Skip to content

Commit

Permalink
Merge pull request #21 from atomic111/master
Browse files Browse the repository at this point in the history 
changed GIS to DTAG SEC
  • Loading branch information
@arlimus
arlimus committed Sep 14, 2014
2 parents 8b5dffd + deead00 commit 14ddcc9
Show file tree
Hide file tree
Showing 4 changed files with 46 additions and 46 deletions.
20 changes: 10 additions & 10 deletions default/serverspec/os_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,47 +21,47 @@
c.filter_run_excluding skipOn: backend(Serverspec::Commands::Base).check_os[:family]
end

# GIS: Req 3.21-4
# DTAG SEC: Req 3.21-4
describe command('find / -name \'.rhosts\' | wc -l ') do
its(:stdout) { should match(/^0/) }
end

# GIS: Req 3.21-4
# DTAG SEC: Req 3.21-4
describe command('find / -name \'hosts.equiv\' | wc -l ') do
its(:stdout) { should match(/^0/) }
end

# GIS: Req 3.21-7
# DTAG SEC: Req 3.21-7
describe file('/etc/shadow') do
it { should be_owned_by 'root' }
end

# GIS: Req 3.21-7
# DTAG SEC: Req 3.21-7
describe file('/etc/shadow') do
it { should be_mode 600 }
end

# GIS: Req 3.21-8
# DTAG SEC: Req 3.21-8
describe command('echo $PATH | grep -ci \'\.\'') do
its(:stdout) { should match(/^0/) }
end

# GIS: Req 3.21-8
# DTAG SEC: Req 3.21-8
describe file('/etc/login.defs') do
its(:content) { should match(%r{^ENV_SUPATH\s+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}) }
end

# GIS: Req 3.21-8
# DTAG SEC: Req 3.21-8
describe file('/etc/login.defs') do
its(:content) { should match(%r{^ENV_PATH\s+PATH=/usr/local/bin:/usr/bin:/bin}) }
end

# GIS: Req 3.21-10
# DTAG SEC: Req 3.21-10
describe file('/etc/login.defs') do
its(:content) { should match(/^UMASK +027/) }
end

# GIS: Req 3.21-12
# DTAG SEC: Req 3.21-12
describe 'SUID/ SGID blacklist check' do
it 'found no blacklisted suid/sgid' do
blacklist = [
Expand Down Expand Up @@ -97,7 +97,7 @@
end
end

# GIS: Req 3.21-16
# DTAG SEC: Req 3.21-16
describe 'Unique uid' do
it 'check for unique uids' do
actual = command('cat /etc/passwd | cut -d \':\' -f 3').stdout.split(/\r?\n/)
Expand Down
26 changes: 13 additions & 13 deletions default/serverspec/sysctl_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,27 +23,27 @@

describe 'IP V4 networking' do

# GIS: Req 3.21-1
# DTAG SEC: Req 3.21-1
context linux_kernel_parameter('net.ipv4.ip_forward') do
its(:value) { should eq 0 }
end

# GIS: Req 3.21-1
# DTAG SEC: Req 3.21-1
context linux_kernel_parameter('net.ipv4.conf.all.forwarding') do
its(:value) { should eq 0 }
end

# GIS: Req 3.21-3
# DTAG SEC: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.rp_filter') do
its(:value) { should eq 1 }
end

# GIS: Req 3.21-3 ; GIS: Req 3.37-10
# DTAG SEC: Req 3.21-3 ; DTAG SEC: Req 3.37-10
context linux_kernel_parameter('net.ipv4.conf.default.rp_filter') do
its(:value) { should eq 1 }
end

# GIS: Req 3.21-1
# DTAG SEC: Req 3.21-1
context linux_kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do
its(:value) { should eq 1 }
end
Expand All @@ -52,7 +52,7 @@
its(:value) { should eq 1 }
end

# GIS: Req 3.01-9
# DTAG SEC: Req 3.01-9
context linux_kernel_parameter('net.ipv4.icmp_ratelimit') do
its(:value) { should eq 100 }
end
Expand All @@ -65,12 +65,12 @@
its(:value) { should eq 0 }
end

# GIS: Req 3.21-3
# DTAG SEC: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.arp_ignore') do
its(:value) { should eq 1 }
end

# GIS: Req 3.21-3
# DTAG SEC: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.arp_announce') do
its(:value) { should eq 2 }
end
Expand All @@ -91,12 +91,12 @@
its(:value) { should eq 1 }
end

# GIS: Req 3.37-12
# DTAG SEC: Req 3.37-12
context linux_kernel_parameter('net.ipv4.conf.all.accept_source_route') do
its(:value) { should eq 0 }
end

# GIS: Req 3.37-12
# DTAG SEC: Req 3.37-12
context linux_kernel_parameter('net.ipv4.conf.default.accept_source_route') do
its(:value) { should eq 0 }
end
Expand Down Expand Up @@ -138,7 +138,7 @@
its(:value) { should eq 1 }
end

# GIS: Req 3.21-1
# DTAG SEC: Req 3.21-1
context linux_kernel_parameter('net.ipv6.conf.all.forwarding') do
its(:value) { should eq 0 }
end
Expand Down Expand Up @@ -202,7 +202,7 @@

describe 'ExecShield' do

# GIS: Req 3.21-5
# DTAG SEC: Req 3.21-5
# check if we find the nx flag
if command('cat /proc/cpuinfo').return_stdout?(/^flags.*?:.*? nx( .*?)?$/)
true
Expand All @@ -217,7 +217,7 @@
end
end

# GIS: Req 3.21-5
# DTAG SEC: Req 3.21-5
context linux_kernel_parameter('kernel.randomize_va_space') do
its(:value) { should eq 2 }
end
Expand Down
20 changes: 10 additions & 10 deletions lockdown/serverspec/os_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,47 +21,47 @@
c.filter_run_excluding skipOn: backend(Serverspec::Commands::Base).check_os[:family]
end

# GIS: Req 3.21-4
# DTAG SEC: Req 3.21-4
describe command('find / -name \'.rhosts\' | wc -l ') do
its(:stdout) { should match(/^0/) }
end

# GIS: Req 3.21-4
# DTAG SEC: Req 3.21-4
describe command('find / -name \'hosts.equiv\' | wc -l ') do
its(:stdout) { should match(/^0/) }
end

# GIS: Req 3.21-7
# DTAG SEC: Req 3.21-7
describe file('/etc/shadow') do
it { should be_owned_by 'root' }
end

# GIS: Req 3.21-7
# DTAG SEC: Req 3.21-7
describe file('/etc/shadow') do
it { should be_mode 600 }
end

# GIS: Req 3.21-8
# DTAG SEC: Req 3.21-8
describe command('echo $PATH | grep -ci \'\.\'') do
its(:stdout) { should match(/^0/) }
end

# GIS: Req 3.21-8
# DTAG SEC: Req 3.21-8
describe file('/etc/login.defs') do
its(:content) { should match(%r{^ENV_SUPATH\s+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin}) }
end

# GIS: Req 3.21-8
# DTAG SEC: Req 3.21-8
describe file('/etc/login.defs') do
its(:content) { should match(%r{^ENV_PATH\s+PATH=/usr/local/bin:/usr/bin:/bin}) }
end

# GIS: Req 3.21-10
# DTAG SEC: Req 3.21-10
describe file('/etc/login.defs') do
its(:content) { should match(/^UMASK +027/) }
end

# GIS: Req 3.21-12
# DTAG SEC: Req 3.21-12
describe 'SUID/ SGID whitelist check' do
it 'found only whitelist suid/sgid' do
whitelist = [
Expand Down Expand Up @@ -116,7 +116,7 @@
end
end

# GIS: Req 3.21-16
# DTAG SEC: Req 3.21-16
describe 'Unique uid' do
it 'check for unique uids' do
actual = command('cat /etc/passwd | cut -d \':\' -f 3').stdout.split(/\r?\n/)
Expand Down
26 changes: 13 additions & 13 deletions lockdown/serverspec/sysctl_spec.rb
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,27 +23,27 @@

describe 'IP V4 networking' do

# GIS: Req 3.21-1
# DTAG SEC: Req 3.21-1
context linux_kernel_parameter('net.ipv4.ip_forward') do
its(:value) { should eq 0 }
end

# GIS: Req 3.21-1
# DTAG SEC: Req 3.21-1
context linux_kernel_parameter('net.ipv4.conf.all.forwarding') do
its(:value) { should eq 0 }
end

# GIS: Req 3.21-3
# DTAG SEC: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.rp_filter') do
its(:value) { should eq 1 }
end

# GIS: Req 3.21-3 ; GIS: Req 3.37-10
# DTAG SEC: Req 3.21-3 ; DTAG SEC: Req 3.37-10
context linux_kernel_parameter('net.ipv4.conf.default.rp_filter') do
its(:value) { should eq 1 }
end

# GIS: Req 3.21-1
# DTAG SEC: Req 3.21-1
context linux_kernel_parameter('net.ipv4.icmp_echo_ignore_broadcasts') do
its(:value) { should eq 1 }
end
Expand All @@ -52,7 +52,7 @@
its(:value) { should eq 1 }
end

# GIS: Req 3.01-9
# DTAG SEC: Req 3.01-9
context linux_kernel_parameter('net.ipv4.icmp_ratelimit') do
its(:value) { should eq 100 }
end
Expand All @@ -65,12 +65,12 @@
its(:value) { should eq 0 }
end

# GIS: Req 3.21-3
# DTAG SEC: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.arp_ignore') do
its(:value) { should eq 1 }
end

# GIS: Req 3.21-3
# DTAG SEC: Req 3.21-3
context linux_kernel_parameter('net.ipv4.conf.all.arp_announce') do
its(:value) { should eq 2 }
end
Expand All @@ -91,12 +91,12 @@
its(:value) { should eq 1 }
end

# GIS: Req 3.37-12
# DTAG SEC: Req 3.37-12
context linux_kernel_parameter('net.ipv4.conf.all.accept_source_route') do
its(:value) { should eq 0 }
end

# GIS: Req 3.37-12
# DTAG SEC: Req 3.37-12
context linux_kernel_parameter('net.ipv4.conf.default.accept_source_route') do
its(:value) { should eq 0 }
end
Expand Down Expand Up @@ -138,7 +138,7 @@
its(:value) { should eq 1 }
end

# GIS: Req 3.21-1
# DTAG SEC: Req 3.21-1
context linux_kernel_parameter('net.ipv6.conf.all.forwarding') do
its(:value) { should eq 0 }
end
Expand Down Expand Up @@ -202,7 +202,7 @@

describe 'ExecShield' do

# GIS: Req 3.21-5
# DTAG SEC: Req 3.21-5
# check if we find the nx flag
if command('cat /proc/cpuinfo').return_stdout?(/^flags.*?:.*? nx( .*?)?$/)
true
Expand All @@ -217,7 +217,7 @@
end
end

# GIS: Req 3.21-5
# DTAG SEC: Req 3.21-5
context linux_kernel_parameter('kernel.randomize_va_space') do
its(:value) { should eq 2 }
end
Expand Down

0 comments on commit 14ddcc9

Please sign in to comment.