69 lines
1.2 KiB
YAML
69 lines
1.2 KiB
YAML
|
# Goss baseline assertions for railiance managed nodes
|
||
|
|
# Derived from spec/server-baseline.yaml — keep in sync.
|
||
|
|
# Run: goss -g /etc/goss/baseline.yaml validate
|
||
|
|
|
||
|
|
package:
|
||
|
|
ufw:
|
||
|
|
installed: true
|
||
|
|
fail2ban:
|
||
|
|
installed: true
|
||
|
|
git:
|
||
|
|
installed: true
|
||
|
|
curl:
|
||
|
|
installed: true
|
||
|
|
vim:
|
||
|
|
installed: true
|
||
|
|
htop:
|
||
|
|
installed: true
|
||
|
|
age:
|
||
|
|
installed: true
|
||
|
|
sops:
|
||
|
|
installed: true
|
||
|
|
|
||
|
|
service:
|
||
|
|
ufw:
|
||
|
|
enabled: true
|
||
|
|
running: true
|
||
|
|
fail2ban:
|
||
|
|
enabled: true
|
||
|
|
running: true
|
||
|
|
ssh:
|
||
|
|
enabled: true
|
||
|
|
running: true
|
||
|
|
|
||
|
|
file:
|
||
|
|
/etc/ssh/sshd_config:
|
||
|
|
exists: true
|
||
|
|
contains:
|
||
|
|
- /^PermitRootLogin no/i
|
||
|
|
- /^PasswordAuthentication no/i
|
||
|
|
- /^PubkeyAuthentication yes/i
|
||
|
|
|
||
|
|
user:
|
||
|
|
admin:
|
||
|
|
exists: true
|
||
|
|
groups:
|
||
|
|
- sudo
|
||
|
|
shell: /bin/bash
|
||
|
|
|
||
|
|
command:
|
||
|
|
"ufw status":
|
||
|
|
exit-status: 0
|
||
|
|
stdout:
|
||
|
|
- "Status: active"
|
||
|
|
- /22\/tcp.*ALLOW/
|
||
|
|
- /6443\/tcp.*ALLOW/
|
||
|
|
- /8472\/udp.*ALLOW/
|
||
|
|
"grep NOPASSWD /etc/sudoers.d/admin":
|
||
|
|
exit-status: 0
|
||
|
|
stdout:
|
||
|
|
- "NOPASSWD"
|
||
|
|
"grep -r HISTCONTROL /etc/profile.d/":
|
||
|
|
exit-status: 0
|
||
|
|
stdout:
|
||
|
|
- "ignorespace"
|
||
|
|
"fail2ban-client status sshd":
|
||
|
|
exit-status: 0
|
||
|
|
stdout:
|
||
|
|
- "Status for the jail: sshd"
|