I need to do a specific check but only if it relates to a specific host so only_if would seem favourite. My frustration is that I cannot get the comparison working.
control ‘SEG_15.05.10’ do
title ‘SEG_15.05.10 - test1’
impact 0.5
desc ‘test1’
HostName = command(‘uname -n’).stdout.split
only_if { HostName cmp ‘Daves-MacBook-Pro.local’ }
describe file(’/etc/hosts’) do
it { should exist }
end
end
should do the trick. The cmp matcher is not available inside only if methods, since its just available inside of describe blocks. In this case we need to rely on pure ruby comparison.
↺ SEG_15.05.10: SEG_15.05.10 - test1
↺ Skipped control due to only_if condition.
Profile Summary: 0 successful controls, 0 control failures, 1 control skipped
Test Summary: 0 successful, 0 failures, 1 skipped
Daves-MacBook-Pro:InSpec dave$ inspec shell
Welcome to the interactive InSpec Shell
To find out how to use it, type: help
I made an error in my initial example, the following is working now:
control 'SEG_15.05.10' do
title 'SEG_15.05.10 - test1'
impact 0.5
desc 'test1'
HostName = command('uname -n').stdout.strip
describe file('/etc/hosts') do
it { should exist }
end
only_if {
HostName == 'Daves-MacBook-Pro.local'
}
end
command(‘uname -n’).stdout.split returns an array, therefore HostName == ‘Daves-MacBook-Pro.local’ is never true. strip removes the whitespace (in this case the newline). I recommend to keep the hostname extraction where it is required. In this case the only_if block is the best.
control 'SEG_15.05.10' do
title 'SEG_15.05.10 - test1'
impact 0.5
desc 'test1'
describe file('/etc/hosts') do
it { should exist }
end
only_if {
HostName = command('uname -n').stdout.strip
HostName == 'Daves-MacBook-Pro.local'
}
end
If you need some debug outputs, you can easily output variables during execution with puts
control 'SEG_15.05.10' do
title 'SEG_15.05.10 - test1'
impact 0.5
desc 'test1'
describe file('/etc/hosts') do
it { should exist }
end
only_if {
HostName = command('uname -n').stdout.strip
puts HostName
HostName == 'Daves-MacBook-Pro.local'
}
end
control 'SEG_15.05.10' do
title 'SEG_15.05.10 - test1'
impact 0.5
desc 'test1'
describe file('/etc/hosts') do
it { should exist }
end
only_if {
sys_info.hostname == 'Daves-MacBook-Pro.local'
}
end
ok - I must be doing something bizarre with this - here’s what I am doing - based on the above but with all the right commands in, I note the sys_info stuff but I can’t use it as this box is Solaris and sys_info is not supported.
BoKSMaster = 'sol-boksp1'
control 'SEG_15.03.05' do
title 'SEG_15.03.05 - Password must meet complexity requirements'
impact 0.5
desc 'Enforce at least on lowercase character'
describe command('/opt/boksm/sbin/keonadm -S pswadm charclass') do
its('stdout') { should match /LOWER=1/ }
end
only_if {
HostName = command('uname -n').stdout.split
puts BoKSMaster
puts HostName
HostName == BoKSMaster
}
end
When I run this I get the following (I’ve added puts to show the variables)
control ‘SEG_15.03.01’ do
title ‘SEG_15.03.01 - Define minimum password length (8)’
impact 0.5
desc ‘The use of blank passwords not allowed, requiring at least 8 characters’
describe login_defs do
its(‘PASS_MIN_LEN’) { should eq ‘8’ }
end
end
control ‘SEG_15.03.02’ do
title ‘SEG_15.03.02 - Maximum Password Age’
impact 0.5
desc ‘Maximum Password Age’
describe command(’/opt/boksm/sbin/bksdef’) do
its(‘stdout’) { should match /^Password term of validity.*90/ }
end
only_if { HostName == BoKSMaster }
end
control ‘SEG_15.03.05’ do title 'SEG_15.03.05 - Password must meet complexity requirements’ impact 0.5 desc 'Enforce at least on lowercase character’
describe command(’/opt/boksm/sbin/keonadm -S pswadm charclass’) do its(‘stdout’) { should match /LOWER=1/ } end only_if { HostName == BoKSMaster } end