{"id":19418,"date":"2023-08-23T09:23:52","date_gmt":"2023-08-23T13:23:52","guid":{"rendered":"https:\/\/qxf2.com\/blog\/?p=19418"},"modified":"2023-09-05T06:38:46","modified_gmt":"2023-09-05T10:38:46","slug":"auditing-os-level-resources-with-chef-inspec-beginners-guide","status":"publish","type":"post","link":"https:\/\/qxf2.com\/blog\/auditing-os-level-resources-with-chef-inspec-beginners-guide\/","title":{"rendered":"Auditing OS level resources with Chef InSpec"},"content":{"rendered":"

Many of Qxf2<\/a>‘s clients store their Infrastructure as Code. This means that new infrastructure is spun using code and then the application is deployed. So, as testers, we now have to verify that the right infrastructure was spun up and configured correctly. In this post, I will show you how to use Chef InSpec<\/a> – a tool to write tests for your infrastructure. It will help you catch annoying errors like misconfigurations, dead services, etc. <\/p>\n

1.Introduction<\/h3>\n

Chef InSpec is an open source framework tool used for testing and auditing applications and infrastructure. The tool:<\/p>\n

a) compares the actual state of the system with desired state
\nb) validates configurations and behaviour of your systems
\nc) identifies compliance and security violations
\nd) generates a detailed report for further analysis and action<\/p>\n

The good news is that Chef InSpec is easy to pick up. It offers a rich collection of ready-to-use resources, and also you can write custom code to extend it.<\/p>\n

2.Purpose of this post<\/h3>\n

The decision to write this post on the Chef InSpec tool, is to cater to testers who are eager to learn how to test infrastructure<\/a>, especially when it is stored as code. In a previous client project, I utilized Chef InSpec to test deployments by the TestOps team. However, my ability to delve deeply into test creation was limited at that time, due to limited access to resources. This limitation has motivated me to explore this tool further and to share my acquired knowledge. <\/p>\n

I will cover testing a server that has been setup with an application in this post. We do this with something called OS resources<\/a>. In a following post, I will delve into testing the configuration of AWS resources. These sequential discussions are primarily intended for beginners who possess an interest in familiarizing themselves with the Chef InSpec tool.<\/p>\n\n

3.Setup<\/h3>\n

Users can download<\/a> Chef InSpec from the official website and choose between Operating Systems of MacOS, Windows, and Linux.<\/p>\n

3.1 MacOS:<\/h6>\n

It is available as a standalone Homebrew package. Run the following command.<\/p>\n

brew install chef\/chef\/inspec<\/pre>\n
3.2 CLI:<\/h6>\n
You can download using curl script. Run the following command.<\/p>\n
curl https:\/\/omnitruck.chef.io\/install.sh | sudo bash -s -- -P inspec<\/pre>\n
3.3 Windows:<\/h6>\n
Download the latest package and click the .msi<\/strong> file to launch the installer and follow the prompts.<\/p>\n
3.4 Linux:<\/h6>\n
The following command used to install it on Ubuntu and Red Hat Enterprise Linux.<\/p>\n
curl https:\/\/omnitruck.chef.io\/install.sh | sudo bash -s -- -P inspec <\/pre>\n
\n
4.Keywords<\/h3>\n
In the next sections, you will encounter the following technical words: controls<\/em>, resource<\/em> and profiles<\/em>. Here is an inaccurate but useful mental-model for these words:<\/p>\n
a) resource: “infrastructure” we want our tests to interact with. Example: OS, AWS, GCP, Azure, etc.
\nb) controls: a directory where our tests go
\nc) profile: helps you organize and partition your tests at a higher level (example: one profile per app, or profile per service and so on)<\/p>\n
Additionally, each profile will be associated with a  inspec.yml<\/code> file that stores the meta-information about the profile.<\/p>\n
5.Profiles<\/h3>\n
Profiles play an important role in Chef InSpec as it encompasses a collection of controls, with each control representing individual tests targeting specific system aspects. The Chef InSpec profile maintains a standalone structure that necessitates the inclusion of both the inspec.yml<\/code> a metadata file and the controls folder<\/code>. Both are mandatory.
\n-The inspec.yml<\/code> metadata file gives information about the profile. While only the Name field is mandatory, all other profile settings are optional. It is possible to specify the targeted platform (example: Ubuntu) for running tests within this file. Additionally, one can list all the dependencies required for the tests. The path from which the profile is accessible can also be defined; this could be a local path, a URL (HTTP\/HTTPS), or a Git repository.
\n-The Controls folder is where you store all your tests. By default, it contains a sample test file created during the profile creation. To initiate the creation of a new profile, execute the command below.<\/p>\n
Command to create standard profile:<\/h6>\n
inspec init profile test_profile\r\n<\/pre>\n
 This command will create a new profile named test_profile<\/strong> with default structure.<\/p>\n
Command to verify the profile creation:<\/h6>\n
inspec check [profile_name] \r\n<\/pre>\n
 When run against profile, it will pop up errors, warnings if any<\/p>\n
\n
6.Test to verify OS resources<\/h3>\n
The following section describes the syntax and shows some simple examples of using Chef InSpec’s OS resources. It would be nice if you could follow along and practice against some server that you work with. The Chef InSpec language is Ruby DSL(domain-specific languages) for writing audit controls, which includes audit resources. As testers we need to write tests for Infrastructure as Code.<\/p>\n
6.1 File resource:<\/h5>\n
We sometimes want to make sure that certain files exist (or do not exist) after a deploy. Using File<\/code> Chef InSpec auditing resource to test system file types including directories, symbolic links.
\nExample: Test if a configuration file exists and has specific permissions.<\/p>\n
describe file('\/etc\/hosts') do\r\n  it { should exist }\r\n  it { should be_readable.by('owner') }\r\nend\r\n<\/pre>\n
I will try to explain the code using Chef InSpec glossary<\/a>.
\nEach line within the resource block begins with “it”<\/strong> and is used to access resource-specific matchers like { should exist }<\/code> . Matcher { should be_readable }<\/code> tests if the existing file is readable. The Matchers perform the actual assertion against resource or the properties of the resource.<\/p>\n\n
6.2 Package resource:<\/h5>\n
Package resource holds significance to confirm the installation of specific packages and validate their corresponding versions. This task can be accomplished through the utilization of the package<\/code> auditing resource.
\nExample: Test the package ‘nginx’ is installed and its version using the package<\/code> resource.<\/p>\n
describe apt('nginx') do\r\n  it { should be_installed }\r\n  its('version') { should eq '1.9.5' }\r\nend\r\n<\/pre>\n\n
6.3 Docker container resource:<\/h5>\n
Testing of the existence and operational state of a deployed Docker image is vital. docker_container<\/code> auditing resource can be used to validate this.
\nExample: Test if a specific docker container is running.<\/p>\n
describe docker_container('myapp') do\r\n  it { should exist }\r\n  it { should be_running }\r\nend\r\n<\/pre>\n\n
6.4 HTTP resource:<\/h5>\n
http<\/code> auditing resource can be used to perform a health check before commencing testing of the web application.
\nExample:Test if specific domain is accessible and returns a specific status code.<\/p>\n
describe http('http:\/\/example.com') do\r\n  its('status') { should cmp 200 }\r\nend\r\n<\/pre>\n
A universal matcher is a matcher that can be used on the properties of a resource. Universal matchers are always used with the “its” keyword. In this example used against a property of a resource. “cmp” matcher is used to check the value of the properties.<\/p>\n
\n
6.5 Nginx resource:<\/h5>\n
Nginx, an open-source web server software, is commonly utilized for hosting applications. Validating the availability of Nginx is significant. This can be achieved by using nginx<\/code> auditing resource.
\nExample: Test Nginx service is running and enabled.<\/code><\/code><\/p>\n
describe service('nginx') do\r\n  it { should be_enabled }\r\n  it { should be_running }\r\nend\r\n<\/pre>\n
\n
6.6 Passwd resource:<\/h5>\n
Using the passwd<\/code> auditing resource allows you to test the contents of the ‘\/etc\/passwd’<\/strong> file.
\nExample: test if \u2018root\u2019 and \u2018www-data\u2019 users exist and count is  equal to one.<\/p>\n
describe passwd.uids(0) do\r\n    its('users') { should cmp 'root' }\r\n    its('count') { should eq 1 }\r\nend\r\ndescribe passwd.where { user == 'www-data' } do\r\n    its('uids') { should cmp 33 }\r\n    its('count') { should eq 1 }\r\nend\r\n<\/pre>\n
\n
6.7 Service resource:<\/h5>\n
When testing Infrastructure, it is essential to assess the status of the services. The service auditing resource serves this purpose by enabling the testing of specific services for installation, running status, and activation. In few cases, to verify specific service manager by using one of the service manager specific resources like “systemd_resource”, “launchd_service”.
\nExample: test if mysql systemd service and prometheus launchd service are installed, enabled and in running status.<\/p>\n
describe systemd_service('MYSQL') do\r\n    it { should_not be_enabled }\r\n    it { should_not be_installed }\r\n    it { should_not be_running }\r\nend\r\ndescribe launchd_service('prometheus') do\r\n    it { should_not be_enabled }\r\n    it { should_not be_installed }\r\n    it { should_not be_running }\r\nend\r\n<\/pre>\n
\n
Command to execute Chef InSpec test:<\/h6>\n
\r\ninspec exec  [profile_name]\r\n<\/pre>\n
Sample run of service resource test:<\/h6>\n
\"Chef<\/p>\n
\n
To wrap up this post, Chef InSpec is a good tool to test compliance and security of the infrastructure. I like it\u2019s user-friendly syntax. It not only lets us use predefined resources out of the box. But it also allows us to customize the resources and extend them. My intention is to inspire each one of you to take into the world of testing infrastructure using Chef Inspec. Let’s have more secure, reliable, and compliant infrastructure with Chef InSpec!<\/p>\n
\n
Hire technical testers from Qxf2<\/h3>\n
Hire Qxf2<\/a> testers for testing your infrastructure. Our testers possess deep technical expertise and practical experience in testing modern technical stacks. Gain access to skilled testers who can navigate the intricacies of Infrastructure as Code by partnering with Qxf2.<\/p>\n
\n
References:<\/h3>\n
https:\/\/docs.chef.io\/inspec\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Many of Qxf2‘s clients store their Infrastructure as Code. This means that new infrastructure is spun using code and then the application is deployed. So, as testers, we now have to verify that the right infrastructure was spun up and configured correctly. In this post, I will show you how to use Chef InSpec – a tool to write tests […]<\/p>\n","protected":false},"author":37,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[367,380,316],"tags":[],"class_list":["post-19418","post","type-post","status-publish","format-standard","hentry","category-chef-inspec","category-iac","category-infrastructure"],"_links":{"self":[{"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/posts\/19418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/users\/37"}],"replies":[{"embeddable":true,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/comments?post=19418"}],"version-history":[{"count":123,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/posts\/19418\/revisions"}],"predecessor-version":[{"id":20048,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/posts\/19418\/revisions\/20048"}],"wp:attachment":[{"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/media?parent=19418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/categories?post=19418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qxf2.com\/blog\/wp-json\/wp\/v2\/tags?post=19418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}