mirror of
https://github.com/inspec/inspec
synced 2024-11-14 17:07:09 +00:00
73 lines
1.7 KiB
Ruby
73 lines
1.7 KiB
Ruby
# encoding: utf-8
|
|
# author: Christoph Hartmann
|
|
# author: Dominik Richter
|
|
#
|
|
# Security Configuration and Analysis
|
|
#
|
|
# Export local security policy:
|
|
# secedit /export /cfg secpol.cfg
|
|
#
|
|
# @link http://www.microsoft.com/en-us/download/details.aspx?id=25250
|
|
#
|
|
# In Windows, some security options are managed differently that the local GPO
|
|
# All local GPO parameters can be examined via Registry, but not all security
|
|
# parameters. Therefore we need a combination of Registry and secedit output
|
|
|
|
class SecurityPolicy < Inspec.resource(1)
|
|
name 'security_policy'
|
|
|
|
def initialize
|
|
@loaded = false
|
|
@policy = nil
|
|
@exit_status = nil
|
|
end
|
|
|
|
# load security content
|
|
def load
|
|
# export the security policy
|
|
inspec.command('secedit /export /cfg win_secpol.cfg')
|
|
# store file content
|
|
command_result ||= inspec.command('type win_secpol.cfg')
|
|
# delete temp file
|
|
inspec.command('del win_secpol.cfg')
|
|
|
|
@exit_status = command_result.exit_status.to_i
|
|
@policy = command_result.stdout
|
|
@loaded = true
|
|
|
|
# returns self
|
|
self
|
|
end
|
|
|
|
def method_missing(method)
|
|
# load data if needed
|
|
if (@loaded == false)
|
|
load
|
|
end
|
|
|
|
# find line with key
|
|
key = Regexp.escape(method.to_s)
|
|
target = ''
|
|
@policy.each_line {|s|
|
|
target = s.strip if s.match(/^\s*#{key}\s*=\s*(.*)\b/)
|
|
}
|
|
|
|
# extract variable value
|
|
result = target.match(/[=]{1}\s*(?<value>.*)/)
|
|
|
|
if !result.nil?
|
|
val = result[:value]
|
|
val = val.to_i if val.match(/^\d+$/)
|
|
else
|
|
# TODO: we may need to return skip or failure if the
|
|
# requested value is not available
|
|
val = nil
|
|
end
|
|
|
|
val
|
|
end
|
|
|
|
def to_s
|
|
'Security Policy'
|
|
end
|
|
end
|