-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
refactor(pillar): add default pillars for each OS family
- Loading branch information
1 parent
d898f10
commit 7dd3e18
Showing
3 changed files
with
248 additions
and
73 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,38 +1,4 @@ | ||
| # -*- coding: utf-8 -*- | ||
| # vim: ft=yaml | ||
| --- | ||
| rkhunter: | ||
| default: | ||
| cron_daily_run: true | ||
| cron_db_update: true | ||
| db_update_email: false | ||
| report_email: root | ||
| apt_autogen: true | ||
| run_check_on_battery: false | ||
|
|
||
| config: | ||
| mail-on-warning: root | ||
| logfile: /var/log/rkhunter.log | ||
| allow_ssh_root_user: without-password | ||
| allow_ssh_prot_v1: 2 | ||
| tmpdir: /var/lib/rkhunter/tmp | ||
| dbdir: /var/lib/rkhunter/db | ||
| scriptdir: /usr/share/rkhunter/scripts | ||
| installdir: /usr | ||
| disable_unhide: 1 | ||
| auto_x_detect: 1 | ||
| enable_tests: all | ||
| disable_tests: | ||
| - suspscan | ||
| - hidden_procs | ||
| - deleted_files | ||
| - packet_cap_apps | ||
| - apps | ||
|
|
||
| scriptwhitelist: | ||
| - /bin/egrep | ||
| - /bin/fgrep | ||
| - /bin/which | ||
| - /usr/bin/groups | ||
| - /usr/bin/ldd | ||
| - /usr/sbin/adduser | ||
| rkhunter: {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,48 +1,93 @@ | ||
| control 'Rkhunter configuration' do | ||
| title 'should match desired lines' | ||
|
|
||
| describe file('/etc/rkhunter.conf') do | ||
| # Default config | ||
| its('content') { should include 'AUTO_X_DETECT=1' } | ||
| its('content') { should include 'DISABLE_UNHIDE=1' } | ||
| its('content') { should include 'DBDIR=/var/lib/rkhunter/db' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/bin/egrep' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/bin/fgrep' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/bin/which' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/usr/bin/groups' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/usr/bin/ldd' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/usr/sbin/adduser' } | ||
| its('content') { should include 'LOGFILE=/var/log/rkhunter.log' } | ||
| its('content') { should include 'INSTALLDIR=/usr' } | ||
| its('content') { should include 'ENABLE_TESTS=all' } | ||
| its('content') { should include 'TMPDIR=/var/lib/rkhunter/tmp' } | ||
| its('content') { should include 'SCRIPTDIR=/usr/share/rkhunter/scripts' } | ||
| its('content') { should include "DISABLE_TESTS='suspscan hidden_procs deleted_files packet_cap_apps apps'" } | ||
|
|
||
| # Custom config from pillar | ||
| its('content') { should include 'ALLOW_SSH_ROOT_USER=yes' } | ||
| def check_debian | ||
| describe file('/etc/default/rkhunter') do | ||
| # Default config | ||
| its('content') { should include 'APT_AUTOGEN="true"' } | ||
| its('content') { should include 'REPORT_EMAIL=root' } | ||
| its('content') { should include 'DB_UPDATE_EMAIL="false"' } | ||
| its('content') { should include 'CRON_DB_UPDATE="true"' } | ||
| its('content') { should include 'CRON_DAILY_RUN="true"' } | ||
|
|
||
| # Custom config from pillar | ||
| its('content') { should include 'RUN_CHECK_ON_BATTERY="true"' } | ||
| end | ||
|
|
||
| describe file('/etc/rkhunter.conf') do | ||
| # Default config | ||
| its('content') { should include 'AUTO_X_DETECT=1' } | ||
| its('content') { should include 'DISABLE_UNHIDE=1' } | ||
| its('content') { should include 'DBDIR=/var/lib/rkhunter/db' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/bin/egrep' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/bin/fgrep' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/bin/which' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/usr/bin/groups' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/usr/bin/ldd' } | ||
| its('content') { should include 'SCRIPTWHITELIST=/usr/sbin/adduser' } | ||
| its('content') { should include 'LOGFILE=/var/log/rkhunter.log' } | ||
| its('content') { should include 'INSTALLDIR=/usr' } | ||
| its('content') { should include 'ENABLE_TESTS=all' } | ||
| its('content') { should include 'TMPDIR=/var/lib/rkhunter/tmp' } | ||
| its('content') { should include 'SCRIPTDIR=/usr/share/rkhunter/scripts' } | ||
| its('content') { should include "DISABLE_TESTS='suspscan hidden_procs deleted_files packet_cap_apps apps'" } | ||
|
|
||
| # Custom config from pillar | ||
| its('content') { should include 'ALLOW_SSH_ROOT_USER=yes' } | ||
| end | ||
| end | ||
|
|
||
| # Override by OS | ||
| config = | ||
| case os[:name] | ||
| when 'debian' | ||
| '/etc/default/rkhunter' | ||
| when 'redhat', 'fedora', 'centos', 'opensuse' | ||
| '/etc/sysconfig/rkhunter' | ||
| else | ||
| '/etc/default/rkhunter' | ||
| def check_redhat | ||
| describe file('/etc/sysconfig/rkhunter') do | ||
| # Default config | ||
| its('content') { should include 'MAILTO=root@localhost' } | ||
| its('content') { should include 'DIAG_SCAN=no' } | ||
| end | ||
|
|
||
| describe file('/etc/rkhunter.conf') do | ||
| # Default config | ||
| its('content') { should include 'PKGMGR=RPM' } | ||
| its('content') { should include 'LOGFILE=/var/log/rkhunter/rkhunter.log' } | ||
| its('content') { should include 'INSTALLDIR=/usr' } | ||
| its('content') { should include 'ENABLE_TESTS=ALL' } | ||
| its('content') { should include 'TMPDIR=/var/lib/rkhunter' } | ||
| its('content') { should include 'SCRIPTDIR=/usr/share/rkhunter/scripts' } | ||
| its('content') { should include "DISABLE_TESTS='suspscan hidden_procs deleted_files packet_cap_apps apps ipc_shared_mem'" } | ||
| end | ||
| end | ||
|
|
||
| describe file(config) do | ||
| # Default config | ||
| its('content') { should include 'APT_AUTOGEN="true"' } | ||
| its('content') { should include 'REPORT_EMAIL=root' } | ||
| its('content') { should include 'DB_UPDATE_EMAIL="false"' } | ||
| its('content') { should include 'CRON_DB_UPDATE="true"' } | ||
| its('content') { should include 'CRON_DAILY_RUN="true"' } | ||
| def check_suse | ||
| describe file('/etc/sysconfig/rkhunter') do | ||
| # Default config | ||
| its('content') { should include "START_RKHUNTER=yes" } | ||
| its('content') { should include "RUN_SUSECONFIG=yes" } | ||
| its('content') { should include "CRON_DB_UPDATE=no" } | ||
| its('content') { should include "PRO_UPDATE=no" } | ||
| its('content') { should include "NICE=0" } | ||
| its('content') { should include "LOGFILE=/var/log/rkhunter.log" } | ||
| its('content') { should include "REPORT_EMAIL=root" } | ||
| its('content') { should include 'OPTIONS="--no-mail-on-warning --cronjob --report-warnings-only --append-log --pkgmgr RPM"' } | ||
| end | ||
|
|
||
| # Custom config from pillar | ||
| its('content') { should include 'RUN_CHECK_ON_BATTERY="true"' } | ||
| describe file('/etc/rkhunter.conf') do | ||
| # Default config | ||
| its('content') { should include 'PKGMGR=RPM' } | ||
| its('content') { should include 'LOGFILE=/var/log/rkhunter.log' } | ||
| its('content') { should include 'INSTALLDIR=/usr' } | ||
| its('content') { should include 'ENABLE_TESTS=ALL' } | ||
| its('content') { should include 'TMPDIR=/var/lib/rkhunter' } | ||
| its('content') { should include 'SCRIPTDIR=/usr/lib/rkhunter/scripts' } | ||
| its('content') { should include "DISABLE_TESTS='suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps'" } | ||
| end | ||
| end | ||
|
|
||
| # Override by OS | ||
| case os[:name] | ||
| when 'debian' | ||
| check_debian | ||
| when 'redhat', 'fedora', 'centos' | ||
| check_redhat | ||
| when 'suse' | ||
| check_suse | ||
| end | ||
| end |