openstack_taster 1.0.1 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d197f40b701de60109b9171f250962922dc2f860
-  data.tar.gz: 70c9e7da35b886369ae89a4dece5b1e50260235a
+  metadata.gz: 847cb5a20b108d188a612e254b26c30d553efd90
+  data.tar.gz: 36527d054338e59a9a6410541a3e532b1b096caa
 SHA512:
-  metadata.gz: d2868e2dae6f66633d73f6ddb54edf80b905e3c35b6b08121128c77729ce597a5e64d7f76c08d1f26e5cb56f9140499e76de3e44ea2e8904b03693e903bbf455
-  data.tar.gz: f391b2d1d487bd2e4fedd8ba9aaa49f7599b3769ff71d0c120fdb9f93b9a63426deb8c8da841bee5d302cb1636c9d080f13bdee7e684bf7f70bcdda343744901
+  metadata.gz: 94623399b8a7d779b9db8e96410dcaffb4c144c2c41d0b2ba6ecbbdd6d5da1e100ac55b67be4efe9fb959a4b1f6ca7926928715e8bd56c1f60fbedb83b68f975
+  data.tar.gz: ab0ae7a389592b96ae43e5a712c2ed5af1a438cd277dae8ee6126d3bd6492aaa5ade5713d1b7db3ace62aab69cb590e5ff7b22961a3366ce6f0d9c7caa361d67

data/lib/openstack_taster.rb

@@ -9,7 +9,7 @@ require 'inspec'
 
 # @author Andrew Tolvstad, Samarendra Hedaoo, Cody Holliday
 class OpenStackTaster
-  INSTANCE_FLAVOR_NAME = 'm1.small'
+  INSTANCE_FLAVOR_NAME = 'm1.tiny'
   INSTANCE_NETWORK_NAME = 'public'
   INSTANCE_NAME_PREFIX = 'taster'
   INSTANCE_VOLUME_MOUNT_POINT = '/mnt/taster_volume'
@@ -155,6 +155,7 @@ class OpenStackTaster
       'host' => instance.addresses['public'].first['addr'],
       'port' => 22,
       'user' => username,
+      'sudo' => true,
       'keys_only' => true,
       'key_files' => @ssh_private_key,
       'logger' => instance.logger

data/tests/controls/security_test.rb

@@ -4,13 +4,25 @@ control 'security-1.0' do
   title 'Openstack Image Security Test'
   desc 'Tests the security of images used for Openstack.'
 
-  username = user.username
+  username = os.name
 
-  describe sshd_config do
-    its('PermitRootLogin') { should eq 'no' }
-    its('PasswordAuthentication') { should eq 'no' }
-    its('ChallengeResponseAuthentication') { should eq 'no' }
-    its('KbdInteractiveAuthentication') { should eq 'no' }
+  describe 'saved sshd config' do
+    let(:resource) { command('sudo cat /etc/ssh/sshd_config') }
+
+    it 'should not permit root login' do
+      expect(resource.stdout).to cmp(/^PermitRootLogin no/i)
+    end
+
+    it 'should not permit password authentication' do
+      expect(resource.stdout).to cmp(/^PasswordAuthentication no/i)
+    end
+
+    it 'should not permit challenge response authentication' do
+      expect(resource.stdout).to cmp(/^ChallengeResponseAuthentication no/i)
+    end
+    it 'should not permit keyboard interactive authentication' do
+      expect(resource.stdout).to cmp(/^KbdInteractiveAuthentication no/i)
+    end
   end
 
   describe 'running sshd config' do
@@ -48,4 +60,14 @@ control 'security-1.0' do
       its('stdout') { should cmp(/\(ALL\) ((NO)*PASSWD)*: ALL/) }
     end
   end
+
+  # ssh should be the only thing listening
+  describe port.where { protocol =~ /tcp/ && port != 22 } do
+    it { should_not be_listening }
+  end
+
+  # It's OK if dhclient is listening
+  describe port.where { protocol =~ /udp/ && port != 68 && process != 'dhclient' } do
+    it { should_not be_listening }
+  end
 end

data/tests/inspec.yml

@@ -3,5 +3,5 @@ title: OpenPower Security Test Suite
 maintainer: OSU Open Source Lab
 copyright: Oregon State University
 license: Apache License, Version 2.0
-summary: Verify that an image has correctly configured security settings. 
-version: 1.0.0
+summary: Verify that an image has correctly configured security settings.
+version: 1.0.2

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: openstack_taster
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.2
 platform: ruby
 authors:
 - OSU Open Source Lab
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-27 00:00:00.000000000 Z
+date: 2017-12-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: inspec
@@ -115,7 +115,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.10
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Taste all of the OpenStack's basic functionality for an image