mirror of
https://github.com/inspec/inspec
synced 2024-11-14 00:47:10 +00:00
4b9acb4800
* Bump Rubocop to 0.49.1 This change bumps Rubocop to 0.49.1. There have been a lot of changes since 0.39.0 and this PR is hopefully a nice compromise of turning off certain cops and updating our codebase to take advantage of new Ruby 2.3 methods and operators. Signed-off-by: Adam Leff <adam@leff.co> * Set end-of-line format to line-feed only, avoid Windows-related CRLF issues Signed-off-by: Adam Leff <adam@leff.co>
652 lines
21 KiB
Ruby
652 lines
21 KiB
Ruby
# encoding: utf-8
|
|
# author: Christoph Hartmann
|
|
# author: Dominik Richter
|
|
|
|
require 'utils/parser'
|
|
require 'utils/convert'
|
|
require 'utils/filter'
|
|
|
|
module Inspec::Resources
|
|
# This file contains two resources, the `user` and `users` resource.
|
|
# The `user` resource is optimized for requests that verify specific users
|
|
# that you know upfront for testing. If you need to query all users or search
|
|
# specific users with certain properties, use the `users` resource.
|
|
module UserManagementSelector
|
|
# select user provider based on the operating system
|
|
# returns nil, if no user manager was found for the operating system
|
|
def select_user_manager(os)
|
|
if os.linux?
|
|
LinuxUser.new(inspec)
|
|
elsif os.windows?
|
|
WindowsUser.new(inspec)
|
|
elsif ['darwin'].include?(os[:family])
|
|
DarwinUser.new(inspec)
|
|
elsif ['freebsd'].include?(os[:family])
|
|
FreeBSDUser.new(inspec)
|
|
elsif ['aix'].include?(os[:family])
|
|
AixUser.new(inspec)
|
|
elsif os.solaris?
|
|
SolarisUser.new(inspec)
|
|
elsif ['hpux'].include?(os[:family])
|
|
HpuxUser.new(inspec)
|
|
end
|
|
end
|
|
end
|
|
|
|
# The InSpec users resources looksup all local users available on a system.
|
|
# TODO: the current version of the users resource will use eg. /etc/passwd
|
|
# on Linux to parse all usernames. Therefore the resource may not return
|
|
# users managed on other systems like LDAP/ActiveDirectory. Please open
|
|
# a feature request at https://github.com/chef/inspec if you need that
|
|
# functionality
|
|
#
|
|
# This resource allows complex filter mechanisms
|
|
#
|
|
# describe users.where(uid: 0).entries do
|
|
# it { should eq ['root'] }
|
|
# its('uids') { should eq [1234] }
|
|
# its('gids') { should eq [1234] }
|
|
# end
|
|
#
|
|
# describe users.where { uid =~ /S\-1\-5\-21\-\d+\-\d+\-\d+\-500/ } do
|
|
# it { should exist }
|
|
# end
|
|
class Users < Inspec.resource(1)
|
|
include UserManagementSelector
|
|
|
|
name 'users'
|
|
desc 'Use the users InSpec audit resource to test local user profiles. Users can be filtered by groups to which they belong, the frequency of required password changes, the directory paths to home and shell.'
|
|
example "
|
|
describe users.where { uid == 0 }.entries do
|
|
it { should eq ['root'] }
|
|
its('uids') { should eq [1234] }
|
|
its('gids') { should eq [1234] }
|
|
end
|
|
"
|
|
def initialize
|
|
# select user provider
|
|
@user_provider = select_user_manager(inspec.os)
|
|
return skip_resource 'The `users` resource is not supported on your OS yet.' if @user_provider.nil?
|
|
end
|
|
|
|
filter = FilterTable.create
|
|
filter.add_accessor(:where)
|
|
.add_accessor(:entries)
|
|
.add(:usernames, field: :username)
|
|
.add(:uids, field: :uid)
|
|
.add(:gids, field: :gid)
|
|
.add(:groupnames, field: :groupname)
|
|
.add(:groups, field: :groups)
|
|
.add(:homes, field: :home)
|
|
.add(:shells, field: :shell)
|
|
.add(:mindays, field: :mindays)
|
|
.add(:maxdays, field: :maxdays)
|
|
.add(:warndays, field: :warndays)
|
|
.add(:disabled, field: :disabled)
|
|
.add(:exists?) { |x| !x.entries.empty? }
|
|
.add(:disabled?) { |x| x.where { disabled == false }.entries.empty? }
|
|
.add(:enabled?) { |x| x.where { disabled == true }.entries.empty? }
|
|
filter.connect(self, :collect_user_details)
|
|
|
|
def to_s
|
|
'Users'
|
|
end
|
|
|
|
private
|
|
|
|
# method to get all available users
|
|
def list_users
|
|
@username_cache ||= @user_provider.list_users unless @user_provider.nil?
|
|
end
|
|
|
|
# collects information about every user
|
|
def collect_user_details
|
|
@users_cache ||= @user_provider.collect_user_details unless @user_provider.nil?
|
|
end
|
|
end
|
|
|
|
# The `user` resource handles the special case where only one resource is required
|
|
#
|
|
# describe user('root') do
|
|
# it { should exist }
|
|
# its('uid') { should eq 0 }
|
|
# its('gid') { should eq 0 }
|
|
# its('group') { should eq 'root' }
|
|
# its('groups') { should eq ['root', 'wheel']}
|
|
# its('home') { should eq '/root' }
|
|
# its('shell') { should eq '/bin/bash' }
|
|
# its('mindays') { should eq 0 }
|
|
# its('maxdays') { should eq 99 }
|
|
# its('warndays') { should eq 5 }
|
|
# end
|
|
#
|
|
# The following Serverspec matchers are deprecated in favor for direct value access
|
|
#
|
|
# describe user('root') do
|
|
# it { should belong_to_group 'root' }
|
|
# it { should have_uid 0 }
|
|
# it { should have_home_directory '/root' }
|
|
# it { should have_login_shell '/bin/bash' }
|
|
# its('minimum_days_between_password_change') { should eq 0 }
|
|
# its('maximum_days_between_password_change') { should eq 99 }
|
|
# end
|
|
#
|
|
# ServerSpec tests that are not supported:
|
|
#
|
|
# describe user('root') do
|
|
# it { should have_authorized_key 'ssh-rsa ADg54...3434 user@example.local' }
|
|
# its(:encrypted_password) { should eq 1234 }
|
|
# end
|
|
class User < Inspec.resource(1)
|
|
include UserManagementSelector
|
|
name 'user'
|
|
desc 'Use the user InSpec audit resource to test user profiles, including the groups to which they belong, the frequency of required password changes, the directory paths to home and shell.'
|
|
example "
|
|
describe user('root') do
|
|
it { should exist }
|
|
its('uid') { should eq 1234 }
|
|
its('gid') { should eq 1234 }
|
|
end
|
|
"
|
|
def initialize(username = nil)
|
|
@username = username
|
|
# select user provider
|
|
@user_provider = select_user_manager(inspec.os)
|
|
return skip_resource 'The `user` resource is not supported on your OS yet.' if @user_provider.nil?
|
|
end
|
|
|
|
def exists?
|
|
!identity.nil? && !identity[:username].nil?
|
|
end
|
|
|
|
def disabled?
|
|
identity[:disabled] == true unless identity.nil?
|
|
end
|
|
|
|
def enabled?
|
|
identity[:disabled] == false unless identity.nil?
|
|
end
|
|
|
|
def username
|
|
identity[:username] unless identity.nil?
|
|
end
|
|
|
|
def uid
|
|
identity[:uid] unless identity.nil?
|
|
end
|
|
|
|
def gid
|
|
identity[:gid] unless identity.nil?
|
|
end
|
|
|
|
def groupname
|
|
identity[:groupname] unless identity.nil?
|
|
end
|
|
alias group groupname
|
|
|
|
def groups
|
|
identity[:groups] unless identity.nil?
|
|
end
|
|
|
|
def home
|
|
meta_info[:home] unless meta_info.nil?
|
|
end
|
|
|
|
def shell
|
|
meta_info[:shell] unless meta_info.nil?
|
|
end
|
|
|
|
# returns the minimum days between password changes
|
|
def mindays
|
|
credentials[:mindays] unless credentials.nil?
|
|
end
|
|
|
|
# returns the maximum days between password changes
|
|
def maxdays
|
|
credentials[:maxdays] unless credentials.nil?
|
|
end
|
|
|
|
# returns the days for password change warning
|
|
def warndays
|
|
credentials[:warndays] unless credentials.nil?
|
|
end
|
|
|
|
# implement 'mindays' method to be compatible with serverspec
|
|
def minimum_days_between_password_change
|
|
deprecated('minimum_days_between_password_change', "Please use: its('mindays')")
|
|
mindays
|
|
end
|
|
|
|
# implement 'maxdays' method to be compatible with serverspec
|
|
def maximum_days_between_password_change
|
|
deprecated('maximum_days_between_password_change', "Please use: its('maxdays')")
|
|
maxdays
|
|
end
|
|
|
|
# implements rspec has matcher, to be compatible with serverspec
|
|
# @see: https://github.com/rspec/rspec-expectations/blob/master/lib/rspec/matchers/built_in/has.rb
|
|
def has_uid?(compare_uid)
|
|
deprecated('has_uid?')
|
|
uid == compare_uid
|
|
end
|
|
|
|
def has_home_directory?(compare_home)
|
|
deprecated('has_home_directory?', "Please use: its('home')")
|
|
home == compare_home
|
|
end
|
|
|
|
def has_login_shell?(compare_shell)
|
|
deprecated('has_login_shell?', "Please use: its('shell')")
|
|
shell == compare_shell
|
|
end
|
|
|
|
def has_authorized_key?(_compare_key)
|
|
deprecated('has_authorized_key?')
|
|
raise NotImplementedError
|
|
end
|
|
|
|
def deprecated(name, alternative = nil)
|
|
warn "[DEPRECATION] #{name} is deprecated. #{alternative}"
|
|
end
|
|
|
|
def to_s
|
|
"User #{@username}"
|
|
end
|
|
|
|
private
|
|
|
|
# returns the iden
|
|
def identity
|
|
return @id_cache if defined?(@id_cache)
|
|
@id_cache = @user_provider.identity(@username) if !@user_provider.nil?
|
|
end
|
|
|
|
def meta_info
|
|
return @meta_cache if defined?(@meta_cache)
|
|
@meta_cache = @user_provider.meta_info(@username) if !@user_provider.nil?
|
|
end
|
|
|
|
def credentials
|
|
return @cred_cache if defined?(@cred_cache)
|
|
@cred_cache = @user_provider.credentials(@username) if !@user_provider.nil?
|
|
end
|
|
end
|
|
|
|
# This is an abstract class that every user provoider has to implement.
|
|
# A user provider implements a system abstracts and helps the InSpec resource
|
|
# hand-over system specific behavior to those providers
|
|
class UserInfo
|
|
include Converter
|
|
|
|
attr_reader :inspec
|
|
def initialize(inspec)
|
|
@inspec = inspec
|
|
end
|
|
|
|
# returns a hash with user-specific values:
|
|
# {
|
|
# uid: '',
|
|
# user: '',
|
|
# gid: '',
|
|
# group: '',
|
|
# groups: '',
|
|
# }
|
|
def identity(_username)
|
|
raise 'user provider must implement the `identity` method'
|
|
end
|
|
|
|
# returns optional information about a user, eg shell
|
|
def meta_info(_username)
|
|
nil
|
|
end
|
|
|
|
# returns a hash with meta-data about user credentials
|
|
# {
|
|
# mindays: 1,
|
|
# maxdays: 1,
|
|
# warndays: 1,
|
|
# }
|
|
# this method is optional and may not be implemented by each provider
|
|
def credentials(_username)
|
|
nil
|
|
end
|
|
|
|
# returns an array with users
|
|
def list_users
|
|
raise 'user provider must implement the `list_users` method'
|
|
end
|
|
|
|
# retuns all aspects of the user as one hash
|
|
def user_details(username)
|
|
item = {}
|
|
id = identity(username)
|
|
item.merge!(id) unless id.nil?
|
|
meta = meta_info(username)
|
|
item.merge!(meta) unless meta.nil?
|
|
cred = credentials(username)
|
|
item.merge!(cred) unless cred.nil?
|
|
item
|
|
end
|
|
|
|
# returns the full information list for a user
|
|
def collect_user_details
|
|
list_users.map { |username|
|
|
user_details(username.chomp)
|
|
}
|
|
end
|
|
end
|
|
|
|
# implements generic unix id handling
|
|
class UnixUser < UserInfo
|
|
attr_reader :inspec, :id_cmd, :list_users_cmd
|
|
def initialize(inspec)
|
|
@inspec = inspec
|
|
@id_cmd ||= 'id'
|
|
@list_users_cmd ||= 'cut -d: -f1 /etc/passwd | grep -v "^#"'
|
|
super
|
|
end
|
|
|
|
# returns a list of all local users on a system
|
|
def list_users
|
|
cmd = inspec.command(list_users_cmd)
|
|
return [] if cmd.exit_status != 0
|
|
cmd.stdout.chomp.lines
|
|
end
|
|
|
|
# parse one id entry like '0(wheel)''
|
|
def parse_value(line)
|
|
SimpleConfig.new(
|
|
line,
|
|
line_separator: ',',
|
|
assignment_regex: /^\s*([^\(]*?)\s*\(\s*(.*?)\)*$/,
|
|
group_re: nil,
|
|
multiple_values: false,
|
|
).params
|
|
end
|
|
|
|
# extracts the identity
|
|
def identity(username)
|
|
cmd = inspec.command("#{id_cmd} #{username}")
|
|
return nil if cmd.exit_status != 0
|
|
|
|
# parse words
|
|
params = SimpleConfig.new(
|
|
parse_id_entries(cmd.stdout.chomp),
|
|
assignment_regex: /^\s*([^=]*?)\s*=\s*(.*?)\s*$/,
|
|
group_re: nil,
|
|
multiple_values: false,
|
|
).params
|
|
|
|
{
|
|
uid: convert_to_i(parse_value(params['uid']).keys[0]),
|
|
username: parse_value(params['uid']).values[0],
|
|
gid: convert_to_i(parse_value(params['gid']).keys[0]),
|
|
groupname: parse_value(params['gid']).values[0],
|
|
groups: parse_value(params['groups']).values,
|
|
}
|
|
end
|
|
|
|
# splits the results of id into seperate lines
|
|
def parse_id_entries(raw)
|
|
data = []
|
|
until (index = raw.index(/\)\s{1}/)).nil?
|
|
data.push(raw[0, index+1]) # inclue closing )
|
|
raw = raw[index+2, raw.length-index-2]
|
|
end
|
|
data.push(raw) if !raw.nil?
|
|
data.join("\n")
|
|
end
|
|
end
|
|
|
|
class LinuxUser < UnixUser
|
|
include PasswdParser
|
|
include CommentParser
|
|
|
|
def meta_info(username)
|
|
cmd = inspec.command("getent passwd #{username}")
|
|
return nil if cmd.exit_status != 0
|
|
# returns: root:x:0:0:root:/root:/bin/bash
|
|
passwd = parse_passwd_line(cmd.stdout.chomp)
|
|
{
|
|
home: passwd['home'],
|
|
shell: passwd['shell'],
|
|
}
|
|
end
|
|
|
|
def credentials(username)
|
|
cmd = inspec.command("chage -l #{username}")
|
|
return nil if cmd.exit_status != 0
|
|
|
|
params = SimpleConfig.new(
|
|
cmd.stdout.chomp,
|
|
assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
|
|
group_re: nil,
|
|
multiple_values: false,
|
|
).params
|
|
|
|
{
|
|
mindays: convert_to_i(params['Minimum number of days between password change']),
|
|
maxdays: convert_to_i(params['Maximum number of days between password change']),
|
|
warndays: convert_to_i(params['Number of days of warning before password expires']),
|
|
}
|
|
end
|
|
end
|
|
|
|
class SolarisUser < LinuxUser
|
|
def initialize(inspec)
|
|
@inspec = inspec
|
|
@id_cmd ||= 'id -a'
|
|
super
|
|
end
|
|
end
|
|
|
|
class AixUser < UnixUser
|
|
def identity(username)
|
|
id = super(username)
|
|
return nil if id.nil?
|
|
# AIX 'id' command doesn't include the primary group in the supplementary
|
|
# yet it can be somewhere in the supplementary list if someone added root
|
|
# to a groups list in /etc/group
|
|
# we rearrange to expected list if that is the case
|
|
if id[:groups].first != id[:group]
|
|
id[:groups].reject! { |i| i == id[:group] } if id[:groups].include?(id[:group])
|
|
id[:groups].unshift(id[:group])
|
|
end
|
|
|
|
id
|
|
end
|
|
|
|
def meta_info(username)
|
|
lsuser = inspec.command("lsuser -C -a home shell #{username}")
|
|
return nil if lsuser.exit_status != 0
|
|
|
|
user = lsuser.stdout.chomp.split("\n").last.split(':')
|
|
{
|
|
home: user[1],
|
|
shell: user[2],
|
|
}
|
|
end
|
|
|
|
def credentials(username)
|
|
cmd = inspec.command(
|
|
"lssec -c -f /etc/security/user -s #{username} -a minage -a maxage -a pwdwarntime",
|
|
)
|
|
return nil if cmd.exit_status != 0
|
|
|
|
user_sec = cmd.stdout.chomp.split("\n").last.split(':')
|
|
|
|
{
|
|
mindays: user_sec[1].to_i * 7,
|
|
maxdays: user_sec[2].to_i * 7,
|
|
warndays: user_sec[3].to_i,
|
|
}
|
|
end
|
|
end
|
|
|
|
class HpuxUser < UnixUser
|
|
def meta_info(username)
|
|
hpuxuser = inspec.command("logins -x -l #{username}")
|
|
return nil if hpuxuser.exit_status != 0
|
|
user = hpuxuser.stdout.chomp.split(' ')
|
|
{
|
|
home: user[4],
|
|
shell: user[5],
|
|
}
|
|
end
|
|
end
|
|
|
|
# we do not use 'finger' for MacOS, because it is harder to parse data with it
|
|
# @see https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/fingerd.8.html
|
|
# instead we use 'dscl' to request user data
|
|
# @see https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/dscl.1.html
|
|
# @see http://superuser.com/questions/592921/mac-osx-users-vs-dscl-command-to-list-user
|
|
class DarwinUser < UnixUser
|
|
def initialize(inspec)
|
|
@list_users_cmd ||= 'dscl . list /Users'
|
|
super
|
|
end
|
|
|
|
def meta_info(username)
|
|
cmd = inspec.command("dscl -q . -read /Users/#{username} NFSHomeDirectory PrimaryGroupID RecordName UniqueID UserShell")
|
|
return nil if cmd.exit_status != 0
|
|
|
|
params = SimpleConfig.new(
|
|
cmd.stdout.chomp,
|
|
assignment_regex: /^\s*([^:]*?)\s*:\s*(.*?)\s*$/,
|
|
group_re: nil,
|
|
multiple_values: false,
|
|
).params
|
|
|
|
{
|
|
home: params['NFSHomeDirectory'],
|
|
shell: params['UserShell'],
|
|
}
|
|
end
|
|
end
|
|
|
|
# FreeBSD recommends to use the 'pw' command for user management
|
|
# @see: https://www.freebsd.org/doc/handbook/users-synopsis.html
|
|
# @see: https://www.freebsd.org/cgi/man.cgi?pw(8)
|
|
# It offers the following commands:
|
|
# - adduser(8) The recommended command-line application for adding new users.
|
|
# - rmuser(8) The recommended command-line application for removing users.
|
|
# - chpass(1) A flexible tool for changing user database information.
|
|
# - passwd(1) The command-line tool to change user passwords.
|
|
class FreeBSDUser < UnixUser
|
|
include PasswdParser
|
|
|
|
def meta_info(username)
|
|
cmd = inspec.command("pw usershow #{username} -7")
|
|
return nil if cmd.exit_status != 0
|
|
# returns: root:*:0:0:Charlie &:/root:/bin/csh
|
|
passwd = parse_passwd_line(cmd.stdout.chomp)
|
|
{
|
|
home: passwd['home'],
|
|
shell: passwd['shell'],
|
|
}
|
|
end
|
|
end
|
|
|
|
# This optimization was inspired by
|
|
# @see https://mcpmag.com/articles/2015/04/15/reporting-on-local-accounts.aspx
|
|
# Alternative solutions are WMI Win32_UserAccount
|
|
# @see https://msdn.microsoft.com/en-us/library/aa394507(v=vs.85).aspx
|
|
# @see https://msdn.microsoft.com/en-us/library/aa394153(v=vs.85).aspx
|
|
class WindowsUser < UserInfo
|
|
def parse_windows_account(username)
|
|
account = username.split('\\')
|
|
name = account.pop
|
|
domain = account.pop if !account.empty?
|
|
[name, domain]
|
|
end
|
|
|
|
def identity(username)
|
|
# TODO: we look for local users only at this point
|
|
name, _domain = parse_windows_account(username)
|
|
return if collect_user_details.nil?
|
|
res = collect_user_details.select { |user| user[:username] == name }
|
|
res[0] if !res.empty?
|
|
end
|
|
|
|
def list_users
|
|
collect_user_details.map { |user| user[:username] }
|
|
end
|
|
|
|
# https://msdn.microsoft.com/en-us/library/aa746340(v=vs.85).aspx
|
|
def collect_user_details # rubocop:disable Metrics/MethodLength
|
|
return @users_cache if defined?(@users_cache)
|
|
script = <<~EOH
|
|
Function ConvertTo-SID { Param([byte[]]$BinarySID)
|
|
(New-Object System.Security.Principal.SecurityIdentifier($BinarySID,0)).Value
|
|
}
|
|
|
|
Function Convert-UserFlag { Param ($UserFlag)
|
|
$List = @()
|
|
Switch ($UserFlag) {
|
|
($UserFlag -BOR 0x0001) { $List += 'SCRIPT' }
|
|
($UserFlag -BOR 0x0002) { $List += 'ACCOUNTDISABLE' }
|
|
($UserFlag -BOR 0x0008) { $List += 'HOMEDIR_REQUIRED' }
|
|
($UserFlag -BOR 0x0010) { $List += 'LOCKOUT' }
|
|
($UserFlag -BOR 0x0020) { $List += 'PASSWD_NOTREQD' }
|
|
($UserFlag -BOR 0x0040) { $List += 'PASSWD_CANT_CHANGE' }
|
|
($UserFlag -BOR 0x0080) { $List += 'ENCRYPTED_TEXT_PWD_ALLOWED' }
|
|
($UserFlag -BOR 0x0100) { $List += 'TEMP_DUPLICATE_ACCOUNT' }
|
|
($UserFlag -BOR 0x0200) { $List += 'NORMAL_ACCOUNT' }
|
|
($UserFlag -BOR 0x0800) { $List += 'INTERDOMAIN_TRUST_ACCOUNT' }
|
|
($UserFlag -BOR 0x1000) { $List += 'WORKSTATION_TRUST_ACCOUNT' }
|
|
($UserFlag -BOR 0x2000) { $List += 'SERVER_TRUST_ACCOUNT' }
|
|
($UserFlag -BOR 0x10000) { $List += 'DONT_EXPIRE_PASSWORD' }
|
|
($UserFlag -BOR 0x20000) { $List += 'MNS_LOGON_ACCOUNT' }
|
|
($UserFlag -BOR 0x40000) { $List += 'SMARTCARD_REQUIRED' }
|
|
($UserFlag -BOR 0x80000) { $List += 'TRUSTED_FOR_DELEGATION' }
|
|
($UserFlag -BOR 0x100000) { $List += 'NOT_DELEGATED' }
|
|
($UserFlag -BOR 0x200000) { $List += 'USE_DES_KEY_ONLY' }
|
|
($UserFlag -BOR 0x400000) { $List += 'DONT_REQ_PREAUTH' }
|
|
($UserFlag -BOR 0x800000) { $List += 'PASSWORD_EXPIRED' }
|
|
($UserFlag -BOR 0x1000000) { $List += 'TRUSTED_TO_AUTH_FOR_DELEGATION' }
|
|
($UserFlag -BOR 0x04000000) { $List += 'PARTIAL_SECRETS_ACCOUNT' }
|
|
}
|
|
$List
|
|
}
|
|
|
|
$Computername = $Env:Computername
|
|
$adsi = [ADSI]"WinNT://$Computername"
|
|
$adsi.Children | where {$_.SchemaClassName -eq 'user'} | ForEach {
|
|
New-Object PSObject -property @{
|
|
uid = ConvertTo-SID -BinarySID $_.ObjectSID[0]
|
|
username = $_.Name[0]
|
|
description = $_.Description[0]
|
|
disabled = $_.AccountDisabled[0]
|
|
userflags = Convert-UserFlag -UserFlag $_.UserFlags[0]
|
|
passwordage = [math]::Round($_.PasswordAge[0]/86400)
|
|
minpasswordlength = $_.MinPasswordLength[0]
|
|
mindays = [math]::Round($_.MinPasswordAge[0]/86400)
|
|
maxdays = [math]::Round($_.MaxPasswordAge[0]/86400)
|
|
warndays = $null
|
|
badpasswordattempts = $_.BadPasswordAttempts[0]
|
|
maxbadpasswords = $_.MaxBadPasswordsAllowed[0]
|
|
gid = $null
|
|
group = $null
|
|
groups = @($_.Groups() | Foreach-Object { $_.GetType().InvokeMember('Name', 'GetProperty', $null, $_, $null) })
|
|
home = $_.HomeDirectory[0]
|
|
shell = $null
|
|
domain = $Computername
|
|
}
|
|
} | ConvertTo-Json
|
|
EOH
|
|
cmd = inspec.powershell(script)
|
|
# cannot rely on exit code for now, successful command returns exit code 1
|
|
# return nil if cmd.exit_status != 0, try to parse json
|
|
begin
|
|
users = JSON.parse(cmd.stdout)
|
|
rescue JSON::ParserError => _e
|
|
return nil
|
|
end
|
|
|
|
# ensure we have an array of groups
|
|
users = [users] if !users.is_a?(Array)
|
|
# convert keys to symbols
|
|
@users_cache = users.map { |user| user.each_with_object({}) { |(k, v), h| h[k.to_sym] = v } }
|
|
end
|
|
end
|
|
end
|