Skip to content

bugfix: use new inspec load mechanism #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chris-rock merged 2 commits into from
Apr 28, 2016
Merged

bugfix: use new inspec load mechanism #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a3090e0
bugfix: use new inspec load mechanism
chris-rock Apr 28, 2016
f689f17
remove ansible symlinks
chris-rock Apr 28, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion ansible_1.9
View file
Open in desktop

This file was deleted.

1 change: 0 additions & 1 deletion ansible_latest
View file
Open in desktop

This file was deleted.

7 changes: 3 additions & 4 deletions controls/ssh_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,9 @@

title 'SSH client config'

$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'libraries'))
require 'ssh_crypto'

ssh_crypto = SshCrypto.new(os)
only_if do
command('ssh').exist?
end

control 'ssh-01' do
impact 1.0
Expand Down
7 changes: 3 additions & 4 deletions controls/sshd_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,9 @@

title 'SSH server config'

$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'libraries'))
require 'ssh_crypto'

ssh_crypto = SshCrypto.new(os)
only_if do
command('sshd').exist?
end

control 'sshd-01' do
impact 1.0
Expand Down
37 changes: 17 additions & 20 deletions libraries/ssh_crypto.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,8 @@
# author: Dominik Richter
# author: Patrick Muench

class SshCrypto # rubocop:disable Metrics/ClassLength
attr_reader :os
def initialize(os)
@os = os
end
class SshCrypto < Inspec.resource(1) # rubocop:disable Metrics/ClassLength
name 'ssh_crypto'

def valid_ciphers
# define a set of default ciphers
Expand All @@ -31,23 +28,23 @@ def valid_ciphers
ciphers = ciphers53

# adjust ciphers based on OS + release
case os[:family]
case inspec.os[:family]
when 'ubuntu'
case os[:release]
case inspec.os[:release]
when '12.04'
ciphers = ciphers53
when '14.04'
ciphers = ciphers66
end
when 'debian'
case os[:release]
case inspec.os[:release]
when /6\./, /7\./
ciphers = ciphers53
when /8\./
ciphers = ciphers66
end
when 'redhat'
case os[:release]
case inspec.os[:release]
when '6.4', '6.5'
ciphers = ciphers53
end
Expand All @@ -63,16 +60,16 @@ def valid_kexs
kex = kex59

# adjust KEXs based on OS + release
case os[:family]
case inspec.os[:family]
when 'ubuntu'
case os[:release]
case inspec.os[:release]
when '12.04'
kex = kex59
when '14.04'
kex = kex66
end
when 'debian'
case os[:release]
case inspec.os[:release]
when /6\./
kex = nil
when /7\./
Expand All @@ -81,7 +78,7 @@ def valid_kexs
kex = kex66
end
when 'redhat', 'centos'
case os[:release]
case inspec.os[:release]
when '6.4', '6.5', /7\./
kex = nil
end
Expand All @@ -98,16 +95,16 @@ def valid_macs
macs = macs59

# adjust MACs based on OS + release
case os[:family]
case inspec.os[:family]
when 'ubuntu'
case os[:release]
case inspec.os[:release]
when '12.04'
macs = macs59
when '14.04'
macs = macs66
end
when 'debian'
case os[:release]
case inspec.os[:release]
when /6\./
macs = macs53
when /7\./
Expand All @@ -116,7 +113,7 @@ def valid_macs
macs = macs66
end
when 'redhat', 'centos'
case os[:release]
case inspec.os[:release]
when '6.4', '6.5', /7\./
macs = macs53
end
Expand All @@ -134,14 +131,14 @@ def valid_privseparation
# debian 7.x and newer has ssh 5.9+
# ubuntu 12.04 and newer has ssh 5.9+

case os[:family]
case inspec.os[:family]
when 'debian'
case os[:release]
case inspec.os[:release]
when /6\./
ps = ps53
end
when 'redhat', 'centos'
case os[:release]
case inspec.os[:release]
# redhat/centos/oracle 6.x has ssh 5.3
when /6\./, /7\./
ps = ps53
Expand Down