Skip to content

Commit 43432a4

Browse files
obscurerichardobscurerichard
authored
Merge pull request #51 from ModusCreateOrg/gauntlt_packer
Run Gauntlt through packer
2 parents 8e2baee + 25cf7e2 commit 43432a4

File tree

24 files changed

+544
-118
lines changed

24 files changed

+544
-118
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
/terraform/tf.plan
1212
__pycache__
1313
build/
14+
tmp/
1415
jmeter.log
1516
scan-xccdf-results.html
1617
scan-xccdf-results.xml

‎Jenkinsfile‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -165,16 +165,27 @@ if (params.Run_Packer) {
165165
node {
166166
wrap.call({
167167
unstash 'src'
168-
sh ("./bin/pack.sh")
169-
archive (includes: 'build/**')
170-
publishHTML (target: [
171-
allowMissing: true,
172-
alwaysLinkToLastBuild: false,
173-
keepAll: true,
174-
reportDir: 'build',
175-
reportFiles: 'scan-xccdf-results.html',
176-
reportName: "OpenSCAP Report"
177-
])
168+
try {
169+
sh ("./bin/pack.sh")
170+
} finally {
171+
archiveArtifacts artifacts: 'build/**', fingerprint: true
172+
publishHTML (target: [
173+
allowMissing: true,
174+
alwaysLinkToLastBuild: false,
175+
keepAll: true,
176+
reportDir: 'build',
177+
reportFiles: 'scan-xccdf-results.html',
178+
reportName: "OpenSCAP Report"
179+
])
180+
publishHTML (target: [
181+
allowMissing: true,
182+
alwaysLinkToLastBuild: false,
183+
keepAll: true,
184+
reportDir: 'build',
185+
reportFiles: 'gauntlt-results.html',
186+
reportName: "Gauntlt Report"
187+
])
188+
}
178189
})
179190
}
180191
}

‎Vagrantfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
Vagrant.configure("2") do |config|
22
config.vm.box = "bento/centos-7.5"
33
config.vm.synced_folder ".", "/app"
4-
config.vm.provision "shell", inline: "/app/bin/install-gauntlt.sh", upload_path: "/home/vagrant/install-gauntlt.sh"
5-
config.vm.provision "shell", inline: "/app/bin/install-ansible.sh", upload_path: "/home/vagrant/install-ansible.sh"
6-
config.vm.provision "shell", inline: "cd /app/ansible && ansible-playbook -l localhost bakery.yml app-AfterInstall.yml app-StartServer.yml", upload_path: "/home/vagrant/apl.sh"
4+
config.vm.provision "shell", inline: "/app/bin/install-gauntlt.sh", upload_path: "/home/vagrant/install-gauntlt.sh", privileged: false
5+
config.vm.provision "shell", inline: "/app/bin/install-ansible.sh", upload_path: "/home/vagrant/install-ansible.sh", privileged: false
6+
config.vm.provision "shell", inline: "/app/bin/ansible.sh bakery.yml scan-openscap.yml scan-gauntlt.yml app-AfterInstall.yml app-StartServer.yml ", upload_path: "/home/vagrant/ansible.sh", privileged: false
77
config.vm.network "forwarded_port", guest: 80, host: 6080, auto_correct: true
88
end

‎ansible/bakery.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@
3333
- nginxinc.nginx
3434
- prepare-web-content
3535
- prepare-codedeploy
36+
vars:
37+
nginx_start: false
3638

3739

3840
- name: Harden Server
@@ -42,4 +44,3 @@
4244
roles:
4345
- extra-cis-remediation
4446
#- MindPointGroup.RHEL7-CIS
45-
- scan-openscap

‎ansible/gauntlt-results.txt‎

Lines changed: 306 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,306 @@
1+
Feature: OS detection
2+
3+
Background: # /app/gauntlt/os_detection.attack:3
4+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
5+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
6+
| name | value |
7+
| hostname | scanme.nmap.org |
8+
9+
@slow
10+
Scenario: Detect OS # /app/gauntlt/os_detection.attack:10
11+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
12+
"""
13+
nmap -sV -p80 -PN <hostname>
14+
"""
15+
Then the output should contain: # aruba-0.7.4/lib/aruba/cucumber.rb:182
16+
"""
17+
Apache
18+
"""
19+
20+
@slow
21+
Feature: nmap attacks for scanme.nmap.org and to use this for your tests, change the value in the profile
22+
23+
Background: # /app/gauntlt/nmap.attack:4
24+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
25+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
26+
| name | value |
27+
| hostname | scanme.nmap.org |
28+
| host | scanme.nmap.org |
29+
| tcp_ping_ports | 22,25,80,443 |
30+
31+
Scenario: Verify server is open on expected set of ports using the nmap-fast attack step # /app/gauntlt/nmap.attack:12
32+
Checking nmap-fast and nmap-fastRunning a nmap-fast attack. This attack has this description:
33+
This is a fast nmap scan that should run in 10 seconds or less on most networks. It looks for the most common ports and services.
34+
When I launch a "nmap-fast" attack # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:12
35+
Then the output should match /80.tcp\s+open/ # aruba-0.7.4/lib/aruba/cucumber.rb:206
36+
37+
Scenario: Verify server is open on expected set of ports using the nmap fast flag # /app/gauntlt/nmap.attack:16
38+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
39+
"""
40+
nmap -F <hostname>
41+
"""
42+
Then the output should match: # aruba-0.7.4/lib/aruba/cucumber.rb:210
43+
"""
44+
80/tcp\s+open
45+
"""
46+
47+
Scenario: Verify that there are no unexpected ports open # /app/gauntlt/nmap.attack:26
48+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
49+
"""
50+
nmap -F <hostname>
51+
"""
52+
Then the output should not contain: # aruba-0.7.4/lib/aruba/cucumber.rb:186
53+
"""
54+
22/tcp
55+
25/tcp
56+
"""
57+
58+
Scenario: Output to XML # /app/gauntlt/nmap.attack:37
59+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
60+
"""
61+
nmap -p 80,443 -oX foo.xml <hostname>
62+
"""
63+
And the file "foo.xml" should contain XML: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:15
64+
| css |
65+
| ports port[protocol="tcp"][portid="80"] state[state="open"] |
66+
And the file "foo.xml" should not contain XML: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:21
67+
| css |
68+
| ports port[protocol="tcp"][portid="123"] state[state="open"] |
69+
| ports port[protocol="tcp"][portid="443"] state[state="open"] |
70+
71+
@slow
72+
Feature: simple nmap attack (sanity check)
73+
74+
Background: # /app/gauntlt/simple-env-var.attack:4
75+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
76+
And the following environment variables: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:3
77+
| name | environment_variable_name |
78+
| hostname | TEST_HOSTNAME |
79+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
80+
| name | value |
81+
| https_port | 443 |
82+
| http_port | 80 |
83+
84+
Scenario: Verify server is available on standard web ports # /app/gauntlt/simple-env-var.attack:16
85+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
86+
"""
87+
nmap -p <http_port>,<https_port> <hostname>
88+
"""
89+
no implicit conversion of nil into String (TypeError)
90+
/app/gauntlt/simple-env-var.attack:17:in `When I launch an "nmap" attack with:'
91+
Then the output should match /80.tcp\s+open/ # aruba-0.7.4/lib/aruba/cucumber.rb:206
92+
And the output should not match: # aruba-0.7.4/lib/aruba/cucumber.rb:219
93+
"""
94+
443/tcp\s+open
95+
"""
96+
97+
Failing Scenarios:
98+
cucumber /app/gauntlt/simple-env-var.attack:16 # Scenario: Verify server is available on standard web ports
99+
100+
6 scenarios (1 failed, 5 passed)
101+
27 steps (1 failed, 2 skipped, 24 passed)
102+
0m14.558s
103+
Feature: OS detection
104+
105+
Background: # /app/gauntlt/os_detection.attack:3
106+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
107+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
108+
| name | value |
109+
| hostname | scanme.nmap.org |
110+
111+
@slow
112+
Scenario: Detect OS # /app/gauntlt/os_detection.attack:10
113+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
114+
"""
115+
nmap -sV -p80 -PN <hostname>
116+
"""
117+
Then the output should contain: # aruba-0.7.4/lib/aruba/cucumber.rb:182
118+
"""
119+
Apache
120+
"""
121+
122+
@slow
123+
Feature: nmap attacks for scanme.nmap.org and to use this for your tests, change the value in the profile
124+
125+
Background: # /app/gauntlt/nmap.attack:4
126+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
127+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
128+
| name | value |
129+
| hostname | scanme.nmap.org |
130+
| host | scanme.nmap.org |
131+
| tcp_ping_ports | 22,25,80,443 |
132+
133+
Scenario: Verify server is open on expected set of ports using the nmap-fast attack step # /app/gauntlt/nmap.attack:12
134+
Checking nmap-fast and nmap-fastRunning a nmap-fast attack. This attack has this description:
135+
This is a fast nmap scan that should run in 10 seconds or less on most networks. It looks for the most common ports and services.
136+
When I launch a "nmap-fast" attack # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:12
137+
Then the output should match /80.tcp\s+open/ # aruba-0.7.4/lib/aruba/cucumber.rb:206
138+
139+
Scenario: Verify server is open on expected set of ports using the nmap fast flag # /app/gauntlt/nmap.attack:16
140+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
141+
"""
142+
nmap -F <hostname>
143+
"""
144+
Then the output should match: # aruba-0.7.4/lib/aruba/cucumber.rb:210
145+
"""
146+
80/tcp\s+open
147+
"""
148+
149+
Scenario: Verify that there are no unexpected ports open # /app/gauntlt/nmap.attack:26
150+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
151+
"""
152+
nmap -F <hostname>
153+
"""
154+
Then the output should not contain: # aruba-0.7.4/lib/aruba/cucumber.rb:186
155+
"""
156+
22/tcp
157+
25/tcp
158+
"""
159+
160+
Scenario: Output to XML # /app/gauntlt/nmap.attack:37
161+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
162+
"""
163+
nmap -p 80,443 -oX foo.xml <hostname>
164+
"""
165+
And the file "foo.xml" should contain XML: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:15
166+
| css |
167+
| ports port[protocol="tcp"][portid="80"] state[state="open"] |
168+
And the file "foo.xml" should not contain XML: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:21
169+
| css |
170+
| ports port[protocol="tcp"][portid="123"] state[state="open"] |
171+
| ports port[protocol="tcp"][portid="443"] state[state="open"] |
172+
173+
@slow
174+
Feature: simple nmap attack (sanity check)
175+
176+
Background: # /app/gauntlt/simple-env-var.attack:4
177+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
178+
And the following environment variables: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:3
179+
| name | environment_variable_name |
180+
| hostname | TEST_HOSTNAME |
181+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
182+
| name | value |
183+
| https_port | 443 |
184+
| http_port | 80 |
185+
186+
Scenario: Verify server is available on standard web ports # /app/gauntlt/simple-env-var.attack:16
187+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
188+
"""
189+
nmap -p <http_port>,<https_port> <hostname>
190+
"""
191+
no implicit conversion of nil into String (TypeError)
192+
/app/gauntlt/simple-env-var.attack:17:in `When I launch an "nmap" attack with:'
193+
Then the output should match /80.tcp\s+open/ # aruba-0.7.4/lib/aruba/cucumber.rb:206
194+
And the output should not match: # aruba-0.7.4/lib/aruba/cucumber.rb:219
195+
"""
196+
443/tcp\s+open
197+
"""
198+
199+
Failing Scenarios:
200+
cucumber /app/gauntlt/simple-env-var.attack:16 # Scenario: Verify server is available on standard web ports
201+
202+
6 scenarios (1 failed, 5 passed)
203+
27 steps (1 failed, 2 skipped, 24 passed)
204+
0m17.076s
205+
Feature: OS detection
206+
207+
Background: # /app/gauntlt/os_detection.attack:3
208+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
209+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
210+
| name | value |
211+
| hostname | scanme.nmap.org |
212+
213+
@slow
214+
Scenario: Detect OS # /app/gauntlt/os_detection.attack:10
215+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
216+
"""
217+
nmap -sV -p80 -PN <hostname>
218+
"""
219+
Then the output should contain: # aruba-0.7.4/lib/aruba/cucumber.rb:182
220+
"""
221+
Apache
222+
"""
223+
224+
@slow
225+
Feature: nmap attacks for scanme.nmap.org and to use this for your tests, change the value in the profile
226+
227+
Background: # /app/gauntlt/nmap.attack:4
228+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
229+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
230+
| name | value |
231+
| hostname | scanme.nmap.org |
232+
| host | scanme.nmap.org |
233+
| tcp_ping_ports | 22,25,80,443 |
234+
235+
Scenario: Verify server is open on expected set of ports using the nmap-fast attack step # /app/gauntlt/nmap.attack:12
236+
Checking nmap-fast and nmap-fastRunning a nmap-fast attack. This attack has this description:
237+
This is a fast nmap scan that should run in 10 seconds or less on most networks. It looks for the most common ports and services.
238+
When I launch a "nmap-fast" attack # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:12
239+
Then the output should match /80.tcp\s+open/ # aruba-0.7.4/lib/aruba/cucumber.rb:206
240+
241+
Scenario: Verify server is open on expected set of ports using the nmap fast flag # /app/gauntlt/nmap.attack:16
242+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
243+
"""
244+
nmap -F <hostname>
245+
"""
246+
Then the output should match: # aruba-0.7.4/lib/aruba/cucumber.rb:210
247+
"""
248+
80/tcp\s+open
249+
"""
250+
251+
Scenario: Verify that there are no unexpected ports open # /app/gauntlt/nmap.attack:26
252+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
253+
"""
254+
nmap -F <hostname>
255+
"""
256+
Then the output should not contain: # aruba-0.7.4/lib/aruba/cucumber.rb:186
257+
"""
258+
22/tcp
259+
25/tcp
260+
"""
261+
262+
Scenario: Output to XML # /app/gauntlt/nmap.attack:37
263+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
264+
"""
265+
nmap -p 80,443 -oX foo.xml <hostname>
266+
"""
267+
And the file "foo.xml" should contain XML: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:15
268+
| css |
269+
| ports port[protocol="tcp"][portid="80"] state[state="open"] |
270+
And the file "foo.xml" should not contain XML: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:21
271+
| css |
272+
| ports port[protocol="tcp"][portid="123"] state[state="open"] |
273+
| ports port[protocol="tcp"][portid="443"] state[state="open"] |
274+
275+
@slow
276+
Feature: simple nmap attack (sanity check)
277+
278+
Background: # /app/gauntlt/simple-env-var.attack:4
279+
Given "nmap" is installed # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:4
280+
And the following environment variables: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:3
281+
| name | environment_variable_name |
282+
| hostname | TEST_HOSTNAME |
283+
And the following profile: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/gauntlt.rb:9
284+
| name | value |
285+
| https_port | 443 |
286+
| http_port | 80 |
287+
288+
Scenario: Verify server is available on standard web ports # /app/gauntlt/simple-env-var.attack:16
289+
When I launch an "nmap" attack with: # gauntlt-1.0.13/lib/gauntlt/attack_adapters/nmap.rb:8
290+
"""
291+
nmap -p <http_port>,<https_port> <hostname>
292+
"""
293+
no implicit conversion of nil into String (TypeError)
294+
/app/gauntlt/simple-env-var.attack:17:in `When I launch an "nmap" attack with:'
295+
Then the output should match /80.tcp\s+open/ # aruba-0.7.4/lib/aruba/cucumber.rb:206
296+
And the output should not match: # aruba-0.7.4/lib/aruba/cucumber.rb:219
297+
"""
298+
443/tcp\s+open
299+
"""
300+
301+
Failing Scenarios:
302+
cucumber /app/gauntlt/simple-env-var.attack:16 # Scenario: Verify server is available on standard web ports
303+
304+
6 scenarios (1 failed, 5 passed)
305+
27 steps (1 failed, 2 skipped, 24 passed)
306+
0m14.169s

‎ansible/roles/scan-gauntlt/README.md‎

Whitespace-only changes.

‎ansible/roles/scan-gauntlt/defaults/main.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
3+
gauntlt_version: "1.0.8"
4+
build_dir: /app/build/
5+
gauntlt_attacks: /app/gauntlt/*.attack
6+
output_file_html: /app/build/gauntlt-results.html

0 commit comments

Comments
 (0)