Skip to content

Commit 25cf7e2

Browse files
obscurerichardobscurerichard
authored
Merge pull request #52 from ModusCreateOrg/gauntlt_packer_bash_fn_refactor
Put in root checks, refactor functions
2 parents c398e58 + 1aca1db commit 25cf7e2

File tree

22 files changed

+412
-130
lines changed

22 files changed

+412
-130
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
/terraform/tf.plan
1212
__pycache__
1313
build/
14+
tmp/
1415
jmeter.log
1516
scan-xccdf-results.html
1617
scan-xccdf-results.xml

‎Jenkinsfile‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -165,24 +165,27 @@ if (params.Run_Packer) {
165165
node {
166166
wrap.call({
167167
unstash 'src'
168-
sh ("./bin/pack.sh")
169-
archive (includes: 'build/**')
170-
publishHTML (target: [
171-
allowMissing: true,
172-
alwaysLinkToLastBuild: false,
173-
keepAll: true,
174-
reportDir: 'build',
175-
reportFiles: 'scan-xccdf-results.html',
176-
reportName: "OpenSCAP Report"
177-
])
178-
publishHTML (target: [
179-
allowMissing: true,
180-
alwaysLinkToLastBuild: false,
181-
keepAll: true,
182-
reportDir: 'build',
183-
reportFiles: 'gauntlt-results.txt',
184-
reportName: "Gauntlt Report"
185-
])
168+
try {
169+
sh ("./bin/pack.sh")
170+
} finally {
171+
archiveArtifacts artifacts: 'build/**', fingerprint: true
172+
publishHTML (target: [
173+
allowMissing: true,
174+
alwaysLinkToLastBuild: false,
175+
keepAll: true,
176+
reportDir: 'build',
177+
reportFiles: 'scan-xccdf-results.html',
178+
reportName: "OpenSCAP Report"
179+
])
180+
publishHTML (target: [
181+
allowMissing: true,
182+
alwaysLinkToLastBuild: false,
183+
keepAll: true,
184+
reportDir: 'build',
185+
reportFiles: 'gauntlt-results.html',
186+
reportName: "Gauntlt Report"
187+
])
188+
}
186189
})
187190
}
188191
}

‎Vagrantfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
Vagrant.configure("2") do |config|
22
config.vm.box = "bento/centos-7.5"
33
config.vm.synced_folder ".", "/app"
4-
config.vm.provision "shell", inline: "/app/bin/install-gauntlt.sh", upload_path: "/home/vagrant/install-gauntlt.sh"
5-
config.vm.provision "shell", inline: "/app/bin/install-ansible.sh", upload_path: "/home/vagrant/install-ansible.sh"
6-
config.vm.provision "shell", inline: "cd /app/ansible && ansible-playbook -l localhost bakery.yml app-AfterInstall.yml app-StartServer.yml", upload_path: "/home/vagrant/apl.sh"
4+
config.vm.provision "shell", inline: "/app/bin/install-gauntlt.sh", upload_path: "/home/vagrant/install-gauntlt.sh", privileged: false
5+
config.vm.provision "shell", inline: "/app/bin/install-ansible.sh", upload_path: "/home/vagrant/install-ansible.sh", privileged: false
6+
config.vm.provision "shell", inline: "/app/bin/ansible.sh bakery.yml scan-openscap.yml scan-gauntlt.yml app-AfterInstall.yml app-StartServer.yml ", upload_path: "/home/vagrant/ansible.sh", privileged: false
77
config.vm.network "forwarded_port", guest: 80, host: 6080, auto_correct: true
88
end

‎ansible/bakery.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@
3333
- nginxinc.nginx
3434
- prepare-web-content
3535
- prepare-codedeploy
36+
vars:
37+
nginx_start: false
3638

3739

3840
- name: Harden Server
@@ -42,5 +44,3 @@
4244
roles:
4345
- extra-cis-remediation
4446
#- MindPointGroup.RHEL7-CIS
45-
- scan-openscap
46-
- scan-gauntlt

‎ansible/gauntlt-results.txt‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,3 +100,207 @@ cucumber /app/gauntlt/simple-env-var.attack:16 # Scenario: Verify server is avai
100100
6 scenarios (1 failed, 5 passed)
101101
27 steps (1 failed, 2 skipped, 24 passed)
102102
0m14.558s
103+
Feature: OS detection
104+
105+
Background: # /app/gauntlt/os_detection.attack:3
106+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
107+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
108+
| name | value |
109+
| hostname | scanme.nmap.org |
110+
111+
@slow
112+
Scenario: Detect OS # /app/gauntlt/os_detection.attack:10
113+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
114+
"""
115+
nmap -sV -p80 -PN <hostname>
116+
"""
117+
Then the output should contain: # aruba-0.7.4/lib/aruba/cucumber.rb:182
118+
"""
119+
Apache
120+
"""
121+
122+
@slow
123+
Feature: nmap attacks for scanme.nmap.org and to use this for your tests, change the value in the profile
124+
125+
Background: # /app/gauntlt/nmap.attack:4
126+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
127+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
128+
| name | value |
129+
| hostname | scanme.nmap.org |
130+
| host | scanme.nmap.org |
131+
| tcp_ping_ports | 22,25,80,443 |
132+
133+
Scenario: Verify server is open on expected set of ports using the nmap-fast attack step # /app/gauntlt/nmap.attack:12
134+
Checking nmap-fast and nmap-fastRunning a nmap-fast attack. This attack has this description:
135+
This is a fast nmap scan that should run in 10 seconds or less on most networks. It looks for the most common ports and services.
136+
When I launch a "nmap-fast" attack # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:12
137+
Then the output should match /80.tcp\s+open/ # aruba-0.7.4/lib/aruba/cucumber.rb:206
138+
139+
Scenario: Verify server is open on expected set of ports using the nmap fast flag # /app/gauntlt/nmap.attack:16
140+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
141+
"""
142+
nmap -F <hostname>
143+
"""
144+
Then the output should match: # aruba-0.7.4/lib/aruba/cucumber.rb:210
145+
"""
146+
80/tcp\s+open
147+
"""
148+
149+
Scenario: Verify that there are no unexpected ports open # /app/gauntlt/nmap.attack:26
150+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
151+
"""
152+
nmap -F <hostname>
153+
"""
154+
Then the output should not contain: # aruba-0.7.4/lib/aruba/cucumber.rb:186
155+
"""
156+
22/tcp
157+
25/tcp
158+
"""
159+
160+
Scenario: Output to XML # /app/gauntlt/nmap.attack:37
161+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
162+
"""
163+
nmap -p 80,443 -oX foo.xml <hostname>
164+
"""
165+
And the file "foo.xml" should contain XML: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:15
166+
| css |
167+
| ports port[protocol="tcp"][portid="80"] state[state="open"] |
168+
And the file "foo.xml" should not contain XML: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:21
169+
| css |
170+
| ports port[protocol="tcp"][portid="123"] state[state="open"] |
171+
| ports port[protocol="tcp"][portid="443"] state[state="open"] |
172+
173+
@slow
174+
Feature: simple nmap attack (sanity check)
175+
176+
Background: # /app/gauntlt/simple-env-var.attack:4
177+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
178+
And the following environment variables: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:3
179+
| name | environment_variable_name |
180+
| hostname | TEST_HOSTNAME |
181+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
182+
| name | value |
183+
| https_port | 443 |
184+
| http_port | 80 |
185+
186+
Scenario: Verify server is available on standard web ports # /app/gauntlt/simple-env-var.attack:16
187+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
188+
"""
189+
nmap -p <http_port>,<https_port> <hostname>
190+
"""
191+
no implicit conversion of nil into String (TypeError)
192+
/app/gauntlt/simple-env-var.attack:17:in `When I launch an "nmap" attack with:'
193+
Then the output should match /80.tcp\s+open/ # aruba-0.7.4/lib/aruba/cucumber.rb:206
194+
And the output should not match: # aruba-0.7.4/lib/aruba/cucumber.rb:219
195+
"""
196+
443/tcp\s+open
197+
"""
198+
199+
Failing Scenarios:
200+
cucumber /app/gauntlt/simple-env-var.attack:16 # Scenario: Verify server is available on standard web ports
201+
202+
6 scenarios (1 failed, 5 passed)
203+
27 steps (1 failed, 2 skipped, 24 passed)
204+
0m17.076s
205+
Feature: OS detection
206+
207+
Background: # /app/gauntlt/os_detection.attack:3
208+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
209+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
210+
| name | value |
211+
| hostname | scanme.nmap.org |
212+
213+
@slow
214+
Scenario: Detect OS # /app/gauntlt/os_detection.attack:10
215+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
216+
"""
217+
nmap -sV -p80 -PN <hostname>
218+
"""
219+
Then the output should contain: # aruba-0.7.4/lib/aruba/cucumber.rb:182
220+
"""
221+
Apache
222+
"""
223+
224+
@slow
225+
Feature: nmap attacks for scanme.nmap.org and to use this for your tests, change the value in the profile
226+
227+
Background: # /app/gauntlt/nmap.attack:4
228+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
229+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
230+
| name | value |
231+
| hostname | scanme.nmap.org |
232+
| host | scanme.nmap.org |
233+
| tcp_ping_ports | 22,25,80,443 |
234+
235+
Scenario: Verify server is open on expected set of ports using the nmap-fast attack step # /app/gauntlt/nmap.attack:12
236+
Checking nmap-fast and nmap-fastRunning a nmap-fast attack. This attack has this description:
237+
This is a fast nmap scan that should run in 10 seconds or less on most networks. It looks for the most common ports and services.
238+
When I launch a "nmap-fast" attack # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:12
239+
Then the output should match /80.tcp\s+open/ # aruba-0.7.4/lib/aruba/cucumber.rb:206
240+
241+
Scenario: Verify server is open on expected set of ports using the nmap fast flag # /app/gauntlt/nmap.attack:16
242+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
243+
"""
244+
nmap -F <hostname>
245+
"""
246+
Then the output should match: # aruba-0.7.4/lib/aruba/cucumber.rb:210
247+
"""
248+
80/tcp\s+open
249+
"""
250+
251+
Scenario: Verify that there are no unexpected ports open # /app/gauntlt/nmap.attack:26
252+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
253+
"""
254+
nmap -F <hostname>
255+
"""
256+
Then the output should not contain: # aruba-0.7.4/lib/aruba/cucumber.rb:186
257+
"""
258+
22/tcp
259+
25/tcp
260+
"""
261+
262+
Scenario: Output to XML # /app/gauntlt/nmap.attack:37
263+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
264+
"""
265+
nmap -p 80,443 -oX foo.xml <hostname>
266+
"""
267+
And the file "foo.xml" should contain XML: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:15
268+
| css |
269+
| ports port[protocol="tcp"][portid="80"] state[state="open"] |
270+
And the file "foo.xml" should not contain XML: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:21
271+
| css |
272+
| ports port[protocol="tcp"][portid="123"] state[state="open"] |
273+
| ports port[protocol="tcp"][portid="443"] state[state="open"] |
274+
275+
@slow
276+
Feature: simple nmap attack (sanity check)
277+
278+
Background: # /app/gauntlt/simple-env-var.attack:4
279+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
280+
And the following environment variables: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:3
281+
| name | environment_variable_name |
282+
| hostname | TEST_HOSTNAME |
283+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
284+
| name | value |
285+
| https_port | 443 |
286+
| http_port | 80 |
287+
288+
Scenario: Verify server is available on standard web ports # /app/gauntlt/simple-env-var.attack:16
289+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
290+
"""
291+
nmap -p <http_port>,<https_port> <hostname>
292+
"""
293+
no implicit conversion of nil into String (TypeError)
294+
/app/gauntlt/simple-env-var.attack:17:in `When I launch an "nmap" attack with:'
295+
Then the output should match /80.tcp\s+open/ # aruba-0.7.4/lib/aruba/cucumber.rb:206
296+
And the output should not match: # aruba-0.7.4/lib/aruba/cucumber.rb:219
297+
"""
298+
443/tcp\s+open
299+
"""
300+
301+
Failing Scenarios:
302+
cucumber /app/gauntlt/simple-env-var.attack:16 # Scenario: Verify server is available on standard web ports
303+
304+
6 scenarios (1 failed, 5 passed)
305+
27 steps (1 failed, 2 skipped, 24 passed)
306+
0m14.169s

‎ansible/roles/scan-gauntlt/defaults/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@
33
gauntlt_version: "1.0.8"
44
build_dir: /app/build/
55
gauntlt_attacks: /app/gauntlt/*.attack
6-
output_file_html: gauntlt-results.txt
6+
output_file_html: /app/build/gauntlt-results.html

‎ansible/roles/scan-gauntlt/tasks/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@
99
mode: 0775
1010

1111
- name: Scan using gauntlt
12-
shell: gauntlt "{{ gauntlt_attacks }}" | cat >> "{{ build_dir}}""{{ output_file_html }}"
12+
command: gauntlt -f html -o "{{ output_file_html }}" "{{ gauntlt_attacks }}"

‎ansible/roles/scan-openscap/defaults/main.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
# defaults file for scan-oscap
33
build_dir: /app/build
4-
output_file_html: scan-xccdf-results.html
5-
output_file_xml: scan-xccdf-results.xml
4+
output_file_html: /app/build/scan-xccdf-results.html
5+
output_file_xml: /app/build/scan-xccdf-results.xml
66
profile: C2S
77
xccdf_file: /usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml

‎ansible/roles/scan-openscap/tasks/main.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@
1414

1515
- name: Scan with OpenSCAP
1616
shell: |
17-
eet -euo pipefail
18-
ed {{ build_dir }}
17+
set -euo pipefail
18+
cd {{ build_dir }}
1919
# This will have a non-zero exit if any of the scans fail, so do not fail immediately on that
2020
set +e
2121
oscap xccdf eval --fetch-remote-resources --profile {{ profile }} --results {{ output_file_xml }} {{ xccdf_file }}

‎ansible/scan-gauntlt.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
# Thanks https://www.tricksofthetrades.net/2017/10/02/ansible-local-playbooks/ for
3+
# the trick on installing locally using "hosts: 127.0.0.1" and "connection:local"
4+
5+
- name: Scan Server with Gauntlt
6+
hosts: 127.0.0.1
7+
connection: local
8+
roles:
9+
- scan-gauntlt

0 commit comments

Comments
 (0)