mirror of
https://github.com/inspec/inspec
synced 2024-11-23 21:23:29 +00:00
9cfc86d2ab
Light formatting changes, change order of example and matchers, slight color changes Signed-off-by: hannah-radish <hmaddy@chef.io>
84 lines
2.6 KiB
Text
84 lines
2.6 KiB
Text
---
|
|
title: About the inetd_conf Resource
|
|
---
|
|
|
|
# inetd_conf
|
|
|
|
Use the `inetd_conf` InSpec audit resource to test if a service is listed in the `inetd.conf` file on Linux and Unix platforms. inetd---the Internet service daemon---listens on dedicated ports, and then loads the appropriate program based on a request. The `inetd.conf` file is typically located at `/etc/inetd.conf` and contains a list of Internet services associated to the ports on which that service will listen. Only enabled services may handle a request; only services that are required by the system should be enabled.`
|
|
|
|
<br>
|
|
|
|
## Syntax
|
|
|
|
An `inetd_conf` resource block declares the list of services that are enabled in the `inetd.conf` file:
|
|
|
|
describe inetd_conf('path') do
|
|
its('service_name') { should eq 'value' }
|
|
end
|
|
|
|
where
|
|
|
|
* `'service_name'` is a service listed in the `inetd.conf` file
|
|
* `('path')` is the non-default path to the `inetd.conf` file
|
|
* `should eq 'value'` is the value that is expected
|
|
|
|
<br>
|
|
|
|
## Examples
|
|
|
|
The following examples show how to use this InSpec audit resource.
|
|
|
|
### Verify that FTP is disabled
|
|
|
|
The contents if the `inetd.conf` file contain the following:
|
|
|
|
#ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a
|
|
#telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd
|
|
|
|
and the following test is defined:
|
|
|
|
describe inetd_conf do
|
|
its('ftp') { should eq nil }
|
|
its('telnet') { should eq nil }
|
|
end
|
|
|
|
Because both the `ftp` and `telnet` Internet services are commented out (`#`), both services are disabled. Consequently, both tests will return `true`. However, if the `inetd.conf` file is set as follows:
|
|
|
|
ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a
|
|
#telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd
|
|
|
|
then the same test will return `false` for `ftp` and the entire test will fail.
|
|
|
|
### Test if telnet is installed
|
|
|
|
describe package('telnetd') do
|
|
it { should_not be_installed }
|
|
end
|
|
|
|
describe inetd_conf do
|
|
its('telnet') { should eq nil }
|
|
end
|
|
|
|
<br>
|
|
|
|
## Matchers
|
|
|
|
This resource matches any service that is listed in the `inetd.conf` file. You may want to ensure that specific services do not listen via `inetd.conf`. For a full list of available matchers please visit our [matchers page](https://www.inspec.io/docs/reference/matchers/).
|
|
|
|
its('shell') { should eq nil }
|
|
|
|
or:
|
|
|
|
its('netstat') { should eq nil }
|
|
|
|
or:
|
|
|
|
its('systat') { should eq nil }
|
|
|
|
For example:
|
|
|
|
describe inetd_conf do
|
|
its('shell') { should eq nil }
|
|
its('login') { should eq nil }
|
|
its('exec') { should eq nil }
|
|
end
|