inspec 2.2.10 → 2.2.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +36 -24
- data/docs/reporters.md +44 -0
- data/docs/resources/azure_generic_resource.md.erb +2 -0
- data/docs/resources/http.md.erb +3 -3
- data/docs/resources/shadow.md.erb +25 -25
- data/docs/resources/windows_task.md.erb +0 -10
- data/inspec.gemspec +1 -1
- data/lib/bundles/inspec-compliance/README.md +15 -1
- data/lib/inspec/reporters/automate.rb +3 -0
- data/lib/inspec/version.rb +1 -1
- data/lib/resources/auditd.rb +8 -0
- data/lib/resources/azure/azure_generic_resource.rb +2 -0
- data/lib/resources/shadow.rb +36 -34
- metadata +10 -4
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: d449eb17f22c3c36f906fc5ed5be7541e281aef888d6c1bd4e2db3058282afc2
|
|
4
|
+
data.tar.gz: f9a50c6499b0682106a4d3b05ab8776032671b0f04e01323e20f0812d9ae8857
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 13e3b372d12dcbce84246f2bcdebaaf9fd2938093b1c75d1913e095031b1243b37cc869c82d71a826a47b8aa154b9ac9a1da96bf7f3d394a58943361ad8b6419
|
|
7
|
+
data.tar.gz: a3ddf1079f27dc2ba750893d6472d8c2aba7d77c48a7dde980968cd0634dd78b0c55df4f728ab704f916beb9a3bac3f289a8dec10fe5b0733663664859bbffb9
|
data/CHANGELOG.md
CHANGED
|
@@ -1,43 +1,55 @@
|
|
|
1
1
|
# Change Log
|
|
2
2
|
<!-- usage documentation: http://expeditor-docs.es.chef.io/configuration/changelog/ -->
|
|
3
|
-
<!-- latest_release 2.2.
|
|
4
|
-
## [v2.2.
|
|
3
|
+
<!-- latest_release 2.2.16 -->
|
|
4
|
+
## [v2.2.16](https://github.com/inspec/inspec/tree/v2.2.16) (2018-06-15)
|
|
5
5
|
|
|
6
|
-
####
|
|
7
|
-
-
|
|
6
|
+
#### Merged Pull Requests
|
|
7
|
+
- deprecate azure_generic_resource [#3132](https://github.com/inspec/inspec/pull/3132) ([chris-rock](https://github.com/chris-rock))
|
|
8
8
|
<!-- latest_release -->
|
|
9
9
|
|
|
10
|
-
<!-- release_rollup since=2.
|
|
11
|
-
### Changes since 2.
|
|
12
|
-
|
|
13
|
-
#### New Resources
|
|
14
|
-
- Add aws_elb and aws_elbs resources [#3079](https://github.com/inspec/inspec/pull/3079) ([clintoncwolfe](https://github.com/clintoncwolfe)) <!-- 2.2.8 -->
|
|
15
|
-
- Adds a aws_flow_log resource with unit and integration testing. [#2906](https://github.com/inspec/inspec/pull/2906) ([miah](https://github.com/miah)) <!-- 2.2.7 -->
|
|
16
|
-
|
|
17
|
-
#### Bug Fixes
|
|
18
|
-
- Update documentation for shadow resource. [#3042](https://github.com/inspec/inspec/pull/3042) ([miah](https://github.com/miah)) <!-- 2.2.6 -->
|
|
19
|
-
- Two fixes to FilterTable `where` criteria handling [#3045](https://github.com/inspec/inspec/pull/3045) ([clintoncwolfe](https://github.com/clintoncwolfe)) <!-- 2.2.0 -->
|
|
10
|
+
<!-- release_rollup since=2.2.10 -->
|
|
11
|
+
### Changes since 2.2.10 release
|
|
20
12
|
|
|
21
13
|
#### Enhancements
|
|
22
|
-
-
|
|
23
|
-
- Add common methods to FilterTable [#3104](https://github.com/inspec/inspec/pull/3104) ([clintoncwolfe](https://github.com/clintoncwolfe)) <!-- 2.2.2 -->
|
|
24
|
-
- Detect windows packages with trailing/leading spaces [#3106](https://github.com/inspec/inspec/pull/3106) ([jquick](https://github.com/jquick)) <!-- 2.1.86 -->
|
|
14
|
+
- Fix unit tests for ruby 2.5 [#3125](https://github.com/inspec/inspec/pull/3125) ([jquick](https://github.com/jquick)) <!-- 2.2.12 -->
|
|
25
15
|
|
|
26
16
|
#### Merged Pull Requests
|
|
27
|
-
-
|
|
28
|
-
-
|
|
29
|
-
- Add
|
|
30
|
-
-
|
|
31
|
-
-
|
|
32
|
-
- support local npm package searches [#3105](https://github.com/inspec/inspec/pull/3105) ([arlimus](https://github.com/arlimus)) <!-- 2.1.85 -->
|
|
17
|
+
- deprecate azure_generic_resource [#3132](https://github.com/inspec/inspec/pull/3132) ([chris-rock](https://github.com/chris-rock)) <!-- 2.2.16 -->
|
|
18
|
+
- Bump train version for inspec [#3147](https://github.com/inspec/inspec/pull/3147) ([jquick](https://github.com/jquick)) <!-- 2.2.15 -->
|
|
19
|
+
- Add insecure option to the automate report json [#3124](https://github.com/inspec/inspec/pull/3124) ([jquick](https://github.com/jquick)) <!-- 2.2.14 -->
|
|
20
|
+
- Add list properties back to shadow [#3140](https://github.com/inspec/inspec/pull/3140) ([clintoncwolfe](https://github.com/clintoncwolfe)) <!-- 2.2.13 -->
|
|
21
|
+
- Translate `auditd -s` RHEL output to match CentOS [#3114](https://github.com/inspec/inspec/pull/3114) ([jerryaldrichiii](https://github.com/jerryaldrichiii)) <!-- 2.2.11 -->
|
|
33
22
|
<!-- release_rollup -->
|
|
34
23
|
|
|
35
24
|
<!-- latest_stable_release -->
|
|
25
|
+
## [v2.2.10](https://github.com/inspec/inspec/tree/v2.2.10) (2018-06-08)
|
|
26
|
+
|
|
27
|
+
#### New Resources
|
|
28
|
+
- Adds a aws_flow_log resource with unit and integration testing. [#2906](https://github.com/inspec/inspec/pull/2906) ([miah](https://github.com/miah))
|
|
29
|
+
- Add aws_elb and aws_elbs resources [#3079](https://github.com/inspec/inspec/pull/3079) ([clintoncwolfe](https://github.com/clintoncwolfe))
|
|
30
|
+
|
|
31
|
+
#### Enhancements
|
|
32
|
+
- Detect windows packages with trailing/leading spaces [#3106](https://github.com/inspec/inspec/pull/3106) ([jquick](https://github.com/jquick))
|
|
33
|
+
- Add common methods to FilterTable [#3104](https://github.com/inspec/inspec/pull/3104) ([clintoncwolfe](https://github.com/clintoncwolfe))
|
|
34
|
+
- Allow custom resources to access all other resources [#3108](https://github.com/inspec/inspec/pull/3108) ([jquick](https://github.com/jquick))
|
|
35
|
+
|
|
36
|
+
#### Bug Fixes
|
|
37
|
+
- Two fixes to FilterTable `where` criteria handling [#3045](https://github.com/inspec/inspec/pull/3045) ([clintoncwolfe](https://github.com/clintoncwolfe))
|
|
38
|
+
- Update documentation for shadow resource. [#3042](https://github.com/inspec/inspec/pull/3042) ([miah](https://github.com/miah))
|
|
39
|
+
|
|
40
|
+
#### Merged Pull Requests
|
|
41
|
+
- support local npm package searches [#3105](https://github.com/inspec/inspec/pull/3105) ([arlimus](https://github.com/arlimus))
|
|
42
|
+
- Spellcheck FilterTable Developer Documentation [#3111](https://github.com/inspec/inspec/pull/3111) ([jerryaldrichiii](https://github.com/jerryaldrichiii))
|
|
43
|
+
- Refactor: Perform internal rename and add comments to FilterTable [#3047](https://github.com/inspec/inspec/pull/3047) ([clintoncwolfe](https://github.com/clintoncwolfe))
|
|
44
|
+
- Add lazy-loading to FilterTable [#3093](https://github.com/inspec/inspec/pull/3093) ([clintoncwolfe](https://github.com/clintoncwolfe))
|
|
45
|
+
- Update Junit.rb to add failures attribute [#3086](https://github.com/inspec/inspec/pull/3086) ([scboucher](https://github.com/scboucher))
|
|
46
|
+
- Clean up issues in documentation [#3058](https://github.com/inspec/inspec/pull/3058) ([miah](https://github.com/miah))
|
|
47
|
+
<!-- latest_stable_release -->
|
|
48
|
+
|
|
36
49
|
## [v2.1.84](https://github.com/inspec/inspec/tree/v2.1.84) (2018-05-31)
|
|
37
50
|
|
|
38
51
|
#### Merged Pull Requests
|
|
39
52
|
- Generate new org builds [#3087](https://github.com/inspec/inspec/pull/3087) ([jquick](https://github.com/jquick))
|
|
40
|
-
<!-- latest_stable_release -->
|
|
41
53
|
|
|
42
54
|
## [v2.1.83](https://github.com/chef/inspec/tree/v2.1.83) (2018-05-18)
|
|
43
55
|
|
data/docs/reporters.md
CHANGED
|
@@ -115,3 +115,47 @@ This reporter includes all information from the rspec runner. Unlike the json re
|
|
|
115
115
|
### html
|
|
116
116
|
|
|
117
117
|
This renders html code to view your tests in a browser. It includes all the test and summary information.
|
|
118
|
+
|
|
119
|
+
|
|
120
|
+
## Automate Reporter
|
|
121
|
+
|
|
122
|
+
The automate reporter type is a special reporter used with the Automate 2 suite. To use this reporter you must pass in the correct configuration via a json config `--json-config`.
|
|
123
|
+
|
|
124
|
+
Example config:
|
|
125
|
+
```json
|
|
126
|
+
"reporter": {
|
|
127
|
+
"automate" : {
|
|
128
|
+
"stdout" : false,
|
|
129
|
+
"url" : "https://YOUR_A2_URL/data-collector/v0/",
|
|
130
|
+
"token" : "YOUR_A2_ADMIN_TOKEN",
|
|
131
|
+
"insecure" : true,
|
|
132
|
+
"node_name" : "inspec_test_node",
|
|
133
|
+
"environment" : "prod"
|
|
134
|
+
}
|
|
135
|
+
}
|
|
136
|
+
```
|
|
137
|
+
|
|
138
|
+
### Mandatory fields:
|
|
139
|
+
#### stdout
|
|
140
|
+
This will either suppress or show the automate report in the CLI screen on completion
|
|
141
|
+
|
|
142
|
+
#### url
|
|
143
|
+
This is your Automate 2 url. Append `data-collector/v0/` at the end.
|
|
144
|
+
|
|
145
|
+
#### token
|
|
146
|
+
This is your Automate 2 token. You can generate this token by navigating to the admin tab of A2 and then api keys.
|
|
147
|
+
|
|
148
|
+
### Optional fields
|
|
149
|
+
#### insecure
|
|
150
|
+
This will disable or enable the ssl check when accessing the Automate 2 instance.
|
|
151
|
+
|
|
152
|
+
PLEASE NOTE: These fields are ONLY needed if you do not have chef-client attached to a chef server running on your node. The fields below will be automaticlly pulled from the chef server.
|
|
153
|
+
|
|
154
|
+
#### node_name
|
|
155
|
+
This will be the node name which shows up in Automate 2.
|
|
156
|
+
|
|
157
|
+
#### node_uuid
|
|
158
|
+
This overrides the node uuid sent up to Automate 2. On non-chef nodes we will try to generate a static node uuid for you from your hardware. This will almost never be needed unless your working with a unique virtual setup.
|
|
159
|
+
|
|
160
|
+
#### environment
|
|
161
|
+
This will set the enviroment metadata for Automate 2.
|
|
@@ -4,6 +4,8 @@ title: About the azure_generic_resource Resource
|
|
|
4
4
|
|
|
5
5
|
# azure\_generic\_resource
|
|
6
6
|
|
|
7
|
+
<p class="warning">This resource is deprecated and should not be used. It will be removed in InSpec 3.0.</p>
|
|
8
|
+
|
|
7
9
|
Use the `azure_generic_resource` InSpec audit resource to test any valid Azure Resource. This is very useful if you need to test something that we do not yet have a specific Inspec resource for.
|
|
8
10
|
|
|
9
11
|
## Syntax
|
data/docs/resources/http.md.erb
CHANGED
|
@@ -135,7 +135,7 @@ In InSpec 2.0, the HTTP test will automatically execute remotely whenever InSpec
|
|
|
135
135
|
|
|
136
136
|
`open_timeout` may be specified for a timeout for opening connections (default to 60).
|
|
137
137
|
|
|
138
|
-
describe('http://localhost:8080/ping',
|
|
138
|
+
describe http('http://localhost:8080/ping',
|
|
139
139
|
open_timeout: '90') do
|
|
140
140
|
...
|
|
141
141
|
end
|
|
@@ -144,7 +144,7 @@ In InSpec 2.0, the HTTP test will automatically execute remotely whenever InSpec
|
|
|
144
144
|
|
|
145
145
|
`read_timeout` may be specified for a timeout for reading connections (default to 60).
|
|
146
146
|
|
|
147
|
-
describe('http://localhost:8080/ping',
|
|
147
|
+
describe http('http://localhost:8080/ping',
|
|
148
148
|
read_timeout: '90') do
|
|
149
149
|
...
|
|
150
150
|
end
|
|
@@ -153,7 +153,7 @@ In InSpec 2.0, the HTTP test will automatically execute remotely whenever InSpec
|
|
|
153
153
|
|
|
154
154
|
`ssl_verify` may be specified to enable or disable verification of SSL certificates (default to `true`).
|
|
155
155
|
|
|
156
|
-
describe('http://localhost:8080/ping',
|
|
156
|
+
describe http('http://localhost:8080/ping',
|
|
157
157
|
ssl_verify: true) do
|
|
158
158
|
...
|
|
159
159
|
end
|
|
@@ -27,7 +27,7 @@ These entries are defined as a colon-delimited row in the file, one row per user
|
|
|
27
27
|
A `shadow` resource block declares user properties to be tested:
|
|
28
28
|
|
|
29
29
|
describe shadow do
|
|
30
|
-
its('
|
|
30
|
+
its('users') { should_not include 'forbidden_user' }
|
|
31
31
|
end
|
|
32
32
|
|
|
33
33
|
Properties can be used as a single query:
|
|
@@ -39,7 +39,7 @@ Properties can be used as a single query:
|
|
|
39
39
|
Use the `.where` method to find properties that match a value:
|
|
40
40
|
|
|
41
41
|
describe shadow.where { min_days == '0' } do
|
|
42
|
-
its ('
|
|
42
|
+
its ('users') { should include 'nfs' }
|
|
43
43
|
end
|
|
44
44
|
|
|
45
45
|
describe shadow.where { password =~ /[x|!|*]/ } do
|
|
@@ -48,14 +48,14 @@ Use the `.where` method to find properties that match a value:
|
|
|
48
48
|
|
|
49
49
|
The following properties are available:
|
|
50
50
|
|
|
51
|
-
* `
|
|
52
|
-
* `
|
|
53
|
-
* `
|
|
51
|
+
* `users`
|
|
52
|
+
* `passwords`
|
|
53
|
+
* `last_changes`
|
|
54
54
|
* `min_days`
|
|
55
55
|
* `max_days`
|
|
56
56
|
* `warn_days`
|
|
57
57
|
* `inactive_days`
|
|
58
|
-
* `
|
|
58
|
+
* `expiry_dates`
|
|
59
59
|
* `reserved`
|
|
60
60
|
|
|
61
61
|
<br>
|
|
@@ -67,13 +67,13 @@ The following examples show how to use this InSpec audit resource.
|
|
|
67
67
|
### Test for a forbidden user
|
|
68
68
|
|
|
69
69
|
describe shadow do
|
|
70
|
-
its('
|
|
70
|
+
its('users') { should_not include 'forbidden_user' }
|
|
71
71
|
end
|
|
72
72
|
|
|
73
73
|
### Test that a user appears one time
|
|
74
74
|
|
|
75
|
-
describe shadow.
|
|
76
|
-
its('
|
|
75
|
+
describe shadow.users('bin') do
|
|
76
|
+
its('passwords') { should cmp 'x' }
|
|
77
77
|
its('count') { should eq 1 }
|
|
78
78
|
end
|
|
79
79
|
|
|
@@ -81,55 +81,55 @@ The following examples show how to use this InSpec audit resource.
|
|
|
81
81
|
|
|
82
82
|
## Properties
|
|
83
83
|
|
|
84
|
-
###
|
|
84
|
+
### users
|
|
85
85
|
|
|
86
|
-
The `
|
|
86
|
+
The `users` property tests if the username exists `/etc/shadow`:
|
|
87
87
|
|
|
88
|
-
its('
|
|
88
|
+
its('users') { should include 'root' }
|
|
89
89
|
|
|
90
|
-
###
|
|
90
|
+
### passwords
|
|
91
91
|
|
|
92
|
-
The `
|
|
92
|
+
The `passwords` property returns the encrypted password string from the shadow file. The returned string may not be an encrypted password, but rather a `*` or similar which indicates that direct logins are not allowed.
|
|
93
93
|
|
|
94
94
|
For example:
|
|
95
95
|
|
|
96
|
-
its('
|
|
96
|
+
its('passwords') { should cmp '*' }
|
|
97
97
|
|
|
98
|
-
###
|
|
98
|
+
### last\_changes
|
|
99
99
|
|
|
100
|
-
The `
|
|
100
|
+
The `last_changes` property tests the last time a password was changed:
|
|
101
101
|
|
|
102
|
-
its('
|
|
102
|
+
its('last_changes') { should be_empty }
|
|
103
103
|
|
|
104
|
-
###
|
|
104
|
+
### min\_days
|
|
105
105
|
|
|
106
106
|
The `min_days` property tests the minimum number of days a password must exist, before it may be changed:
|
|
107
107
|
|
|
108
108
|
its('min_days') { should eq 0 }
|
|
109
109
|
|
|
110
|
-
###
|
|
110
|
+
### max\_days
|
|
111
111
|
|
|
112
112
|
The `max_days` property tests the maximum number of days after which a password must be changed:
|
|
113
113
|
|
|
114
114
|
its('max_days') { should eq 90 }
|
|
115
115
|
|
|
116
|
-
###
|
|
116
|
+
### warn\_days
|
|
117
117
|
|
|
118
118
|
The `warn_days` property tests the number of days a user is warned about an expiring password:
|
|
119
119
|
|
|
120
120
|
its('warn_days') { should eq 7 }
|
|
121
121
|
|
|
122
|
-
###
|
|
122
|
+
### inactive\_days
|
|
123
123
|
|
|
124
124
|
The `inactive_days` property tests the number of days a user must be inactive before the user account is disabled:
|
|
125
125
|
|
|
126
126
|
its('inactive_days') { should be_empty }
|
|
127
127
|
|
|
128
|
-
###
|
|
128
|
+
### expiry\_dates
|
|
129
129
|
|
|
130
|
-
The `
|
|
130
|
+
The `expiry_dates` property tests the number of days a user account has been disabled:
|
|
131
131
|
|
|
132
|
-
its('
|
|
132
|
+
its('expiry_dates') { should be_empty }
|
|
133
133
|
|
|
134
134
|
### count
|
|
135
135
|
|
|
@@ -33,38 +33,30 @@ The following examples show how to use this InSpec resource.
|
|
|
33
33
|
|
|
34
34
|
### Tests that a task is enabled
|
|
35
35
|
|
|
36
|
-
```ruby
|
|
37
36
|
describe windows_task('\Microsoft\Windows\Time Synchronization\SynchronizeTime') do
|
|
38
37
|
it { should be_enabled }
|
|
39
38
|
end
|
|
40
|
-
```
|
|
41
39
|
|
|
42
40
|
### Tests that a task is disabled
|
|
43
41
|
|
|
44
|
-
```ruby
|
|
45
42
|
describe windows_task('\Microsoft\Windows\AppID\PolicyConverter') do
|
|
46
43
|
it { should be_disabled }
|
|
47
44
|
end
|
|
48
|
-
```
|
|
49
45
|
|
|
50
46
|
### Tests the configuration parameters of a task
|
|
51
47
|
|
|
52
|
-
```ruby
|
|
53
48
|
describe windows_task('\Microsoft\Windows\AppID\PolicyConverter') do
|
|
54
49
|
its('logon_mode') { should eq 'Interactive/Background' }
|
|
55
50
|
its('last_result') { should eq '1' }
|
|
56
51
|
its('task_to_run') { should cmp '%Windir%\system32\appidpolicyconverter.exe' }
|
|
57
52
|
its('run_as_user') { should eq 'LOCAL SERVICE' }
|
|
58
53
|
end
|
|
59
|
-
```
|
|
60
54
|
|
|
61
55
|
### Tests that a task is defined
|
|
62
56
|
|
|
63
|
-
```ruby
|
|
64
57
|
describe windows_task('\Microsoft\Windows\Defrag\ScheduledDefrag') do
|
|
65
58
|
it { should exist }
|
|
66
59
|
end
|
|
67
|
-
```
|
|
68
60
|
|
|
69
61
|
## Gathering Tasknames
|
|
70
62
|
|
|
@@ -76,7 +68,6 @@ rather than use the `list` output you can use `CSV` if it is easier.
|
|
|
76
68
|
|
|
77
69
|
Please make sure you use the full TaskName (include the prefix `\`) within your control
|
|
78
70
|
|
|
79
|
-
```ruby
|
|
80
71
|
C:\>schtasks /query /FO list
|
|
81
72
|
...
|
|
82
73
|
Folder: \Microsoft\Windows\Diagnosis
|
|
@@ -86,7 +77,6 @@ Please make sure you use the full TaskName (include the prefix `\`) within your
|
|
|
86
77
|
Status: Ready
|
|
87
78
|
Logon Mode: Interactive/Background
|
|
88
79
|
...
|
|
89
|
-
```
|
|
90
80
|
|
|
91
81
|
<br>
|
|
92
82
|
|
data/inspec.gemspec
CHANGED
|
@@ -26,7 +26,7 @@ Gem::Specification.new do |spec|
|
|
|
26
26
|
|
|
27
27
|
spec.required_ruby_version = '>= 2.3'
|
|
28
28
|
|
|
29
|
-
spec.add_dependency 'train', '~> 1.4.
|
|
29
|
+
spec.add_dependency 'train', '~> 1.4', '>= 1.4.15'
|
|
30
30
|
spec.add_dependency 'thor', '~> 0.20'
|
|
31
31
|
spec.add_dependency 'json', '>= 1.8', '< 3.0'
|
|
32
32
|
spec.add_dependency 'method_source', '~> 0.8'
|
|
@@ -37,7 +37,7 @@ Commands:
|
|
|
37
37
|
inspec compliance version # displays the version of the Chef Compliance server
|
|
38
38
|
```
|
|
39
39
|
|
|
40
|
-
### Login with Chef
|
|
40
|
+
### Login with Chef Automate 2
|
|
41
41
|
|
|
42
42
|
You will need an API token for authentication. You can retrieve one via the admin section of your A2 web gui.
|
|
43
43
|
|
|
@@ -45,6 +45,20 @@ You will need an API token for authentication. You can retrieve one via the admi
|
|
|
45
45
|
$ inspec compliance login https://automate2.compliance.test --insecure --user 'admin' --token 'zuop..._KzE'
|
|
46
46
|
```
|
|
47
47
|
|
|
48
|
+
#### Login with Chef Automate 2 via json-config
|
|
49
|
+
|
|
50
|
+
With automate 2 you can automatically login by passing a json config via `--json-config`
|
|
51
|
+
|
|
52
|
+
Example:
|
|
53
|
+
```json
|
|
54
|
+
"compliance": {
|
|
55
|
+
"server" : "https://YOUR_A2_URL",
|
|
56
|
+
"token" : "YOUR_A2_ADMIN_TOKEN",
|
|
57
|
+
"user" : "YOUR_A2_USER",
|
|
58
|
+
"insecure" : true
|
|
59
|
+
}
|
|
60
|
+
```
|
|
61
|
+
|
|
48
62
|
### Login with Chef Automate
|
|
49
63
|
|
|
50
64
|
You will need an access token for authentication. You can retrieve one via [UI](https://docs.chef.io/api_delivery.html) or [CLI](https://docs.chef.io/ctl_delivery.html#delivery-token).
|
|
@@ -8,6 +8,9 @@ module Inspec::Reporters
|
|
|
8
8
|
def initialize(config)
|
|
9
9
|
super(config)
|
|
10
10
|
|
|
11
|
+
# allow the insecure flag
|
|
12
|
+
@config['verify_ssl'] = !@config['insecure'] if @config.key?('insecure')
|
|
13
|
+
|
|
11
14
|
# default to not verifying ssl for sending reports
|
|
12
15
|
@config['verify_ssl'] = @config['verify_ssl'] || false
|
|
13
16
|
end
|
data/lib/inspec/version.rb
CHANGED
data/lib/resources/auditd.rb
CHANGED
|
@@ -58,6 +58,14 @@ module Inspec::Resources
|
|
|
58
58
|
|
|
59
59
|
def status(name = nil)
|
|
60
60
|
@status_content ||= inspec.command('/sbin/auditctl -s').stdout.chomp
|
|
61
|
+
|
|
62
|
+
# See: https://github.com/inspec/inspec/issues/3113
|
|
63
|
+
if @status_content =~ /^AUDIT_STATUS/
|
|
64
|
+
@status_content = @status_content.gsub('AUDIT_STATUS: ', '')
|
|
65
|
+
.tr(' ', "\n")
|
|
66
|
+
.tr('=', ' ')
|
|
67
|
+
end
|
|
68
|
+
|
|
61
69
|
@status_params ||= Hash[@status_content.scan(/^([^ ]+) (.*)$/)]
|
|
62
70
|
|
|
63
71
|
return @status_params[name] if name
|
|
@@ -16,6 +16,8 @@ module Inspec::Resources
|
|
|
16
16
|
attr_accessor :filter, :total, :counts, :name, :type, :location, :probes
|
|
17
17
|
|
|
18
18
|
def initialize(opts = {})
|
|
19
|
+
warn "[DEPRECATED] use a specific azure resources instead of 'azure_generic_resource'. See https://github.com/inspec/inspec/issues/3131"
|
|
20
|
+
|
|
19
21
|
# Call the parent class constructor
|
|
20
22
|
super(opts)
|
|
21
23
|
|
data/lib/resources/shadow.rb
CHANGED
|
@@ -44,29 +44,29 @@ module Inspec::Resources
|
|
|
44
44
|
|
|
45
45
|
filtertable = FilterTable.create
|
|
46
46
|
filtertable
|
|
47
|
-
.
|
|
48
|
-
.
|
|
49
|
-
.
|
|
50
|
-
.
|
|
51
|
-
.
|
|
52
|
-
.
|
|
53
|
-
.
|
|
54
|
-
.
|
|
55
|
-
.
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
47
|
+
.register_column(:users, field: 'user')
|
|
48
|
+
.register_column(:passwords, field: 'password')
|
|
49
|
+
.register_column(:last_changes, field: 'last_change')
|
|
50
|
+
.register_column(:min_days, field: 'min_days')
|
|
51
|
+
.register_column(:max_days, field: 'max_days')
|
|
52
|
+
.register_column(:warn_days, field: 'warn_days')
|
|
53
|
+
.register_column(:inactive_days, field: 'inactive_days')
|
|
54
|
+
.register_column(:expiry_dates, field: 'expiry_date')
|
|
55
|
+
.register_column(:reserved, field: 'reserved')
|
|
56
|
+
# These are deprecated, but we need to "alias" them
|
|
57
|
+
filtertable
|
|
58
|
+
.register_custom_property(:user) { |table, value| table.resource.user(value) }
|
|
59
|
+
.register_custom_property(:password) { |table, value| table.resource.password(value) }
|
|
60
|
+
.register_custom_property(:last_change) { |table, value| table.resource.last_change(value) }
|
|
61
|
+
.register_custom_property(:expiry_date) { |table, value| table.resource.expiry_date(value) }
|
|
62
|
+
|
|
63
|
+
filtertable.register_custom_property(:content) { |t, _|
|
|
60
64
|
t.entries.map do |e|
|
|
61
65
|
[e.user, e.password, e.last_change, e.min_days, e.max_days, e.warn_days, e.inactive_days, e.expiry_date].compact.join(':')
|
|
62
66
|
end.join("\n")
|
|
63
67
|
}
|
|
64
68
|
|
|
65
|
-
filtertable.
|
|
66
|
-
i.entries.length
|
|
67
|
-
}
|
|
68
|
-
|
|
69
|
-
filtertable.connect(self, :set_params)
|
|
69
|
+
filtertable.install_filter_methods_on_resource(self, :set_params)
|
|
70
70
|
|
|
71
71
|
def filter(query = {})
|
|
72
72
|
return self if query.nil? || query.empty?
|
|
@@ -88,28 +88,30 @@ module Inspec::Resources
|
|
|
88
88
|
Shadow.new(@path, content: content, filters: @filters + filters)
|
|
89
89
|
end
|
|
90
90
|
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
91
|
+
# Next 4 are deprecated methods. We define them here so we can emit a deprecation message.
|
|
92
|
+
# They are also defined on the Table, above.
|
|
93
|
+
def user(query = nil)
|
|
94
|
+
warn '[DEPRECATION] The shadow `user` property is deprecated and will be removed' \
|
|
95
|
+
' in InSpec 3.0. Please use `users` instead.'
|
|
96
|
+
query.nil? ? where.users : where('user' => query)
|
|
95
97
|
end
|
|
96
98
|
|
|
97
|
-
def
|
|
98
|
-
warn '[DEPRECATION] The shadow `
|
|
99
|
-
' in InSpec 3.0. Please use `
|
|
100
|
-
query.nil? ?
|
|
99
|
+
def password(query = nil)
|
|
100
|
+
warn '[DEPRECATION] The shadow `password` property is deprecated and will be removed' \
|
|
101
|
+
' in InSpec 3.0. Please use `passwords` instead.'
|
|
102
|
+
query.nil? ? where.passwords : where('password' => query)
|
|
101
103
|
end
|
|
102
104
|
|
|
103
|
-
def
|
|
104
|
-
warn '[DEPRECATION] The shadow `
|
|
105
|
-
' in InSpec 3.0. Please use `
|
|
106
|
-
query.nil? ?
|
|
105
|
+
def last_change(query = nil)
|
|
106
|
+
warn '[DEPRECATION] The shadow `last_change` property is deprecated and will be removed' \
|
|
107
|
+
' in InSpec 3.0. Please use `last_changes` instead.'
|
|
108
|
+
query.nil? ? where.last_changes : where('last_change' => query)
|
|
107
109
|
end
|
|
108
110
|
|
|
109
|
-
def
|
|
110
|
-
warn '[DEPRECATION] The shadow `
|
|
111
|
-
' in InSpec 3.0. Please use `
|
|
112
|
-
query.nil? ?
|
|
111
|
+
def expiry_date(query = nil)
|
|
112
|
+
warn '[DEPRECATION] The shadow `expiry_date` property is deprecated and will be removed' \
|
|
113
|
+
' in InSpec 3.0. Please use `expiry_dates` instead.'
|
|
114
|
+
query.nil? ? where.expiry_dates : where('expiry_date' => query)
|
|
113
115
|
end
|
|
114
116
|
|
|
115
117
|
def lines
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: inspec
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 2.2.
|
|
4
|
+
version: 2.2.16
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Dominik Richter
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2018-06-
|
|
11
|
+
date: 2018-06-15 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: train
|
|
@@ -16,14 +16,20 @@ dependencies:
|
|
|
16
16
|
requirements:
|
|
17
17
|
- - "~>"
|
|
18
18
|
- !ruby/object:Gem::Version
|
|
19
|
-
version: 1.4
|
|
19
|
+
version: '1.4'
|
|
20
|
+
- - ">="
|
|
21
|
+
- !ruby/object:Gem::Version
|
|
22
|
+
version: 1.4.15
|
|
20
23
|
type: :runtime
|
|
21
24
|
prerelease: false
|
|
22
25
|
version_requirements: !ruby/object:Gem::Requirement
|
|
23
26
|
requirements:
|
|
24
27
|
- - "~>"
|
|
25
28
|
- !ruby/object:Gem::Version
|
|
26
|
-
version: 1.4
|
|
29
|
+
version: '1.4'
|
|
30
|
+
- - ">="
|
|
31
|
+
- !ruby/object:Gem::Version
|
|
32
|
+
version: 1.4.15
|
|
27
33
|
- !ruby/object:Gem::Dependency
|
|
28
34
|
name: thor
|
|
29
35
|
requirement: !ruby/object:Gem::Requirement
|