Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

migrate to inspec profile #17

Merged
merged 12 commits into from
Jun 17, 2016
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions .travis.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,10 @@
---
language: ruby
cache: bundler
rvm:
- 1.9.3
- 2.0.0
language: ruby
script: bundle exec rake run_all_linters
- 2.0
- 2.2

bundler_args: --without integration
script: bundle exec rake
14 changes: 12 additions & 2 deletions Gemfile
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,17 @@

source 'https://rubygems.org'

# pin dependency for Ruby 1.9.3 since bundler is not
# detecting that net-ssh 3 does not work with 1.9.3
if Gem::Version.new(RUBY_VERSION) <= Gem::Version.new('1.9.3')
gem 'net-ssh', '~> 2.9'
end

gem 'rake'
gem 'serverspec', '~> 2.3.0'
gem 'rubocop', '~> 0.23'
gem 'inspec', '~> 0'
gem 'rubocop', '~> 0.36.0'
gem 'highline', '~> 1.6.0'

group :tools do
gem 'github_changelog_generator', '~> 1.12.0'
end
48 changes: 25 additions & 23 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,43 +1,45 @@
tests-apache-hardening
=====================

This are the integration tests for the projects
[![Build Status](http://img.shields.io/travis/dev-sec/tests-apache-hardening.svg)][1]

- https://github.com/hardening-io/puppet-apache-hardening
- https://github.com/hardening-io/chef-apache-hardening
This Compliance Profile ensures, that all hardening projects keep the same quality.

they start at `integration` level

you can use the gem `kitchen-sharedtests`

- https://github.com/ehaselwanter/kitchen-sharedtests/

to make them available to your project. Use `thor kitchen:fetch-remote-tests` to put the repo into `test/integration`
- https://github.com/dev-sec/puppet-apache-hardening
- https://github.com/dev-sec/chef-apache-hardening

## Standalone Usage

you can target the integration tests to any host were you have ssh access

rake -T gives you a list of suites you can run (well ignore directories which are obviously not suites for now)
This Compliance Profile requires [InSpec](https://github.com/chef/inspec) for execution:

```
± rake -T
rake serverspec:default # Run serverspec suite default
$ git clone https://github.com/dev-sec/tests-apache-hardening
$ inspec exec tests-apache-hardening
```

run it with:
You can also execute the profile directly from Github:

```
bundle install
$ inspec exec https://github.com/dev-sec/tests-apache-hardening
```

# default user and ssh-key
* Author:: Patrick Muench <patrick.muench1111@googlemail.com>
* Author:: Dominik Richter <dominik.richter@googlemail.com>
* Author:: Christoph Hartmann <chris@lollyrock.com>

bundle exec rake serverspec:default target_host=<name-or-ip-of-target-server>
* Copyright 2014-2016, The Hardening Framework Team

# or with user, host, password
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

ASK_LOGIN_PASSWORD=true bundle exec rake serverspec:default target_host=192.168.1.222 user=stack
```
http://www.apache.org/licenses/LICENSE-2.0

add `format=html|json` to get a report.html or report.json document
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

[1]: http://travis-ci.org/dev-sec/tests-apache-hardening
[2]: https://gitter.im/dev-sec/general
51 changes: 22 additions & 29 deletions Rakefile
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#!/usr/bin/env rake
# encoding: utf-8

require 'rake'
require 'rspec/core/rake_task'
require 'rake/testtask'
require 'rubocop/rake_task'

# Rubocop
Expand All @@ -10,37 +10,30 @@ task :rubocop do
RuboCop::RakeTask.new
end

# Lint the cookbook
desc 'Run linters'
task :run_all_linters => [:rubocop] # rubocop:disable Style/HashSyntax
task :default => :run_all_linters # rubocop:disable Style/HashSyntax
# lint the project
desc 'Run robocop linter'
task lint: [:rubocop]

# Serverspec tests
suites = Dir.glob('*').select { |entry| File.directory?(entry) }
# run tests
task default: [:lint, 'test:check']

class ServerspecTask < RSpec::Core::RakeTask
attr_accessor :target

def spec_command
if target.nil?
puts 'specify either env TARGET_HOST or target_host='
exit 1
end

cmd = super
"env TARGET_HOST=#{target} STANDALONE_SPEC=true #{cmd} --format documentation --no-profile"
namespace :test do
# run inspec check to verify that the profile is properly configured
task :check do
dir = File.join(File.dirname(__FILE__))
sh("bundle exec inspec check #{dir}")
end
end

namespace :serverspec do
suites.each do |suite|
desc "Run serverspec suite #{suite}"
ServerspecTask.new(suite.to_sym) do |t|
t.rspec_opts = '--no-color --format html --out report.html' if ENV['format'] == 'html'
t.rspec_opts = '--no-color --format json --out report.json' if ENV['format'] == 'json'
t.target = ENV['TARGET_HOST'] || ENV['target_host']
t.ruby_opts = "-I #{suite}/serverspec"
t.pattern = "#{suite}/serverspec/*_spec.rb"
end
# Automatically generate a changelog for this project. Only loaded if
# the necessary gem is installed.
# use `rake changelog to=1.2.0`
begin
v = ENV['to']
require 'github_changelog_generator/task'
GitHubChangelogGenerator::RakeTask.new :changelog do |config|
config.future_release = v
end
rescue LoadError
puts '>>>>> GitHub Changelog Generator not loaded, omitting tasks'
end
Loading