)?\s*$
-
-      @content = clean_conf_file(config_file)
-      @params = parse_conf(@content)
-      @params.each do |line|
-        if line["type"] == "local"
-          line["auth_method"] = line["address"]
-          line["address"] = ""
-        end
-      end
-    end
-
-    def parse_conf(content)
-      content.map do |line|
-        parse_line(line)
-      end.compact
-    end
-
-    def parse_line(line)
-      x = line.split(/\s+/)
-      {
-        "type" => x[0],
-        "database" => x[1],
-        "user" => x[2],
-        "address" => x[3],
-        "auth_method" => x[4],
-        "auth_params" => ("" if x.length == 4) || x[5..-1].join(" "),
-      }
-    end
-  end
-end

data/lib/inspec/resources/postgres_ident_conf.rb

@@ -1,75 +0,0 @@
-require "inspec/utils/file_reader"
-require "inspec/resources/postgres"
-
-module Inspec::Resources
-  class PostgresIdentConf < Inspec.resource(1)
-    name "postgres_ident_conf"
-    supports platform: "unix"
-    desc 'Use the postgres_ident_conf InSpec audit resource to test the client
-          authentication data is controlled by a pg_ident.conf file.'
-    example <<~EXAMPLE
-      describe postgres_ident_conf.where { pg_username == 'acme_user' } do
-        its('map_name') { should eq ['ssl-test'] }
-      end
-    EXAMPLE
-
-    include FileReader
-
-    attr_reader :params, :conf_file
-
-    def initialize(ident_conf_path = nil)
-      @conf_file = ident_conf_path || File.expand_path("pg_ident.conf", inspec.postgres.conf_dir)
-      @content = nil
-      @params = nil
-      read_content
-    end
-
-    filter = FilterTable.create
-    filter.register_column(:map_name, field: "map_name")
-      .register_column(:system_username, field: "system_username")
-      .register_column(:pg_username,     field: "pg_username")
-
-    filter.install_filter_methods_on_resource(self, :params)
-
-    def to_s
-      "PostgreSQL Ident Config #{@conf_file}"
-    end
-
-    private
-
-    def filter_comments(data)
-      content = []
-      data.each do |line|
-        line.chomp!
-        content << line unless line.match(/^\s*#/) || line.empty?
-      end
-      content
-    end
-
-    def read_content
-      @content = ""
-      @params = {}
-      @content = filter_comments(read_file(@conf_file))
-      @params = parse_conf(@content)
-    end
-
-    def parse_conf(content)
-      content.map do |line|
-        parse_line(line)
-      end.compact
-    end
-
-    def parse_line(line)
-      x = line.split(/\s+/)
-      {
-        "map_name" => x[0],
-        "system_username" => x[1],
-        "pg_username" => x[2],
-      }
-    end
-
-    def read_file(conf_file = @conf_file)
-      read_file_content(conf_file, allow_empty: true).lines
-    end
-  end
-end