Initial commit

The repository link below also contains the working files for the

Learning Chef for Linux and macOS video training course:

https://github.com/learningchef/learningchef-video

There’s also a vagrant box for the capstone project here:

https://atlas.hashicorp.com/learningchef/boxes/ubuntu1604-desktop

The files are grouped by chapter and each chapter contains a

`*_commands.md` file contains a history of the command line entries

used in each section.

Chapter 10 Commands - Learning Chef for Linux and macOS

-------------------------------------------------------

1001 Why automate validation?

=============================

http://inspec.io

1002 Scanning a docker node with a hardening profile

====================================================

https://github.com/dev-sec

cd ~

docker run --name mycentos73 --detch --tty --interactive centos:7.3.1611 /bin/bash

git clone https://github.com/dev-sec/linux-baseline.git

ls linux-baseline

inspec exec linux-baseline --target docker://mycentos73

cd linux-baseline

atom .

docker stop mycentos73

docker rm mycentos73

1003 Scanning a node with a hardening profile via ssh

=====================================================

# spin up node on digital ocean

inspec help exec

cd ~

inspec exec linux-baseline -t ssh://root@<ip_addr> --key-files ~/.ssh/id_rsa

# remember to delete your digital ocean node

1004 Scanning a local machine with inspec

=========================================

ssh root@<linux_machine>

git --version

yum install git

cat /etc/redhat-release

git clone https://github.com/dev-sec/linux-baseline.git

curl -LO https://packages.chef.io/files/stable/chefdk/1.1.16/el/7/chefdk-1.1.16-1.el7.x86_64.rpm

yum install chefdk-1.1.16-1.el7.x86_64.rpm

inspec exec linux-baseline

1005 Formatting modes

=====================

inspec help exec

inspec exec linux-baseline --format=cli

inspec exec linux-baseline --format=progress

inspec exec linux-baseline --format=documentation

inspec exec linux-baseline --format=json

inspec exec linux-baseline --format=json-min

inspec exec linux-baseline --format=junit

# Controls

https://github.com/dev-sec/linux-baseline/blob/master/control/sysctl_spec.rb

1006 control resource

=====================

https://www.cisecurity.org

https://github.com/dev-sec/linux-baseline/blob/master/controls/os_spec.rb

1007 Audit resources

====================

inspec shell

> help file

> help service

quit

1008 Its form

=============

# No commands

1009 Wrapping Up

================

# No commands

Chapter 11 Commands - Learning Chef for Linux and macOS

-------------------------------------------------------

1101 Why translate compliance policy into code?

===============================================

# No commands

1102 Your first compliance profile

==================================

# No commands

1103 Creating the initial structure and metadata

================================================

# NOTE: Can generate new profile with:

# inspec init profile chef_workstation

cd ~

mkdir chef_workstation

cd chef_workstation

atom .

cd ..

inspec exec chef_workstation

1104 Make tests fail as you are writing them

============================================

inspec shell

> help file

quit

inspec exec chef_workstation

docker run --name mycentos73 --detch --tty --interactive centos:7.3.1611 /bin/bash

inspec exec chef_workstation --target docker://mycentos73

docker stop mycentos73

docker rm mycentos73

1105 Introducing match

======================

chef --version

inspec exec chef_workstation --format=progress

1106 Variable regular expressions

=================================

chef --version

# http://rubular.com

/\d+\.\d+\.\d+/

1107 Adding ruby code to a control

==================================

inspec exec chef_workstation

# Programming Ruby

https://pragprog.com/book/ruby4/programming-ruby-1-9-2-0

http://ruby-doc.com/docs/ProgrammingRuby/

1108 Packaging ruby code in a custom matcher

============================================

# Practical Object-Oriented Design in Ruby

http://www.poodr.com/

inspec exec chef_workstation

1109 Wrapping Up

================

# No commands

# chef_workstation

This Compliance Profile ensures that a workstation

has the minimum required configuration necessary

for Chef Development

control 'ChefDK is installed' do

  describe file('/opt/chefdk/bin/chef') do

    it { should exist }

  end

  describe command('/opt/chefdk/bin/chef --version') do

    its('stdout') { should match(/Chef Development Kit Version: /) }

  end

end

control 'ChefDK is at least 1.1.16' do

  describe(chefdk_version) do

    its('major_version') { should be >= 1 }

    its('minor_version') { should be >= 1 }

    its('patch_version') { should be >= 16 }

  end

end