Linuxセキュリティ設定テスト

spec/server-01/security_spec.rb

require 'spec_helper'

describe selinux do
  it { should be_enforcing }
end

describe command('getsebool httpd_can_network_connect') do
  it { should return_stdout /on$/ }
end

### ポイント: 複数繰り返し処理する際のパラメータ定義 ###
accept_ports = [{:protocol => 'tcp', :port => 22 },
                {:protocol => 'tcp', :port => 80},
                {:protocol => 'tcp', :port => 10051}]

accept_ports.each do |p|  # ポイント: 同じ処理をループ処理化
  describe iptables do
    it { should have_rule("-A INPUT -p #{p[:protocol]} -m state --state NEW -m #{p[:protocol]} --dport #{p[:port]} -j ACCEPT") }
  end
end

spec/server-01/dns_spec.rb

require 'spec_helper'

dns_server = 'dns-server01'

### ポイント: 名前解決に関する設定の確認 ###
describe file('/etc/resolv.conf') do
  its(:content) { should match /^nameserver #{dns_server}/ }
end

describe file('/etc/nsswitch.conf') do
  its(:content) { should match /^hosts:\s*files\s+dns/ }
end

### ポイント: 本当に名前解決できるかの確認 ###
describe host('server-01') do
  it { should be_resolvable }
end

spec/server-01/httpd_spec.rb

require 'spec_helper'

### ポイント: OSの種類毎に異なる処理の分岐 ###

if os[:family] == 'RedHat'
  describe package('httpd') do
    it { should be_installed }
  end
  describe service('httpd') do
    it { should be_enabled   }
    it { should be_running   }
  end
  describe file('/etc/httpd/conf/httpd.conf') do
    it { should be_file }
    its(:content) { should match /Include conf.d\/\*\.conf/ }
  end
  describe file('/etc/httpd/conf.d/zabbix.conf') do
    it { should be_file }
    its(:content) { should match /Alias \/zabbix \/usr\/share\/zabbix/ }
  end
elsif ['Debian', 'Ubuntu'].include?(os[:family])
  describe package('apache2') do
    it { should be_installed }
  end
  describe service('apache2') do
    it { should be_enabled   }
    it { should be_running   }
  end
  describe file('/etc/apache2/apache2.conf') do
    it { should be_file }
    its(:content) { should match /IncludeOptional conf-enabled \/\*\.conf/ }
  end
  describe file('/etc/apache2/conf-enabled/zabbix.conf') do
    it { should be_linked_to '/etc/apache2/conf-available/zabbix.conf' }
    its(:content) { should match /Alias \/zabbix \/usr\/share\/zabbix/ }
  end
end





describe port(80) do
  it { should be_listening }
end

describe command('apachectl -M |grep php5_module') do
  it { should return_stdout /php5_module/ }
end