inspec 4.18.51 → 4.18.85

data/lib/inspec/resources/shadow.rb

@@ -1,150 +0,0 @@
-# copyright: 2016, Chef Software Inc.
-
-require "inspec/utils/filter"
-require "inspec/utils/file_reader"
-
-# The file format consists of
-# - user
-# - password
-# - last_change
-# - min_days before password change
-# - max_days until password change
-# - warn_days before warning about expiry
-# - inactive_days before deactivating the account
-# - expiry_date when this account will expire
-
-module Inspec::Resources
-  class Shadow < Inspec.resource(1)
-    name "shadow"
-    supports platform: "unix"
-    desc "Use the shadow InSpec resource to test the contents of /etc/shadow, "\
-         "which contains information for users that may log into "\
-         "the system and/or as users that own running processes."
-    example <<~EXAMPLE
-      describe shadow do
-        its('user') { should_not include 'forbidden_user' }
-      end
-
-      describe shadow.user('bin') do
-        its('password') { should cmp 'x' }
-        its('count') { should eq 1 }
-      end
-    EXAMPLE
-
-    include FileReader
-
-    attr_reader :params
-
-    def initialize(path = "/etc/shadow", opts = {})
-      @opts = opts
-      @path = path || "/etc/shadow"
-      @filters = @opts[:filters] || ""
-    end
-
-    filtertable = FilterTable.create
-    filtertable
-      .register_column(:users, field: "user")
-      .register_column(:passwords, field: "password")
-      .register_column(:last_changes, field: "last_change")
-      .register_column(:min_days, field: "min_days")
-      .register_column(:max_days, field: "max_days")
-      .register_column(:warn_days, field: "warn_days")
-      .register_column(:inactive_days, field: "inactive_days")
-      .register_column(:expiry_dates, field: "expiry_date")
-      .register_column(:reserved, field: "reserved")
-
-    filtertable.register_custom_property(:content) do |t, _|
-      t.entries.map do |e|
-        [e.user, e.password, e.last_change, e.min_days, e.max_days, e.warn_days, e.inactive_days, e.expiry_date].compact.join(":")
-      end.join("\n")
-    end
-
-    filtertable.install_filter_methods_on_resource(self, :set_params)
-
-    def filter(query = {})
-      return self if query.nil? || query.empty?
-
-      res = set_params
-      filters = ""
-      query.each do |attr, condition|
-        condition = condition.to_s if condition.is_a? Integer
-        filters += " #{attr} = #{condition.inspect}"
-        res = res.find_all do |line|
-          case line[attr.to_s]
-          when condition
-            true
-          else
-            false
-          end
-        end
-      end
-      content = res.map { |x| x.values.join(":") }.join("\n")
-      Shadow.new(@path, content: content, filters: @filters + filters)
-    end
-
-    # Next 4 are deprecated methods.  We define them here so we can emit a deprecation message.
-    # They are also defined on the Table, above.
-    def user(query = nil)
-      Inspec.deprecate(:properties_shadow, "The shadow `user` property is deprecated. Please use `users` instead.")
-      query.nil? ? where.users : where("user" => query)
-    end
-
-    def password(query = nil)
-      Inspec.deprecate(:properties_shadow, "The shadow `password` property is deprecated. Please use `passwords` instead.")
-      query.nil? ? where.passwords : where("password" => query)
-    end
-
-    def last_change(query = nil)
-      Inspec.deprecate(:properties_shadow, "The shadow `last_change` property is deprecated. Please use `last_changes` instead.")
-      query.nil? ? where.last_changes : where("last_change" => query)
-    end
-
-    def expiry_date(query = nil)
-      Inspec.deprecate(:properties_shadow, "The shadow `expiry_date` property is deprecated. Please use `expiry_dates` instead.")
-      query.nil? ? where.expiry_dates : where("expiry_date" => query)
-    end
-
-    def lines
-      Inspec.deprecate(:properties_shadow, "The shadow `lines` property is deprecated.")
-      shadow_content.to_s.split("\n")
-    end
-
-    def to_s
-      f = @filters.empty? ? "" : " with" + @filters
-      "#{@path}#{f}"
-    end
-
-    private
-
-    def shadow_content
-      @opts[:content] || read_file_content(@path, allow_empty: true)
-    end
-
-    def set_params
-      @params ||= Array(shadow_content.to_s.split("\n")).map { |l| parse_shadow_line(l) }
-    end
-
-    def map_data(id)
-      set_params.collect { |x| x[id] }
-    end
-
-    # Parse a line of /etc/shadow
-    #
-    # @param [String] line a line of /etc/shadow
-    # @return [Hash] Map of entries in this line
-    def parse_shadow_line(line)
-      x = line.split(":")
-      {
-        "user" => x.at(0),
-        "password" => x.at(1),
-        "last_change" => x.at(2),
-        "min_days" => x.at(3),
-        "max_days" => x.at(4),
-        "warn_days" => x.at(5),
-        "inactive_days" => x.at(6),
-        "expiry_date" => x.at(7),
-        "reserved" => x.at(8),
-      }
-    end
-  end
-end

data/lib/inspec/resources/ssh_config.rb

@@ -1,98 +0,0 @@
-# copyright: 2015, Vulcano Security GmbH
-
-require "inspec/utils/simpleconfig"
-require "inspec/utils/file_reader"
-
-module Inspec::Resources
-  class SshConfig < Inspec.resource(1)
-    name "ssh_config"
-    supports platform: "unix"
-    desc "Use the `ssh_config` InSpec audit resource to test OpenSSH client configuration data located at `/etc/ssh/ssh_config` on Linux and Unix platforms."
-    example <<~EXAMPLE
-      describe ssh_config do
-        its('cipher') { should contain '3des' }
-        its('port') { should eq '22' }
-        its('hostname') { should include('example.com') }
-      end
-    EXAMPLE
-
-    include FileReader
-
-    def initialize(conf_path = nil, type = nil)
-      @conf_path = conf_path || "/etc/ssh/ssh_config"
-      typename = (@conf_path.include?("sshd") ? "Server" : "Client")
-      @type = type || "SSH #{typename} configuration #{conf_path}"
-      read_content
-    end
-
-    def content
-      read_content
-    end
-
-    def params(*opts)
-      opts.inject(read_params) do |res, nxt|
-        res.respond_to?(:key) ? res[nxt] : nil
-      end
-    end
-
-    def convert_hash(hash)
-      new_hash = {}
-      hash.each do |k, v|
-        new_hash[k.downcase] = v
-      end
-      new_hash
-    end
-
-    def method_missing(name)
-      param = read_params[name.to_s.downcase]
-      return nil if param.nil?
-      # extract first value if we have only one value in array
-      return param[0] if param.length == 1
-
-      param
-    end
-
-    def to_s
-      "SSH Configuration"
-    end
-
-    private
-
-    def read_content
-      return @content if defined?(@content)
-
-      @content = read_file_content(@conf_path)
-    end
-
-    def read_params
-      return @params if defined?(@params)
-      return @params = {} if read_content.nil?
-
-      conf = SimpleConfig.new(
-        read_content,
-        assignment_regex: /^\s*(\S+?)\s+(.*?)\s*$/,
-        multiple_values: true
-      )
-      @params = convert_hash(conf.params)
-    end
-  end
-
-  class SshdConfig < SshConfig
-    name "sshd_config"
-    supports platform: "unix"
-    desc "Use the sshd_config InSpec audit resource to test configuration data for the Open SSH daemon located at /etc/ssh/sshd_config on Linux and UNIX platforms. sshd---the Open SSH daemon---listens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command execution, and data exchanges."
-    example <<~EXAMPLE
-      describe sshd_config do
-        its('Protocol') { should eq '2' }
-      end
-    EXAMPLE
-
-    def initialize(path = nil)
-      super(path || "/etc/ssh/sshd_config")
-    end
-
-    def to_s
-      "SSHD Configuration"
-    end
-  end
-end

data/lib/inspec/resources/sshd_config.rb

@@ -1,2 +0,0 @@
-# This is just here to make the dynamic loader happy.
-require "inspec/resources/ssh_config.rb"

data/lib/inspec/resources/ssl.rb

@@ -1,99 +0,0 @@
-# copyright: 2015, Chef Software Inc.
-
-require "sslshake"
-require "inspec/utils/filter"
-require "uri"
-require "parallel"
-
-# Custom resource based on the InSpec resource DSL
-module Inspec::Resources
-  class SSL < Inspec.resource(1)
-    name "ssl"
-    supports platform: "unix"
-    supports platform: "windows"
-
-    desc "
-      SSL test resource
-    "
-
-    example <<~EXAMPLE
-      describe ssl(port: 443) do
-        it { should be_enabled }
-      end
-
-      # protocols: ssl2, ssl3, tls1.0, tls1.1, tls1.2
-      describe ssl(port: 443).protocols('ssl2') do
-        it { should_not be_enabled }
-      end
-
-      # any ciphers, filter by name or regex
-      describe ssl(port: 443).ciphers(/rc4/i) do
-        it { should_not be_enabled }
-      end
-    EXAMPLE
-
-    VERSIONS = [
-      "ssl2",
-      "ssl3",
-      "tls1.0",
-      "tls1.1",
-      "tls1.2",
-    ].freeze
-
-    attr_reader :host, :port, :timeout, :retries
-
-    def initialize(opts = {})
-      @host = opts[:host]
-      if @host.nil?
-        # Transports like SSH and WinRM will provide a hostname
-        if inspec.backend.respond_to?("hostname")
-          @host = inspec.backend.hostname
-        elsif inspec.backend.class.to_s == "Train::Transports::Local::Connection"
-          @host = "localhost"
-        end
-      end
-      @port = opts[:port] || 443
-      @timeout = opts[:timeout]
-      @retries = opts[:retries]
-    end
-
-    filter = FilterTable.create
-    filter.register_custom_matcher(:enabled?) do |x|
-      raise "Cannot determine host for SSL test. Please specify it or use a different target." if x.resource.host.nil?
-
-      x.handshake.values.any? { |i| i["success"] }
-    end
-    filter.register_column(:ciphers, field: "cipher")
-      .register_column(:protocols, field: "protocol")
-      .register_custom_property(:handshake) do |x|
-        groups = x.entries.group_by(&:protocol)
-        res = Parallel.map(groups, in_threads: 8) do |proto, e|
-          [proto, SSLShake.hello(x.resource.host, port: x.resource.port,
-            protocol: proto, ciphers: e.map(&:cipher),
-            timeout: x.resource.timeout, retries: x.resource.retries, servername: x.resource.host)]
-        end
-        Hash[res]
-      end
-      .install_filter_methods_on_resource(self, :scan_config)
-
-    def to_s
-      "SSL/TLS on #{@host}:#{@port}"
-    end
-
-    private
-
-    def scan_config
-      [
-        { "protocol" => "ssl2", "ciphers" => SSLShake::SSLv2::CIPHERS.keys },
-        { "protocol" => "ssl3", "ciphers" => SSLShake::TLS::SSL3_CIPHERS.keys },
-        { "protocol" => "tls1.0", "ciphers" => SSLShake::TLS::TLS10_CIPHERS.keys },
-        { "protocol" => "tls1.1", "ciphers" => SSLShake::TLS::TLS10_CIPHERS.keys },
-        { "protocol" => "tls1.2", "ciphers" => SSLShake::TLS::TLS_CIPHERS.keys },
-      ].map do |line|
-        line["ciphers"].map do |cipher|
-          { "protocol" => line["protocol"], "cipher" => cipher }
-        end
-      end.flatten
-    end
-  end
-end

data/lib/inspec/resources/sys_info.rb

@@ -1,119 +0,0 @@
-require "inspec/resources/command"
-require "inspec/resources/powershell"
-
-module Inspec::Resources
-  # this resource returns additional system informatio
-  class System < Inspec.resource(1)
-    name "sys_info"
-    supports platform: "unix"
-    supports platform: "windows"
-
-    desc "Use the user InSpec system resource to test for operating system properties."
-    example <<~EXAMPLE
-      describe sys_info do
-        its('hostname') { should eq 'example.com' }
-      end
-
-      describe sys_info do
-        its('fqdn') { should eq 'user.example.com' }
-      end
-
-    EXAMPLE
-
-    %w{ domain fqdn ip_address short }.each do |opt|
-      define_method(opt.to_sym) do
-        hostname(opt)
-      end
-    end
-
-    # returns the hostname of the local system
-    def hostname(opt = nil)
-      os = inspec.os
-      if os.linux?
-        linux_hostname(opt)
-      elsif os.darwin?
-        mac_hostname(opt)
-      elsif os.windows?
-        if !opt.nil?
-          skip_resource "The `sys_info.hostname` resource is not supported with that option on your OS."
-        else
-          inspec.powershell("$env:computername").stdout.chomp
-        end
-      else
-        skip_resource "The `sys_info.hostname` resource is not supported on your OS yet."
-      end
-    end
-
-    def linux_hostname(opt = nil)
-      if opt
-        opt = case opt
-              when "f", "long", "fqdn", "full"
-                " -f"
-              when "d", "domain"
-                " -d"
-              when "i", "ip_address"
-                " -I"
-              when "s", "short"
-                " -s"
-              else
-                "ERROR"
-              end
-      end
-      if opt == "ERROR"
-        skip_resource "The `sys_info.hostname` resource is not supported with that option on your OS."
-      else
-        inspec.command("hostname#{opt}").stdout.chomp
-      end
-    end
-
-    def mac_hostname(opt = nil)
-      if opt
-        opt = case opt
-              when "f", "long", "fqdn", "full"
-                " -f"
-              when "s", "short"
-                " -s"
-              else
-                "ERROR"
-              end
-      end
-      if opt == "ERROR"
-        skip_resource "The `sys_info.hostname` resource is not supported with that option on your OS."
-      else
-        inspec.command("hostname#{opt}").stdout.chomp
-      end
-    end
-
-    # returns the Manufacturer of the local system
-    def manufacturer
-      os = inspec.os
-      if os.darwin?
-        "Apple Inc."
-      elsif os.linux?
-        inspec.command("cat /sys/class/dmi/id/sys_vendor").stdout.chomp
-      elsif os.windows?
-        inspec.powershell("Get-CimInstance -ClassName Win32_ComputerSystem | Select Manufacturer -ExpandProperty Manufacturer").stdout.chomp
-      else
-        skip_resource "The `sys_info.manufacturer` resource is not supported on your OS yet."
-      end
-    end
-
-    # returns the ServerModel of the local system
-    def model
-      os = inspec.os
-      if os.darwin?
-        inspec.command("sysctl -n hw.model").stdout.chomp
-      elsif os.linux?
-        inspec.command("cat /sys/class/dmi/id/product_name").stdout.chomp
-      elsif os.windows?
-        inspec.powershell("Get-CimInstance -ClassName Win32_ComputerSystem | Select Model -ExpandProperty Model").stdout.chomp
-      else
-        skip_resource "The `sys_info.model` resource is not supported on your OS yet."
-      end
-    end
-
-    def to_s
-      "System Information"
-    end
-  end
-end