mitre / inspec_training_courses

(WIP) A set of training material and guides for using inspec

InSpec Courses

Table of Contents:

• InSpec 101 Users Course
• InSpec 102 Developer Course

InSpec Users Course

Course Content

InSpec 101 Course Content

Additional Resources

Installation Guides:
InSpec 101 Installation

InSpec Developer Course

Course Content

InSpec 102 Course Content

Additional Resources

Installation Guides:
InSpec 102 Installation

NOTICE

© 2018 The MITRE Corporation.

Approved for Public Release; Distribution Unlimited. Case Number 18-3678.

NOTICE

MITRE hereby grants express written permission to use, reproduce, distribute, modify, and otherwise leverage this software to the extent permitted by the licensed terms provided in the LICENSE.md file included with this project.

NOTICE

This software was produced for the U. S. Government under Contract Number HHSM-500-2012-00008I, and is subject to Federal Acquisition Regulation Clause 52.227-14, Rights in Data-General.

No other use other than that granted to the U. S. Government, or to those acting on behalf of the U. S. Government under that Clause is authorized without the express written permission of The MITRE Corporation.

For further information, please contact The MITRE Corporation, Contracts Management Office, 7515 Colshire Drive, McLean, VA 22102-7539, [phone].

inspec_training_courses's Issues

Intermediate Course

• An intermediate course could provide a good stepping stone before gearing up for Advanced course.
• It will give students more time to play with resource development before going all out in Advanced.
• It would be helpful to include some read-ahead material that prepares students for the training.
• The process of using inspec_tools can be introduced in intermediate training.

Maintenance

This repo has not been maintained since mid 2019. Are we still intending on providing inspec usage classes? What content is in here that isn't covered in the basic developer class? Can we archive this repo?

ISSO track

Training sessions tailored for ISSOs would be great

1. They only need a high-level overview of how InSpec works
2. They can be walked through analyzing the reports in more detail
3. This training can be more compliance-focused than technical

Several errors during vagrant up

I ran into several errors during the 'vagrant up' step.

1. The Vagrantfile is not in the 'InSpec 102 Dev' directory that the README has. It is instead in the 'InSpec-Developer-Course' directory.
2. The vagrant up failed and stopped after creating the workstation VM because apt-get could not find some Ubuntu release files. Rerunning vagrant up got past this error.
3. The vagrant up failed and stopped after creating the target VM because Chef Inspec required the acceptance of a license agreement. SSHing into each target VM and installing the chef gem got past this error. The target VMs may require the inspec-bin gem as well.

Here are the stdin/stdout/stderr I saw and the steps I took to get past them:

(base) ip-10-232-38-203:InSpec 102 Dev gregory.beck$ vagrant up
A Vagrant environment or target machine is required to run this
command. Run vagrant init to create a new Vagrant environment. Or,
get an ID of a target machine from vagrant global-status to run
this command on. A final option is to change to a directory with a
Vagrantfile and to try again.
(base) ip-10-232-38-203:InSpec 102 Dev gregory.beck$ pwd
/Users/gregory.beck/Documents/GitHub/inspec_training_courses/installation/InSpec 102 Dev
(base) ip-10-232-38-203:InSpec 102 Dev gregory.beck$ cd ../..
(base) ip-10-232-38-203:inspec_training_courses gregory.beck$ pwd
/Users/gregory.beck/Documents/GitHub/inspec_training_courses
(base) ip-10-232-38-203:inspec_training_courses gregory.beck$ find . -name Vagrantfile
./InSpec-Developer-Course/Vagrantfile
(base) ip-10-232-38-203:inspec_training_courses gregory.beck$ cd InSpec-Developer-Course/
(base) ip-10-232-38-203:InSpec-Developer-Course gregory.beck$ ls
README.md cookbooks nginx_output.json
Vagrantfile installation rhel6-baseline.zip
(base) ip-10-232-38-203:InSpec-Developer-Course gregory.beck$ vagrant up
Bringing machine 'workstation' up with 'virtualbox' provider...
Bringing machine 'target' up with 'virtualbox' provider...
Bringing machine 'target-centos6' up with 'virtualbox' provider...
==> workstation: Box 'chenhan/ubuntu-mate-desktop-18.10' could not be found. Attempting to find and install...
workstation: Box Provider: virtualbox
workstation: Box Version: >= 0
==> workstation: Loading metadata for box 'chenhan/ubuntu-mate-desktop-18.10'
workstation: URL: https://vagrantcloud.com/chenhan/ubuntu-mate-desktop-18.10
==> workstation: Adding box 'chenhan/ubuntu-mate-desktop-18.10' (v20181019.0.0) for provider: virtualbox
workstation: Downloading: https://vagrantcloud.com/chenhan/boxes/ubuntu-mate-desktop-18.10/versions/20181019.0.0/providers/virtualbox.box
Download redirected to host: vagrantcloud-files-production.s3.amazonaws.com
==> workstation: Successfully added box 'chenhan/ubuntu-mate-desktop-18.10' (v20181019.0.0) for 'virtualbox'!
==> workstation: Importing base box 'chenhan/ubuntu-mate-desktop-18.10'...
==> workstation: Matching MAC address for NAT networking...
==> workstation: Checking if box 'chenhan/ubuntu-mate-desktop-18.10' version '20181019.0.0' is up to date...
==> workstation: Setting the name of the VM: workstation
==> workstation: Using hostname "workstation" as node name for Chef...
Vagrant is currently configured to create VirtualBox synced folders with
the SharedFoldersEnableSymlinksCreate option enabled. If the Vagrant
guest is not trusted, you may want to disable this option. For more
information on this option, please refer to the VirtualBox manual:

https://www.virtualbox.org/manual/ch04.html#sharedfolders

This option can be disabled globally with an environment variable:

VAGRANT_DISABLE_VBOXSYMLINKCREATE=1

or on a per folder basis within the Vagrantfile:

config.vm.synced_folder '/host/path', '/guest/path', SharedFoldersEnableSymlinksCreate: false
==> workstation: Clearing any previously set network interfaces...
==> workstation: Preparing network interfaces based on configuration...
workstation: Adapter 1: nat
==> workstation: Forwarding ports...
workstation: 22 (guest) => 2222 (host) (adapter 1)
==> workstation: Running 'pre-boot' VM customizations...
==> workstation: Booting VM...
==> workstation: Waiting for machine to boot. This may take a few minutes...
workstation: SSH address: 127.0.0.1:2222
workstation: SSH username: vagrant
workstation: SSH auth method: private key
workstation: Warning: Connection reset. Retrying...
workstation: Warning: Remote connection disconnect. Retrying...
workstation:
workstation: Vagrant insecure key detected. Vagrant will automatically replace
workstation: this with a newly generated keypair for better security.
workstation:
workstation: Inserting generated public key within guest...
workstation: Removing insecure key from the guest if it's present...
workstation: Key inserted! Disconnecting and reconnecting using new SSH key...
==> workstation: Machine booted and ready!
==> workstation: Checking for guest additions in VM...
workstation: The guest additions on this VM do not match the installed version of
workstation: VirtualBox! In most cases this is fine, but in rare cases it can
workstation: prevent things such as shared folders from working properly. If you see
workstation: shared folder errors, please make sure the guest additions within the
workstation: virtual machine match the version of VirtualBox you have installed on
workstation: your host and reload your VM.
workstation:
workstation: Guest Additions Version: 5.2.10
workstation: VirtualBox Version: 6.1
==> workstation: Setting hostname...
==> workstation: Mounting shared folders...
workstation: /vagrant => /Users/gregory.beck/Documents/GitHub/inspec_training_courses/InSpec-Developer-Course
workstation: /tmp/vagrant-chef/4f17fd4c6af7d2ffecb37037c911e433/cookbooks => /Users/gregory.beck/Documents/GitHub/inspec_training_courses/InSpec-Developer-Course/cookbooks
==> workstation: Running provisioner: chef_solo...
workstation: Installing Chef (latest)...
**The following SSH command responded with a non-zero exit status.
Vagrant assumes that this means the command failed!

apt-get update -y -qq

Stdout from the command:

Stderr from the command:

E: The repository 'http://security.ubuntu.com/ubuntu cosmic-security Release' no longer has a Release file.
E: The repository 'http://archive.ubuntu.com/ubuntu cosmic Release' no longer has a Release file.
E: The repository 'http://archive.ubuntu.com/ubuntu cosmic-updates Release' no longer has a Release file.
E: The repository 'http://archive.ubuntu.com/ubuntu cosmic-backports Release' no longer has a Release file.**

(base) ip-10-232-38-203:InSpec-Developer-Course gregory.beck$ ls
README.md cookbooks nginx_output.json
Vagrantfile installation rhel6-baseline.zip
(base) ip-10-232-38-203:InSpec-Developer-Course gregory.beck$ find . -exec grep -l apt-get {} ; 2> /dev/null
./installation/LinuxInstall.md
./cookbooks/workstation/recipes/default.rb
./cookbooks/target/recipes/default.rb
(base) ip-10-232-38-203:InSpec-Developer-Course gregory.beck$ cat Vagrantfile
nodes = [
{ :hostname => 'workstation', :box => 'chenhan/ubuntu-mate-desktop-18.10', :ram => 2048 },
{ :hostname => 'target', :box => 'minimal/xenial64', :ram => 1024 },
{ :hostname => 'target-centos6', :box => 'bento/centos-6', :ram => 1024 },
]

Vagrant.configure("2") do |config|
nodes.each do |node|
config.vm.define node[:hostname] do |nodeconfig|
nodeconfig.vm.box = node[:box]
nodeconfig.vm.hostname = node[:hostname]

  memory = node[:ram] ? node[:ram] : 1024;
  nodeconfig.vm.provider :virtualbox do |vb|
    vb.name = node[:hostname]
    vb.customize [
      "modifyvm", :id,
      "--cpuexecutioncap", "50",
      "--memory", memory.to_s,
      "--clipboard", "bidirectional",
      "--draganddrop", "bidirectional",
    ]
  end

  nodeconfig.vm.provision :chef_solo do |chef|
    chef.add_recipe node[:hostname]
  end
end

end
end
(base) ip-10-232-38-203:InSpec-Developer-Course gregory.beck$ vagrant up
Bringing machine 'workstation' up with 'virtualbox' provider...
Bringing machine 'target' up with 'virtualbox' provider...
Bringing machine 'target-centos6' up with 'virtualbox' provider...
==> workstation: Checking if box 'chenhan/ubuntu-mate-desktop-18.10' version '20181019.0.0' is up to date...
==> workstation: Clearing any previously set forwarded ports...
==> workstation: Using hostname "workstation" as node name for Chef...
==> workstation: Clearing any previously set network interfaces...
==> workstation: Preparing network interfaces based on configuration...
workstation: Adapter 1: nat
==> workstation: Forwarding ports...
workstation: 22 (guest) => 2222 (host) (adapter 1)
==> workstation: Running 'pre-boot' VM customizations...
==> workstation: Booting VM...
==> workstation: Waiting for machine to boot. This may take a few minutes...
workstation: SSH address: 127.0.0.1:2222
workstation: SSH username: vagrant
workstation: SSH auth method: private key
workstation: Warning: Connection reset. Retrying...
workstation: Warning: Remote connection disconnect. Retrying...
==> workstation: Machine booted and ready!
==> workstation: Checking for guest additions in VM...
workstation: The guest additions on this VM do not match the installed version of
workstation: VirtualBox! In most cases this is fine, but in rare cases it can
workstation: prevent things such as shared folders from working properly. If you see
workstation: shared folder errors, please make sure the guest additions within the
workstation: virtual machine match the version of VirtualBox you have installed on
workstation: your host and reload your VM.
workstation:
workstation: Guest Additions Version: 5.2.10
workstation: VirtualBox Version: 6.1
==> workstation: Setting hostname...
==> workstation: Mounting shared folders...
workstation: /vagrant => /Users/gregory.beck/Documents/GitHub/inspec_training_courses/InSpec-Developer-Course
workstation: /tmp/vagrant-chef/4f17fd4c6af7d2ffecb37037c911e433/cookbooks => /Users/gregory.beck/Documents/GitHub/inspec_training_courses/InSpec-Developer-Course/cookbooks
==> workstation: Machine already provisioned. Run vagrant provision or use the --provision
==> workstation: flag to force provisioning. Provisioners marked to run always will still run.
==> target: Box 'minimal/xenial64' could not be found. Attempting to find and install...
target: Box Provider: virtualbox
target: Box Version: >= 0
==> target: Loading metadata for box 'minimal/xenial64'
target: URL: https://vagrantcloud.com/minimal/xenial64
==> target: Adding box 'minimal/xenial64' (v16.04.2) for provider: virtualbox
target: Downloading: https://vagrantcloud.com/minimal/boxes/xenial64/versions/16.04.2/providers/virtualbox.box
Download redirected to host: vagrantcloud-files-production.s3.amazonaws.com
==> target: Successfully added box 'minimal/xenial64' (v16.04.2) for 'virtualbox'!
==> target: Importing base box 'minimal/xenial64'...
==> target: Matching MAC address for NAT networking...
==> target: Checking if box 'minimal/xenial64' version '16.04.2' is up to date...
==> target: Setting the name of the VM: target
==> target: Using hostname "target" as node name for Chef...
==> target: Fixed port collision for 22 => 2222. Now on port 2200.
==> target: Clearing any previously set network interfaces...
==> target: Preparing network interfaces based on configuration...
target: Adapter 1: nat
==> target: Forwarding ports...
target: 22 (guest) => 2200 (host) (adapter 1)
==> target: Running 'pre-boot' VM customizations...
==> target: Booting VM...
==> target: Waiting for machine to boot. This may take a few minutes...
target: SSH address: 127.0.0.1:2200
target: SSH username: vagrant
target: SSH auth method: private key
target:
target: Vagrant insecure key detected. Vagrant will automatically replace
target: this with a newly generated keypair for better security.
target:
target: Inserting generated public key within guest...
target: Removing insecure key from the guest if it's present...
target: Key inserted! Disconnecting and reconnecting using new SSH key...
==> target: Machine booted and ready!
==> target: Checking for guest additions in VM...
target: The guest additions on this VM do not match the installed version of
target: VirtualBox! In most cases this is fine, but in rare cases it can
target: prevent things such as shared folders from working properly. If you see
target: shared folder errors, please make sure the guest additions within the
target: virtual machine match the version of VirtualBox you have installed on
target: your host and reload your VM.
target:
target: Guest Additions Version: 5.1.14
target: VirtualBox Version: 6.1
==> target: Setting hostname...
==> target: Mounting shared folders...
target: /vagrant => /Users/gregory.beck/Documents/GitHub/inspec_training_courses/InSpec-Developer-Course
target: /tmp/vagrant-chef/4f17fd4c6af7d2ffecb37037c911e433/cookbooks => /Users/gregory.beck/Documents/GitHub/inspec_training_courses/InSpec-Developer-Course/cookbooks
==> target: Running provisioner: chef_solo...
target: Installing Chef (latest)...
==> target: Generating chef JSON and uploading...
==> target: Running chef-solo...
==> target: Chef Infra Client cannot execute without accepting the license
Chef never successfully completed! Any errors should be visible in the
output above. Please fix your recipes so that they properly complete.
(base) ip-10-232-38-203:InSpec-Developer-Course gregory.beck$ vagrant up
Bringing machine 'workstation' up with 'virtualbox' provider...
Bringing machine 'target' up with 'virtualbox' provider...
Bringing machine 'target-centos6' up with 'virtualbox' provider...
==> workstation: Checking if box 'chenhan/ubuntu-mate-desktop-18.10' version '20181019.0.0' is up to date...
==> workstation: Using hostname "workstation" as node name for Chef...
==> workstation: Machine already provisioned. Run vagrant provision or use the --provision
==> workstation: flag to force provisioning. Provisioners marked to run always will still run.
==> target: Checking if box 'minimal/xenial64' version '16.04.2' is up to date...
==> target: Using hostname "target" as node name for Chef...
==> target: Machine already provisioned. Run vagrant provision or use the --provision
==> target: flag to force provisioning. Provisioners marked to run always will still run.
==> target-centos6: Box 'bento/centos-6' could not be found. Attempting to find and install...
target-centos6: Box Provider: virtualbox
target-centos6: Box Version: >= 0
==> target-centos6: Loading metadata for box 'bento/centos-6'
target-centos6: URL: https://vagrantcloud.com/bento/centos-6
==> target-centos6: Adding box 'bento/centos-6' (v202006.16.0) for provider: virtualbox
target-centos6: Downloading: https://vagrantcloud.com/bento/boxes/centos-6/versions/202006.16.0/providers/virtualbox.box
Download redirected to host: vagrantcloud-files-production.s3.amazonaws.com
==> target-centos6: Successfully added box 'bento/centos-6' (v202006.16.0) for 'virtualbox'!
==> target-centos6: Importing base box 'bento/centos-6'...
==> target-centos6: Matching MAC address for NAT networking...
==> target-centos6: Checking if box 'bento/centos-6' version '202006.16.0' is up to date...
==> target-centos6: Setting the name of the VM: target-centos6
==> target-centos6: Using hostname "target-centos6" as node name for Chef...
==> target-centos6: Fixed port collision for 22 => 2222. Now on port 2201.
==> target-centos6: Clearing any previously set network interfaces...
==> target-centos6: Preparing network interfaces based on configuration...
target-centos6: Adapter 1: nat
==> target-centos6: Forwarding ports...
target-centos6: 22 (guest) => 2201 (host) (adapter 1)
==> target-centos6: Running 'pre-boot' VM customizations...
==> target-centos6: Booting VM...
==> target-centos6: Waiting for machine to boot. This may take a few minutes...
target-centos6: SSH address: 127.0.0.1:2201
target-centos6: SSH username: vagrant
target-centos6: SSH auth method: private key
target-centos6:
target-centos6: Vagrant insecure key detected. Vagrant will automatically replace
target-centos6: this with a newly generated keypair for better security.
target-centos6:
target-centos6: Inserting generated public key within guest...
target-centos6: Removing insecure key from the guest if it's present...
target-centos6: Key inserted! Disconnecting and reconnecting using new SSH key...
==> target-centos6: Machine booted and ready!
==> target-centos6: Checking for guest additions in VM...
==> target-centos6: Setting hostname...
==> target-centos6: Mounting shared folders...
target-centos6: /vagrant => /Users/gregory.beck/Documents/GitHub/inspec_training_courses/InSpec-Developer-Course
target-centos6: /tmp/vagrant-chef/4f17fd4c6af7d2ffecb37037c911e433/cookbooks => /Users/gregory.beck/Documents/GitHub/inspec_training_courses/InSpec-Developer-Course/cookbooks
==> target-centos6: Running provisioner: chef_solo...
target-centos6: Installing Chef (latest)...
==> target-centos6: Generating chef JSON and uploading...
==> target-centos6: Running chef-solo...
==> target-centos6: Chef Infra Client cannot execute without accepting the license
Chef never successfully completed! Any errors should be visible in the
output above. Please fix your recipes so that they properly complete.
(base) ip-10-232-38-203:InSpec-Developer-Course gregory.beck$ vagrant ssh target
Welcome to Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-62-generic x86_64)

• Documentation: https://help.ubuntu.com
• Management: https://landscape.canonical.com
• Support: https://ubuntu.com/advantage
  vagrant@target:$ gem install chef
  -bash: gem: command not found
  vagrant@target:$ sudo gem install chef
  sudo: gem: command not found
  vagrant@target:$ set -o vi
  vagrant@target:$ sudo find / -name gem
  /opt/chef/embedded/bin/gem
  vagrant@target:$ /opt/chef/embedded/bin/gem install chef
  Fetching chef-16.2.50.gem
  ERROR: While executing gem ... (Gem::FilePermissionError)
  You don't have write permissions for the /opt/chef/embedded/lib/ruby/gems/2.7.0 directory.
  vagrant@target:$ sudo /opt/chef/embedded/bin/gem install chef
  Fetching chef-16.2.50.gem
  Successfully installed chef-16.2.50
  Parsing documentation for chef-16.2.50
  Installing ri documentation for chef-16.2.50
  Done installing documentation for chef after 24 seconds
  1 gem installed
  vagrant@target:~$ logout
  Connection to 127.0.0.1 closed.
  (base) ip-10-232-38-203:InSpec-Developer-Course gregory.beck$ vagrant ssh target-centos6

This system is built by the Bento project by Chef Software
More information can be found at https://github.com/chef/bento
[vagrant@target-centos6 ~]$ sudo /opt/chef/embedded/bin/gem install chef
Fetching chef-16.2.50.gem
Successfully installed chef-16.2.50
Parsing documentation for chef-16.2.50
Installing ri documentation for chef-16.2.50
Done installing documentation for chef after 24 seconds
1 gem installed

add note about `local` vs `remote` or target execution in controls

see: https://discourse.chef.io/t/assert-things-about-a-list-of-files/13116

update vagrant file to setup the sync'd folders

see:

• https://www.vagrantup.com/docs/synced-folders/virtualbox.html
• https://www.vagrantup.com/docs/synced-folders/basic_usage.html

Setup vagrantfile to update the VirtualBox shared network

Perhaps doing VirtualBox commands

https://www.vagrantup.com/docs/virtualbox/configuration.html#vboxmanage-customizations
https://www.virtualbox.org/manual/ch08.html#vboxmanage-modifyvm-networking