Compliance Automation with InSpec - Chef NYC Meetup - April 2017

Compliance Automation with InSpec
Adam Leff - @adamleff

Who's this guy?
• Adam Leff (@adamleff)
• Technical Community Advocate at Chef
• Formerly Senior Software Engineer in Partner Engineering and Core
Engineering
• Before that, numerous leadership roles at WebMD
• Live in Datacenter Alley (Ashburn, VA)

Join Slack Team & Channel
• http://community-slack.chef.io
• Join us in the #inspec channel
#inspec

We started with infrastructure automation…

Security and compliance slow me down!

Compliance Officer Jane says…
"Our systems mus
be compliant."

This is a true story.
Auditor: "Communication from
your network devices to your
authentication server must be
encrypted."

Me: "We use BlahBlah TACACS+
server. You can't disable
encryption."

Auditor: "Okay. Please show me
that encryption is enabled."

Me: "Um… I can't. I can't disable it,
so I can't show you where it's
enabled. But I can show you that
I'm using BlahBlah TACACS+
server."

Auditor: "Can you show me how
you can't disable it?"

Me: "How about I show you where
I configured the encryption key? Is
that good enough?"

Auditor:

Why did I tell you this?
• This exchange happened at least once a year, sometimes more
• What constitutes "compliance" may be open to interpretation
• What the auditor was actually looking for can be automated
• We REALLY need to automate compliance

OMG so much compliance
• PCI-DSS
• Dodd-Frank
• HITECH
• Gramm-Leach-Bliley Act
• ISO
• HIPAA
• Grundschutz
• Sarbanes-Oxley
• General Data Protection
Regulation (GPDR)

A Documentation Example
SSH supports two different protocol
versions. The original version, SSHv1, was
subject to a number of security issues.
Please use SSHv2 instead to avoid these.

A tale of three personas…
✅❓❌

What is InSpec?
• Open-source testing framework
• Human readable language
• Assert status of infrastructure tests and compliance controls
• Scan locally or remotely

Option #2: Test a requirement with InSpec

Option #3: Test a control with InSpec

One Language
• Linux
• Windows
• BSD
• Solaris
• AIX
• … and more

One Language
• Bare Metal
• VMs
• Containers

Center for Internet Security (CIS)
• Publish benchmarks for compliance
• Red Hat Enterprise Linux, Ubuntu, SUSE, Oracle Linux…
• Microsoft Windows 7, 8, Server 2008, Server 2012…
• IBM AIX, HP-UX, VMware ESXi…
• Oracle MySQL, Apache Tomcat, MS SQL Server, IIS Server…
• … so much more, in glorious PDF format!

Security Content Automation Protocol (SCAP)
• Method for automating compliance using agreed-upon standards
• National Vulnerability Database
• Content and Scanners

Source/Copyright: Center for Internet Security

Why InSpec?
• Break down silos between organizations interested in security/compliance
• Codify your compliance agreements and requirements
• Share knowledge and code
• Safety at velocity

• Monday, May 8, 9:30am-2:30pm
• CONVENE – 32 Old Slip, NYC
• Breakfast and Lunch
• Meet CEO Barry Crist and CMO Ken Cheney
• Learn about (and get hands-on with) Compliance Automation with Chef
Automate
• events.chef.io
• FREE

★ Workshops & Chef Training
★ DevOps Leadership Summit
★ Community Summit
★ Partner Summit
★ Welcome Reception
★ Customer Dinner
★ Analyst Day
• Exhibit Hall Open & Sales suites available • chefconf.chef.io •
DAY 1 // MAY 22
★ Keynotes
★ Technical Sessions
★ Happy Hour
★ Game Night
★ Executive Dinner
DAY 2 // MAY 23
★ Keynotes
★ Technical Sessions
★ Awesome Chef Awards
★ Community Celebration
DAY 3 // MAY 24
★ Hackday
DAY 4 // MAY 25

Compliance Automation with InSpec
Learning Lab
Adam Leff - @adamleff

Login to remote workstation
The authenticity of host '52.54.113.210 (52.54.113.210)' can't be
established.
ECDSA key fingerprint is
SHA256:zAtoeO29XbhRNvwg542cuh4qsKCEaX8hNIlEOCbgd3I.
Are you sure you want to continue connecting (yes/no)?
ssh chef@IP_ADDRESS

established.
Are you sure you want to continue connecting (yes/no)? yes
ssh chef@IP_ADDRESS

established.
Warning: Permanently added '52.54.113.210' (ECDSA) to the list of known
hosts.
chef@52.54.113.210's password:
ssh chef@IP_ADDRESS

established.
Warning: Permanently added '52.54.113.210' (ECDSA) to the list of known
hosts.
chef@52.54.113.210's password: chef
ssh chef@IP_ADDRESS

Touch a file with your name
touch firstname-lastname

Touch a file with your name
touch adam-leff

List your home directory
adam-leff cookbooks Berksfile
nodes Berksfile.lock config.json
ls -t

Verify the installation
/opt/chefdk/bin/inspec
which inspec

1.11.0
Your version of InSpec is out of date! The latest version is 1.15.0.
inspec version

/opt/chefdk/bin/chef
which chef

Chef Development Kit Version: 1.2.22
chef-client version: 12.18.31
delivery version: master (0b746cafed65a9ea1a79de3cc546e7922de9187c)
berks version: 5.6.0
kitchen version: 1.15.0
chef --version

Chef DK - The Chef Development Kit
• Definitive tooling for local development of Chef code & Infrastructure as Code development
▪ Validate your Chef code against Chef best
practices
▪ Extend with rules to enforce organizational
Chef development best practices
▪ Enforce compliance & security practices
Foodcritic
Test Your “Chef Style”
▪ Validate your Chef code against Ruby best
practices
▪ Identify potential Ruby errors
Unclosed strings, etc.
▪ Identify style/convention that helps write better
code
Single quotes vs. double quotes
CookStyle
Validate your Ruby
▪ Validate your Chef code will run
▪ Testing for more Chef advanced use cases
▪ Useful for regression testing
ChefSpec
Simulate Chef
▪ Executes your Chef code on an instance or container
▪ Integrates with Cloud and Virtualization providers
▪ Validate your Chef code locally before sharing
▪ Speed development of Chef Cookbooks
Test Kitchen
Let’s do this (almost) for real
▪ Assert the intention of your Chef code
▪ Verify on live systems that your Chef code produced the correct result
▪ Confirm your Chef code didn’t not produce compliance drift
InSpec
Verify automation results & ensure compliance
FAST INEXPENSIVE TESTING
DEEP INTEGRATION TESTING

Create a profiles directory
mkdir profiles

Go to the profiles directory
cd profiles

Create a new profile
Create new profile at /home/chef/profiles/my-profile
* Create directory controls
* Create file controls/example.rb
* Create file inspec.yml
* Create directory libraries
* Create file README.md
* Create file libraries/.gitkeep
inspec init profile my-profile

Go to our profile
cd my-profile

Explore the new profile
.
├── README.md
├── controls
│ └── example.rb
├── inspec.yml
└── libraries
tree

Go to the controls directory
cd controls

Check out the example
# encoding: utf-8
# copyright: 2015, The Authors
# license: All rights reserved
title 'sample section'
# you can also use plain tests
describe file('/tmp') do
it { should be_directory }
end
cat example.rb

Create a new control file
vi ssh.rb

~/profiles/my-profile/controls/ssh.rb
control 'ssh-1' do
title 'my title'
desc 'my description'
impact 1.0
describe sshd_config do
its('Protocol') { should cmp 2 }
end
end
Our new control

Go back to the profiles directory
cd ~/profiles

Validate our profile
Location: my-profile
Profile: my-profile
Controls: 3
Timestamp: 2017-04-17T15:57:35-04:00
Valid: true
No errors or warnings
inspec check my-profile

Execute our profile
inspec exec my-profile

Simple SSH Cookbook
• A server recipe to manage the sshd_config file
• Local test environment configured

Move to the cookbooks directory
cd ~/cookbooks

List cookbooks
audit compat_resource
ls

Audit Cookbook
• Install InSpec
• Run InSpec profiles
• Report results to Chef Compliance or Chef Visibility

Run with additional parameters
[2017-03-10T14:10:34+00:00] INFO: Forking chef instance to converge...
Starting Chef Client, version 12.18.31
[2017-03-10T14:10:34+00:00] INFO: *** Chef 12.18.31 ***
...
[2017-03-10T14:10:40+00:00] INFO: Chef Run complete in 4.10402964 seconds
Running handlers:
[2017-03-10T14:10:40+00:00] INFO: Running report handlers
[2017-03-10T14:10:40+00:00] WARN: Format is json
[2017-03-10T14:10:40+00:00] INFO: Initialize InSpec
[2017-03-10T14:10:40+00:00] INFO: Running tests from: [{:name=>"ssh", :path=>"/home/chef/profiles/ssh"}]
[2017-03-10T14:10:40+00:00] INFO: Reporting to chef-visibility
...
Running handlers complete
[2017-03-10T14:10:40+00:00] INFO: Report handlers complete
Chef Client finished, 1/2 resources updated in 06 seconds
sudo run_chef "recipe[audit::default]"

Compat Resource Cookbook
• Adds functionality introduced in the latest chef-client releases to any chef-client
from 12.1 onwards.
• Includes
Custom Resource functionality
notification improvements
new resources added to core chef
• Allows for these new resources in cookbooks without requiring the very latest
Chef client release.

Generate an ssh cookbook
Generating cookbook ssh
- Ensuring correct cookbook file content
- Committing cookbook files to git
- Ensuring delivery configuration
- Ensuring correct delivery build cookbook content
- Adding delivery configuration to feature branch
- Adding build cookbook to feature branch
- Merging delivery content feature branch to master
Your cookbook is ready. Type `cd ssh` to enter it.
There are several commands you can run to get started locally developing and testing your cookbook.
Type `delivery local --help` to see a full list.
Why not start by writing a test? Tests for the default recipe are stored at:
test/smoke/default/default_test.rb
If you'd prefer to dive right in, the default recipe can be found at:
recipes/default.rb
chef generate cookbook ssh

Add a server recipe to the ssh cookbook
Recipe: code_generator::recipe
* directory[./ssh/spec/unit/recipes] action create (up to date)
* cookbook_file[./ssh/spec/spec_helper.rb] action create_if_missing (up to date)
* template[./ssh/spec/unit/recipes/server_spec.rb] action create_if_missing
- create new file ./ssh/spec/unit/recipes/server_spec.rb
- update content in file ./ssh/spec/unit/recipes/server_spec.rb from none to d14960
(diff output suppressed by config)
* directory[./ssh/test/smoke/default] action create (up to date)
* template[./ssh/test/smoke/default/server.rb] action create_if_missing
- create new file ./ssh/test/smoke/default/server.rb
- update content in file ./ssh/test/smoke/default/server.rb from none to aa8bba
* template[./ssh/recipes/server.rb] action create
- create new file ./ssh/recipes/server.rb
- update content in file ./ssh/recipes/server.rb from none to 18f24e
chef generate recipe ssh server

Add a template to the cookbook
Recipe: code_generator::template
* directory[./ssh/templates/default] action create
- create new directory ./ssh/templates/default
* file[./ssh/templates/sshd_config.erb] action create
- create new file ./ssh/templates/sshd_config.erb
- update content in file ./ssh/templates/sshd_config.erb from none to
a16b11
chef generate template ssh sshd_config -s /etc/ssh/sshd_config

~/cookbooks/ssh/recipes/server.rb
template '/etc/ssh/sshd_config' do
source 'sshd_config.erb'
owner 'root'
group 'root'
mode '0600'
end
Server Recipe

Remember…
• Infrastructure policies need testing
↳ Linting
↳ Static Analysis
↳ Unit Testing
↳ Integration Testing
↳ Compliance Testing
"Infrastructure as
Code" should be
tested like ANY
other codebase.

Test-Driven Development
• Write a test, watch it fail
• Write some code
• Write and run more tests
• Code review
• Delivery pipeline to production
• Lowered chance of production failure
Add a test
Run the tests
Make a little change
Run the tests
pass
[development
continues]fail
fail
pass
pass
[development stops]

~/cookbooks/ssh/.kitchen.yml
---
driver:
name: vagrant
name: docker
...
Test Kitchen Configuration (1 of 3)
-
+

...
platforms:
- name: ubuntu-16.04
- name: centos-7.2
- name: centos-7.3
...
-
+
-

+
suites:
- name: default
- name: server
run_list:
- recipe[ssh::default]
- recipe[ssh::server]
verifier:
inspec_tests:
- test/smoke/default
- /home/chef/profiles/my-profile
attributes:
+
-
-
+
-

Move to the cookbook’s directory
cd ~/cookbooks/ssh

List the kitchens
Instance Driver Provisioner Verifier Transport Last Action Last Error
server-centos-73 Docker ChefZero Inspec Ssh <Not Created> <None>
kitchen list

Converge
-----> Starting Kitchen (v1.15.0)
...
-----> Creating <server-centos-73>...
Sending build context to Docker daemon 227.8 kB
Sending build context to Docker daemon
Step 0 : FROM centos:centos7
...
Running handlers:
Finished converging <server-centos-73> (0m23.54s).
-----> Kitchen is finished. (1m0.39s)
kitchen converge

Test-driven Development
Add a test
Run the tests
Run the tests
pass
[development
continues]fail
fail
pass
pass
[development stops]

Verify the Kitchen
-----> Verifying <server-centos-73>...
Loaded
Target: ssh://kitchen@localhost:32771
× sshd-1.0: SSH Version 2 (
expected: 2
got:
(compared using `cmp` matcher)
)
× SSH Configuration Protocol should cmp == 2
expected: 2
got:
(compared using `cmp` matcher)
Profile Summary: 0 successful, 1 failures, 0 skipped
Test Summary: 0 successful, 1 failures, 0 skipped
kitchen verify

Test-driven Development
Add a test
Run the tests
fail
pass

~/cookbooks/ssh/templates/sshd_config.erb
#ListenAddress 0.0.0.0
#ListenAddress ::
# The default requires explicit activation of protocol 1
#Protocol 2
Protocol 2
# HostKey for protocol version 1
Edit the SSH Configuration Template
+
-

Converge
...
-----> Converging <server-centos-73>...
...
# The default requires explicit activation of protocol 1
-#Protocol 2
+Protocol 2
# HostKey for protocol version 1
...
Running handlers:
Finished converging <server-centos-73> (0m16.32s).
kitchen converge

Verify the Kitchen
...
Loaded
Target: ssh://kitchen@localhost:32771
✔ sshd-1.0: SSH Version 2
✔ SSH Configuration Protocol should cmp == 2
Finished verifying <server-centos-73> (0m0.22s).
kitchen verify

Test the Kitchen (1of 2)
...
-----> Cleaning up any prior instances of <server-centos-73>
-----> Destroying <server-centos-73>...
...
-----> Testing <server-centos-73>
...
...
Finished creating <server-centos-73> (0m0.60s).
-----> Converging <server-centos-73>...
...
kitchen test

Test the Kitchen (2 of 2)
-----> Installing Chef Omnibus (install only if missing)
...
-----> Setting up <server-centos-73>...
Finished setting up <server-centos-73> (0m0.00s).
...
Finished verifying <server-centos-73> (0m0.51s).
-----> Destroying <server-centos-73>...
...
kitchen test

What’s next?
• Test-driven development cycle is complete
• Deploy the change

Remediate with Chef
[2017-03-10T16:48:02+00:00] INFO: Forking chef instance to converge...
Starting Chef Client, version 12.18.31
...
Synchronizing Cookbooks:
- ssh (0.1.0)
- audit (2.4.0)
- compat_resource (12.16.3)
...
-#Protocol 2
+Protocol 2
...
[2017-03-10T16:48:05+00:00] INFO: Chef Run complete in 1.248588588 seconds
Running handlers:
...
sudo run_chef "recipe[ssh::server],recipe[audit::default]"

Check the converge status in Automate

Verify Compliance Status in Automate

InSpec Shell
[root@5cd20df7bbe9 /]#
sudo docker run –it centos:7

InSpec Shell
Welcome to the interactive InSpec Shell
To find out how to use it, type: help
You are currently running on:
OS platform: centos
OS family: redhat
OS release: 7.3.1611
inspec> help
Available commands:
`[resource]` - run resource on target machine
`help resources` - show all available resources that can be used as commands
`help [resource]` - information about a specific resource
`exit` - exit the InSpec shell
You can use resources in this environment to test the target machine. For example:
command('uname -a').stdout
file('/proc/cpuinfo').content => "value",
inspec shell -t docker://5cd20df7bbe9

Trying some resources…
file('/etc/group').content

Trying some resources…
passwd.params

Selecting a single entry
passwd.uids(0).params

Using "where" to filter
passwd.where { uid.to_i > 5 }.params

describe passwd.where { uid.to_i >= 500 } do
its('params.size') { should cmp 0 }
end
Using filter with some Ruby magic…

A Challenge
• The username of the passwd entry with UID 5 should be X
• Create a control in your profile that checks that key for the proper value.

Another Challenge
• YAML configuration file at /var/tmp/workshop.yml
• There's a key called "lupo_status"
• There's another key there too…
• Create a control in your profile that checks each key for the proper value.
• Use InSpec shell to look at the file content if needed
• My machine's IP: 35.166.172.16
• No SSH'ing into my machine directly! Disqualified if you do!
• inspec shell / inspec exec ONLY!

Community Resources
• InSpec Website, includes tutorials and docs - http://inspec.io/
• #inspec channel of the Chef Community Slack - http://community-slack.chef.io/
• InSpec category of the Chef Mailing List - https://discourse.chef.io/c/inspec
• Compliance Profiles on the Supermarket - https://supermarket.chef.io/tools?type=compliance_profile
• Open Source Project - https://github.com/chef/inspec

Compliance Automation with InSpec - Chef NYC Meetup - April 2017

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Compliance Automation with InSpec - Chef NYC Meetup - April 2017

Similaire à Compliance Automation with InSpec - Chef NYC Meetup - April 2017 (20)

Dernier

Dernier (20)

Compliance Automation with InSpec - Chef NYC Meetup - April 2017

Notes de l'éditeur