2015-04-09 22:01:23 +02:00
# encoding: utf-8
2015-07-15 15:15:18 +02:00
# copyright: 2015, Vulcano Security GmbH
2015-10-06 18:55:44 +02:00
# author: Dominik Richter
# author: Christoph Hartmann
2015-04-09 22:01:23 +02:00
require 'utils/simpleconfig'
2016-03-08 13:06:55 -05:00
module Inspec::Resources
class SshConf < Inspec . resource ( 1 )
name 'ssh_config'
2017-04-18 12:01:55 +02:00
desc 'Use the `ssh_config` InSpec audit resource to test OpenSSH client configuration data located at `/etc/ssh/ssh_config` on Linux and Unix platforms.'
2016-03-08 13:06:55 -05:00
example "
2017-04-18 12:01:55 +02:00
describe ssh_config do
its ( 'cipher' ) { should contain '3des' }
its ( 'port' ) { should eq '22' }
its ( 'hostname' ) { should include ( 'example.com' ) }
2016-03-08 13:06:55 -05:00
end
"
def initialize ( conf_path = nil , type = nil )
@conf_path = conf_path || '/etc/ssh/ssh_config'
typename = ( @conf_path . include? ( 'sshd' ) ? 'Server' : 'Client' )
@type = type || " SSH #{ typename } configuration #{ conf_path } "
2015-11-27 14:02:38 +01:00
end
2015-04-09 22:01:23 +02:00
2016-03-08 13:06:55 -05:00
def content
read_content
end
2015-04-09 22:01:23 +02:00
2016-03-08 13:06:55 -05:00
def params ( * opts )
opts . inject ( read_params ) do | res , nxt |
res . respond_to? ( :key ) ? res [ nxt ] : nil
end
end
2015-04-09 22:01:23 +02:00
2016-08-15 16:03:44 -04:00
def convert_hash ( hash )
new_hash = { }
2016-08-15 17:39:28 -04:00
hash . each do | k , v |
2016-08-15 16:03:44 -04:00
new_hash [ k . downcase ] = v
end
new_hash
end
2016-03-08 13:06:55 -05:00
def method_missing ( name )
2016-08-15 16:03:44 -04:00
param = read_params [ name . to_s . downcase ]
2016-03-08 13:06:55 -05:00
return nil if param . nil?
# extract first value if we have only one value in array
return param [ 0 ] if param . length == 1
param
2015-04-09 22:01:23 +02:00
end
2016-03-08 13:06:55 -05:00
def to_s
'SSH Configuration'
end
2015-04-09 22:01:23 +02:00
2016-03-08 13:06:55 -05:00
private
2015-10-12 13:01:58 +02:00
2016-03-08 13:06:55 -05:00
def read_content
return @content if defined? ( @content )
file = inspec . file ( @conf_path )
if ! file . file?
return skip_resource " Can't find file \" #{ @conf_path } \" "
end
2015-09-02 00:50:52 +02:00
2016-03-08 13:06:55 -05:00
@content = file . content
2017-02-08 16:49:16 -06:00
if @content . empty? && ! file . empty?
2016-03-08 13:06:55 -05:00
return skip_resource " Can't read file \" #{ @conf_path } \" "
end
2015-08-27 20:02:38 -07:00
2016-03-08 13:06:55 -05:00
@content
2015-06-21 16:33:08 +02:00
end
2015-08-27 20:02:38 -07:00
2016-03-08 13:06:55 -05:00
def read_params
return @params if defined? ( @params )
return @params = { } if read_content . nil?
conf = SimpleConfig . new (
read_content ,
2017-04-26 23:18:14 +02:00
assignment_regex : / ^ \ s*( \ S+?) \ s+(.*?) \ s*$ / ,
2016-03-08 13:06:55 -05:00
multiple_values : true ,
)
2016-08-15 16:03:44 -04:00
@params = convert_hash ( conf . params )
2016-03-08 13:06:55 -05:00
end
2015-04-09 22:01:23 +02:00
end
2016-03-08 13:06:55 -05:00
class SshdConf < SshConf
name 'sshd_config'
2017-04-18 12:01:55 +02:00
desc 'Use the sshd_config InSpec audit resource to test configuration data for the Open SSH daemon located at /etc/ssh/sshd_config on Linux and UNIX platforms. sshd---the Open SSH daemon---listens on dedicated ports, starts a daemon for each incoming connection, and then handles encryption, authentication, key exchanges, command execution, and data exchanges.'
example "
describe sshd_config do
its ( 'Protocol' ) { should eq '2' }
end
"
2015-08-28 10:10:03 -07:00
2016-03-08 13:06:55 -05:00
def initialize ( path = nil )
super ( path || '/etc/ssh/sshd_config' )
end
2017-04-18 12:01:55 +02:00
def to_s
'SSHD Configuration'
end
2015-08-01 09:43:38 +02:00
end
end