1import{_ as t}from"./Heimdall_Results.b076ab5d.js";import{_ as i}from"./plugin-vue_export-helper.21dcd24c.js";import{r as o,o as r,c as l,a as s,e as p,F as c,f as n,b as a}from"./app.1ce12e96.js";var u="/assets/InSpec_Failure.c928ee7f.png",d="/assets/InSpec_Pass.42e20864.png",k="/assets/InSpec_Multiple_Controls.3aea2483.png";const v={},m=n('<h2 id="starting-the-journey" tabindex="-1"><a class="header-anchor" href="#starting-the-journey" aria-hidden="true">#</a> Starting the Journey</h2><h3 id="inspec-profiles" tabindex="-1"><a class="header-anchor" href="#inspec-profiles" aria-hidden="true">#</a> InSpec Profiles</h3><p>InSpec organizes its code into what we call <code>profiles</code>. A <code>profile</code> is a set of automated tests that usually relates directly back to a Security Requirements Benchmark -- such as a CIS Benchmark or a Defense Information Security Agency (DISA) Security Technical Implementation Guide (STIGs) - and provides an organized structure to articulate that set of requirements and tests in code.</p><p>
1Profiles have two (2) required elements:</p><ul><li>An <code>inspec.yml</code> file</li><li>A <code>controls</code> directory</li></ul><p>and four (4) optional elements:</p><ul><li>A <code>libraries</code> directory</li><li>A <code>files</code> directory</li><li>An <code>inputs.yml</code> file</li><li>A <code>README.md</code> file</li></ul>',7),h=a("You can learn all the details here: "),g={href:"https://docs.chef.io/inspec/profiles/",target:"_blank",rel:"noopener noreferrer"},b=a("https://docs.chef.io/inspec/profiles/"),f=n(`<p>We will be going over each of these durning our class.</p><h3 id="inspec-profile-structure" tabindex="-1"><a class="header-anchor" href="#inspec-profile-structure" aria-hidden="true">#</a> InSpec Profile Structure</h3><div class="language-bash ext-sh line-numbers-mode"><pre class="language-bash"><code>$ tree nginx 2 nginx 3 \u2514\u2500\u2500 profile 4 \u251C\u2500\u2500 README.md 5 \u251C\u2500\u2500 inputs.yml 6 \u251C\u2500\u2500 controls 7 \u2502 \u251C\u2500\u2500 V-2230.rb 8 \u2502 \u2514\u2500\u2500 V-2232.rb 9 \u251C\u2500\u2500 files 10 \u2502 \u2514\u2500\u2500 services-and-ports.yml 11 \u251C\u2500\u2500 inspec.yml 12 \u2514\u2500\u2500 libraries 13 \u2514\u2500\u2500 nginx_helper.rb 14</code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><hr><h3 id="inspec-controls-structure" tabindex="-1"><a class="header-anchor" href="#inspec-controls-structure" aria-hidden="true">#</a> InSpec Controls Structure</h3><div class="language-ruby ext-rb line-numbers-mode"><pre class="language-ruby"><code>control <span class="token string-literal"><span class="token string">"V-13727"</span></span> <span class="token keyword">do</span> 15 title <span class="token string-literal"><span class="token string">"The worker_processes StartServers directive must be set properly."</span></span> 16 17 desc "These requirements are set to mitigate the effects of several types of 18 denial of service attacks<span class="token punctuation">.</span> Although there is some latitude concerning the 19 settings themselves<span class="token punctuation">,</span> the requirements attempt to provide reasonable limits 20 <span class="token keyword">for</span> the protection of the web server<span class="token punctuation">.</span> If necessary<span class="token punctuation">,</span> these limits can be 21 adjusted to accommodate the operational requirement of a given system<span class="token punctuation">.</span>" 22 23 impact <span class="token number">0.5</span> 24 tag <span class="token string-literal"><span class="token string">"severity"</span></span><span class="token operator">:</span> <span class="token string-literal"><span class="token string">"medium"</span></span> 25 tag <span class="token string-literal"><span class="token string">"gtitle"</span></span><span class="token operator">:</span> <span class="token string-literal"><span class="token string">"WA000-WWA026"</span></span> 26 tag <span class="token string-literal"><span class="token string">"gid"</span></span><span class="token operator">:</span> <span class="token string-literal"><span class="token string">"V-13727"</span></span> 27 tag <span class="token string-literal"><span class="token string">"rid"</span></span><span class="token operator">:</span> <span class="token string-literal"><span class="token string">"SV-36645r2_rule"</span></span> 28 tag <span class="token string-literal"><span class="token string">"stig_id"</span></span><span class="token operator">:</span> <span class="token string-literal"><span class="token string">"WA000-WWA026 A22"</span></span> 29 tag <span class="token string-literal"><span class="token string">"nist"</span></span><span class="token operator">:</span> <span class="token punctuation">[</span><span class="token string-literal"><span class="token string">"CM-6"</span></span><span class="token punctuation">,</span> <span class="token string-literal"><span class="token string">"Rev_4"</span></span><span class="token punctuation">]</span> 30 31 tag <span class="token string-literal"><span class="token string">"check"</span></span><span class="token operator">:</span> "To view the worker_processes directive value enter the 32 following command<span class="token operator">:</span> 33 grep <span class="token string-literal"><span class="token string">""</span></span>worker_processes<span class="token string-literal"><span class="token string">""</span></span> on the nginx<span class="token punctuation">.</span>conf file <span class="token keyword">and</span> any separate included 34 configuration files 35 If the value of <span class="token string-literal"><span class="token string">""</span></span>worker_processes<span class="token string-literal"><span class="token string">""</span></span> is <span class="token keyword">not</span> set to auto <span class="token keyword">or</span> explicitly set<span class="token punctuation">,</span> 36 this is a finding<span class="token operator">:</span> 37 worker_processes auto<span class="token punctuation">;</span> 38 worker_processes defines the number of worker processes<span class="token punctuation">.</span> The optimal value
39 depends on many factors including <span class="token punctuation">(</span>but <span class="token keyword">not</span> limited to<span class="token punctuation">)</span> the number of <span class="token constant">CPU</span> 40 cores<span class="token punctuation">,</span> the number of hard disk drives that store data<span class="token punctuation">,</span> <span class="token keyword">and</span> load pattern<span class="token punctuation">.</span> When 41 one is <span class="token keyword">in</span> doubt<span class="token punctuation">,</span> setting it to the number of available <span class="token constant">CPU</span> cores would be a 42 good start <span class="token punctuation">(</span>the value \u201Cauto\u201D will try to autodetect it<span class="token punctuation">)</span><span class="token punctuation">.</span>" 43 44 tag <span class="token string-literal"><span class="token string">"fix"</span></span><span class="token operator">:</span> "Edit the configuration file <span class="token keyword">and</span> set the value of 45 <span class="token string-literal"><span class="token string">""</span></span>worker_processes<span class="token string-literal"><span class="token string">""</span></span> to the value of auto <span class="token keyword">or</span> a value of <span class="token number">1</span> <span class="token keyword">or</span> higher<span class="token operator">:</span> 46 worker_processes auto<span class="token punctuation">;</span>" 47 48 describe nginx_conf<span class="token punctuation">(</span><span class="token constant">NGINX_CONF_FILE</span><span class="token punctuation">)</span><span class="token punctuation">.</span>params<span class="token punctuation">[</span><span class="token string-literal"><span class="token string">'worker_processes'</span></span><span class="token punctuation">]</span> <span class="token keyword">do</span> 49 it <span class="token punctuation">{</span> should cmp <span class="token punctuation">[</span><span class="token punctuation">[</span><span class="token string-literal"><span class="token string">'auto'</span></span><span class="token punctuation">]</span><span class="token punctuation">]</span> <span class="token punctuation">}</span> 50 <span class="token keyword">end</span> 51<span class="token keyword">end</span> 52</code></pre><div class="line-numbers" aria-hidden="true"><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div><div class="line-number"></div></div></div><h3 id="inspec-results" tabindex="-1"><a class="header-anchor" href="#inspec-results" aria-hidden="true">#</a> InSpec Results</h3><h4 id="failure" tabindex="-1"><a class="header-anchor" href="#failure" aria-hidden="true">#</a> Failure</h4><p><img src="`+u+'" alt="Alt text" loading="lazy"></p><h4 id="pass" tabindex="-1"><a class="header-anchor" href="#pass" aria-hidden="true">#</a> Pass</h4><p><img src="'+d+'" alt="Alt text" loading="lazy"></p><h4 id="multiple-controls" tabindex="-1">
52<a class="header-anchor" href="#multiple-controls" aria-hidden="true">#</a> Multiple Controls</h4><p><img src="'+k+'" alt="Alt text" loading="lazy"></p><h3 id="tooling-and-reporting" tabindex="-1"><a class="header-anchor" href="#tooling-and-reporting" aria-hidden="true">#</a> Tooling and Reporting</h3><p><img src="'+t+'" alt="Alt text" loading="lazy"></p>',15);function q(_,y){const e=o("ExternalLinkIcon");return r(),l(c,null,[m,s("p",null,[h,s("a",g,[b,p(e)])]),f],64)}var S=i(v,[["render",q],["__file","02.html.vue"]]);export{S as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.