2016-01-26 10:54:53 +00:00
# InSpec Extension for Chef Compliance
This extensions offers the following features:
2017-10-26 15:32:47 +00:00
- list available profiles in Chef Automate/Chef Compliance
- execute profiles directly from Chef Automate/Chef Compliance locally
- upload a local profile to Chef Automate/Chef Compliance
2016-01-26 10:54:53 +00:00
2016-02-01 22:42:27 +00:00
To use the CLI, this InSpec add-on adds the following commands:
2016-01-26 10:54:53 +00:00
2017-10-26 15:32:47 +00:00
* `$ inspec compliance login` - authentication of the API token against Chef Automate/Chef Compliance
* `$ inspec compliance profiles` - list all available Compliance profiles
* `$ inspec exec compliance://profile` - runs a Compliance profile
* `$ inspec compliance upload path/to/local/profile` - uploads a local profile to Chef Automate/Chef Compliance
* `$ inspec compliance logout` - logout of Chef Automate/Chef Compliance
2016-02-02 10:16:27 +00:00
2018-03-20 12:43:30 +00:00
Compliance profiles can be executed in two ways:
2016-02-02 10:16:27 +00:00
- via compliance exec: `inspec compliance exec profile`
- via compliance scheme: `inspec exec compliance://profile`
2016-04-13 20:08:44 +00:00
2017-04-13 15:24:17 +00:00
2016-05-06 12:47:07 +00:00
## Usage
2017-04-13 15:24:17 +00:00
### Command options
```
$ inspec compliance
Commands:
inspec compliance download PROFILE # downloads a profile from Chef Compliance
inspec compliance exec PROFILE # executes a Chef Compliance profile
inspec compliance help [COMMAND] # Describe subcommands or one specific subcommand
2017-10-26 15:32:47 +00:00
inspec compliance login SERVER # Log in to a Chef Automate/Chef Compliance SERVER
2017-04-13 15:24:17 +00:00
inspec compliance logout # user logout from Chef Compliance
inspec compliance profiles # list all available profiles in Chef Compliance
inspec compliance upload PATH # uploads a local profile to Chef Compliance
inspec compliance version # displays the version of the Chef Compliance server
```
### Login with Chef Automate
2017-10-26 15:32:47 +00:00
You will need an access token for authentication. You can retrieve one via [UI ](https://docs.chef.io/api_delivery.html ) or [CLI ](https://docs.chef.io/ctl_delivery.html#delivery-token ).
2017-04-13 15:24:17 +00:00
```
2017-10-26 15:32:47 +00:00
$ inspec compliance login https://automate.compliance.test --insecure --user 'admin' --ent 'brewinc' --token 'zuop..._KzE'
2017-04-13 15:24:17 +00:00
```
### Login with Chef Compliance
2017-10-26 15:32:47 +00:00
You will need an access token for authentication. You can retrieve one via:
2016-05-06 12:47:07 +00:00
You can choose the access token (`--token`) or the refresh token (`--refresh_token`)
```
$ inspec compliance login https://compliance.test --user admin --insecure --token '...'
2017-04-13 15:24:17 +00:00
```
### List available profiles via Chef Compliance / Automate
2016-05-06 12:47:07 +00:00
2017-04-13 15:24:17 +00:00
```
2016-05-06 12:47:07 +00:00
$ inspec compliance profiles
Available profiles:
-------------------
* base/apache
* base/linux
* base/mysql
* base/postgres
* base/ssh
* base/windows
* cis/cis-centos6-level1
* cis/cis-centos6-level2
* cis/cis-centos7-level1
* cis/cis-centos7-level2
* cis/cis-rhel7-level1
* cis/cis-rhel7-level2
* cis/cis-ubuntu12.04lts-level1
* cis/cis-ubuntu12.04lts-level2
* cis/cis-ubuntu14.04lts-level1
* cis/cis-ubuntu14.04lts-level2
2017-04-13 15:24:17 +00:00
```
### Upload a profile to Chef Compliance / Automate
2016-05-06 12:47:07 +00:00
2017-04-13 15:24:17 +00:00
```
2016-05-06 12:47:07 +00:00
$ inspec compliance version
Chef Compliance version: 1.0.11
➜ inspec git:(chris-rock/cc-error-not-loggedin) ✗ b inspec compliance upload examples/profile
I, [2016-05-06T14:27:20.907547 #37592 ] INFO -- : Checking profile in examples/profile
I, [2016-05-06T14:27:20.907668 #37592 ] INFO -- : Metadata OK.
I, [2016-05-06T14:27:20.968584 #37592 ] INFO -- : Found 4 controls.
I, [2016-05-06T14:27:20.968638 #37592 ] INFO -- : Control definitions OK.
Profile is valid
Generate temporary profile archive at /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz
I, [2016-05-06T14:27:21.020017 #37592 ] INFO -- : Generate archive /var/folders/jy/2bnrfb4s36jbjtzllvhhyqhw0000gn/T/profile20160506-37592-1tf326f.tar.gz.
I, [2016-05-06T14:27:21.024837 #37592 ] INFO -- : Finished archive generation.
Start upload to admin/profile
Uploading to Chef Compliance
Successfully uploaded profile
# display all profiles
$ inspec compliance profiles
Available profiles:
-------------------
* admin/profile
* base/apache
* base/linux
* base/mysql
* base/postgres
* base/ssh
* base/windows
* cis/cis-centos6-level1
* cis/cis-centos6-level2
* cis/cis-centos7-level1
* cis/cis-centos7-level2
* cis/cis-rhel7-level1
* cis/cis-rhel7-level2
* cis/cis-ubuntu12.04lts-level1
* cis/cis-ubuntu12.04lts-level2
* cis/cis-ubuntu14.04lts-level1
* cis/cis-ubuntu14.04lts-level2
2017-04-13 15:24:17 +00:00
```
2017-10-26 15:32:47 +00:00
### Run a profile from Chef Compliance / Chef Automate on Workstation
2016-05-06 12:47:07 +00:00
2017-04-13 15:24:17 +00:00
```
2016-05-06 12:47:07 +00:00
$ inspec exec compliance://admin/profile
.*...
Pending: (Failures listed here are expected and do not affect your suite's status)
1) gordon_config Can't find file "/tmp/gordon/config.yaml"
# Not yet implemented
# ./lib/inspec/runner.rb:157
Finished in 0.02862 seconds (files took 0.62628 seconds to load)
5 examples, 0 failures, 1 pending
2016-08-17 11:51:26 +00:00
```
2017-09-13 20:53:36 +00:00
Exec a specific version(2.0.1) of a profile when logged in with Automate:
```
$ inspec exec compliance://admin/apache-baseline#2.0.1
```
Download a specific version(2.0.2) of a profile when logged in with Automate:
```
$ inspec compliance download compliance://admin/apache-baseline#2.0.2
```
2017-04-13 15:24:17 +00:00
### To Logout from Chef Compliance
2016-05-06 12:47:07 +00:00
```
$ inspec compliance logout
Successfully logged out
```
2016-04-13 20:08:44 +00:00
## Integration Tests
At this point of time, InSpec is not able to pick up the token directly, therefore the integration test is semi-automatic at this point of time:
* run `kitchen converge`
* open https://192.168.251.2 and log in with user `admin` and password `admin`
2016-08-17 11:51:26 +00:00
* click on user->about and obtain the access token and the refresh token
2016-04-13 20:08:44 +00:00
* run `kitchen verify` with the required env variables:
```
2016-08-17 11:51:26 +00:00
# both token need to be set, since the test suite runs for each token type
export COMPLIANCE_ACCESSTOKEN='mycompliancetoken'
export COMPLIANCE_REFRESHTOKEN='myrefreshtoken'
kitchen verify
2016-04-13 20:08:44 +00:00
-----> Starting Kitchen (v1.7.3)
-----> Verifying < default-ubuntu-1404 > ...
Search `/Users/chartmann/Development/compliance/inspec/lib/bundles/inspec-compliance/test/integration/default` for tests
..................................
Finished in 6.35 seconds (files took 0.40949 seconds to load)
34 examples, 0 failures
Finished verifying < default-ubuntu-1404 > (0m6.62s).
-----> Kitchen is finished. (0m7.02s)
zlib(finalizer): the stream was freed prematurely.
```
