Ubuntu

.kitchen/logs/kitchen.log

@@ -0,0 +1,29 @@
+I, [2019-10-30T18:58:48.061421 #18752]  INFO -- Kitchen: -----> Starting Kitchen (v2.3.3)
+E, [2019-10-30T18:58:48.068346 #18752] ERROR -- Kitchen: ------Exception-------
+E, [2019-10-30T18:58:48.068479 #18752] ERROR -- Kitchen: Class: Kitchen::UserError
+E, [2019-10-30T18:58:48.068565 #18752] ERROR -- Kitchen: Message: Kitchen YAML file C:/Users/steve/workshops/kitchen.yml does not exist.
+E, [2019-10-30T18:58:48.068680 #18752] ERROR -- Kitchen: ----------------------
+E, [2019-10-30T18:58:48.068783 #18752] ERROR -- Kitchen: ------Backtrace-------
+E, [2019-10-30T18:58:48.068862 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/loader/yaml.rb:65:in `read'
+E, [2019-10-30T18:58:48.068922 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/config.rb:154:in `data'
+E, [2019-10-30T18:58:48.068983 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/config.rb:132:in `suites'
+E, [2019-10-30T18:58:48.069043 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/config.rb:184:in `filter_instances'
+E, [2019-10-30T18:58:48.069105 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/config.rb:143:in `build_instances'
+E, [2019-10-30T18:58:48.069206 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/config.rb:117:in `instances'
+E, [2019-10-30T18:58:48.069302 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/command.rb:112:in `filtered_instances'
+E, [2019-10-30T18:58:48.069399 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/command.rb:142:in `parse_subcommand'
+E, [2019-10-30T18:58:48.069538 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/command/action.rb:35:in `block in call'
+E, [2019-10-30T18:58:48.069632 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/2.6.0/benchmark.rb:293:in `measure'
+E, [2019-10-30T18:58:48.069731 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/command/action.rb:34:in `call'
+E, [2019-10-30T18:58:48.069829 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/cli.rb:52:in `perform'
+E, [2019-10-30T18:58:48.069919 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/cli.rb:198:in `block (2 levels) in <class:CLI>'
+E, [2019-10-30T18:58:48.070010 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor/command.rb:27:in `run'
+E, [2019-10-30T18:58:48.070097 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor/invocation.rb:126:in `invoke_command'
+E, [2019-10-30T18:58:48.070208 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor.rb:387:in `dispatch'
+E, [2019-10-30T18:58:48.070294 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/thor-0.20.3/lib/thor/base.rb:466:in `start'
+E, [2019-10-30T18:58:48.070372 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/bin/kitchen:13:in `block in <top (required)>'
+E, [2019-10-30T18:58:48.070449 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/lib/kitchen/errors.rb:171:in `with_friendly_errors'
+E, [2019-10-30T18:58:48.070508 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/embedded/lib/ruby/gems/2.6.0/gems/test-kitchen-2.3.3/bin/kitchen:13:in `<top (required)>'
+E, [2019-10-30T18:58:48.070645 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/bin/kitchen:372:in `load'
+E, [2019-10-30T18:58:48.070898 #18752] ERROR -- Kitchen: C:/opscode/chef-workstation/bin/kitchen:372:in `<main>'
+E, [2019-10-30T18:58:48.070957 #18752] ERROR -- Kitchen: ----End Backtrace-----

chef-pipeline/Jenkinsfile

@@ -0,0 +1,78 @@
+pipeline {
+  agent any
+  environment {
+    WORKSPACE = "/chef-repo/workspace/chef-pipeline"
+  }
+  stages {
+    stage('Checkout Workshop') {
+      steps {
+        git credentialsId: 'git-repo-creds', url: 'https://github.com/pocsteve/workshops.git'
+      }
+    }
+    stage('Lint Testing') {
+      parallel {
+        stage('Style Check') {
+          steps {
+            echo '*** cookstyle testing ***'
+            sh 'sudo cookstyle .'
+          }
+        }
+        stage('Food Critic') {
+          steps {
+            echo '*** foodcritic testing ***'
+            dir("$WORKSPACE/cookbooks") {
+                sh 'sudo foodcritic . -t ~FC078'
+            }
+          }
+        }
+      }
+    }
+    stage('Unit Testing') {
+      steps {
+        echo '*** Unit Testing ***'
+        dir("$WORKSPACE/cookbooks/tomcat") {
+          echo '*** tomcat ***'
+          sh 'sudo chef exec rspec spec/unit/recipes/default_spec.rb'
+        }
+        dir("$WORKSPACE/cookbooks/mongodb") {
+          echo '*** mongodb ***'
+          sh 'sudo chef exec rspec spec/unit/recipes/default_spec.rb'
+        }
+      }
+    }
+    stage('Functional Testing') {
+      steps {
+        dir("$WORKSPACE/cookbooks") {
+          echo '*** Building Policyfile ***'
+          sh 'sudo chef install ../policyfiles/workshop.rb'
+          echo '*** Running Test Kitchen ***'
+          sh 'sudo kitchen verify'
+          sh 'sudo kitchen converge'
+          sh 'sudo kitchen verify'
+        }
+      }
+    }
+    stage('Upload to Chef Server') {
+      steps {
+        dir("$WORKSPACE/policyfiles") {
+          echo '*** Uploading Policy to Chef Server ***'
+          sh 'sudo chef push sandbox workshop.lock.json'
+        }
+      }
+    }
+  }
+  post {
+    success {
+      echo 'The build was successful. Policy pushed to Chef Server'
+    }
+    failure {
+      echo "The build failed"
+    }
+    always {
+      dir("$WORKSPACE/cookbooks") {
+        sh 'sudo kitchen destroy'
+      }
+      cleanWs()
+    }
+  }
+}

cookbooks/.kitchen/logs/default-centos-7.log

@@ -0,0 +1,5 @@
+I, [2019-10-31T13:57:52.841218 #5288]  INFO -- default-centos-7: -----> Destroying <default-centos-7>...
+I, [2019-10-31T13:58:00.624874 #5288]  INFO -- default-centos-7: ==> default: Forcing shutdown of VM...
+I, [2019-10-31T13:58:01.979216 #5288]  INFO -- default-centos-7: ==> default: Destroying VM and associated drives...
+I, [2019-10-31T13:58:02.368688 #5288]  INFO -- default-centos-7: Vagrant instance <default-centos-7> destroyed.
+I, [2019-10-31T13:58:02.392266 #5288]  INFO -- default-centos-7: Finished destroying <default-centos-7> (0m9.53s).

cookbooks/centos7/.delivery/project.toml

@@ -0,0 +1,32 @@
+# Delivery for Local Phases Execution
+#
+# This file allows you to execute test phases locally on a workstation or
+# in a CI pipeline. The delivery-cli will read this file and execute the
+# command(s) that are configured for each phase. You can customize them
+# by just modifying the phase key on this file.
+#
+# By default these phases are configured for Cookbook Workflow only
+#
+
+[local_phases]
+unit = "chef exec rspec spec/"
+lint = "chef exec cookstyle"
+# foodcritic has been deprecated in favor of cookstyle so we skip the syntax
+# phase now.
+syntax = "echo skipping syntax phase. Use lint phase instead."
+provision = "chef exec kitchen create"
+deploy = "chef exec kitchen converge"
+smoke = "chef exec kitchen verify"
+# The functional phase is optional, you can define it by uncommenting
+# the line below and running the command: `delivery local functional`
+# functional = ""
+cleanup = "chef exec kitchen destroy"
+
+# Remote project.toml file
+#
+# Instead of the local phases above, you may specify a remote URI location for
+# the `project.toml` file. This is useful for teams that wish to centrally
+# manage the behavior of the `delivery local` command across many different
+# projects.
+#
+# remote_file = "https://url/project.toml"

cookbooks/centos7/.gitignore

@@ -0,0 +1,22 @@
+.vagrant
+*~
+*#
+.#*
+\#*#
+.*.sw[a-z]
+*.un~
+
+# Bundler
+Gemfile.lock
+gems.locked
+bin/*
+.bundle/*
+
+# test kitchen
+.kitchen/
+kitchen.local.yml
+
+# Chef
+Berksfile.lock
+.zero-knife.rb
+Policyfile.lock.json

cookbooks/centos7/CHANGELOG.md

@@ -0,0 +1,11 @@
+# centos7 CHANGELOG
+
+This file is used to list changes made in each version of the centos7 cookbook.
+
+# 0.1.0
+
+Initial release.
+
+- change 0
+- change 1
+

cookbooks/centos7/LICENSE

@@ -0,0 +1,3 @@
+Copyright 2019 The Authors
+
+All rights reserved, do not redistribute.

cookbooks/centos7/README.md

@@ -0,0 +1,9 @@
+# centos7
+
+This cookbook is currently a WIP (to be expanded with additional security and standard configurations) that is being used to demo the Detect and Correct Pattern.  The 'Detect' part is handled by the Inspec profile 'my-centos' which has been uploaded to a demo A2 server.  
+
+Detect and Correct Steps:
+1: Create a new Scan Job in A2 using the my-centos profile on a bootstrapped node to identify what is not in compliance
+2: Run Chef-Client on the bootstrapped node with this cookbook in it's runlist
+3: Create another Scan Job in A2 to verify the previously identified non-compliance items have been corrected
+

cookbooks/centos7/attributes/default.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+default['audit']['fetcher'] = 'chef-server'
+default['audit']['reporter'] = 'chef-server-automate'
+# default['audit']['profiles']['cis-centos7-level1-server'] = { compliance: 'admin/cis-centos7-level1-server' }
+default['audit']['profiles']['my-centos'] = { compliance: 'admin/my-centos' }
+
+# default['audit']['profiles'] = [
+#   {
+#     name: 'CIS CentOS Linux 7 Benchmark Level 1 - Server',
+#     compliance: 'admin/cis-centos7-level1-server',
+#   },
+# ]

cookbooks/centos7/chefignore

@@ -0,0 +1,110 @@
+# Put files/directories that should be ignored in this file when uploading
+# to a Chef Infra Server or Supermarket.
+# Lines that start with '# ' are comments.
+
+# OS generated files #
+######################
+.DS_Store
+ehthumbs.db
+Icon?
+nohup.out
+Thumbs.db
+
+# SASS #
+########
+.sass-cache
+
+# EDITORS #
+###########
+.#*
+.project
+.settings
+*_flymake
+*_flymake.*
+*.bak
+*.sw[a-z]
+*.tmproj
+*~
+\#*
+mkmf.log
+REVISION
+TAGS*
+tmtags
+
+## COMPILED ##
+##############
+*.class
+*.com
+*.dll
+*.exe
+*.o
+*.pyc
+*.so
+*/rdoc/
+a.out
+
+# Testing #
+###########
+.circleci/*
+.codeclimate.yml
+.foodcritic
+.kitchen*
+.rspec
+.rubocop.yml
+.travis.yml
+.watchr
+azure-pipelines.yml
+examples/*
+features/*
+Guardfile
+kitchen.yml*
+Procfile
+Rakefile
+spec/*
+spec/*
+spec/fixtures/*
+test/*
+
+# SCM #
+#######
+.git
+.gitattributes
+.gitconfig
+.github/*
+.gitignore
+.gitmodules
+.svn
+*/.bzr/*
+*/.git
+*/.hg/*
+*/.svn/*
+
+# Berkshelf #
+#############
+Berksfile
+Berksfile.lock
+cookbooks/*
+tmp
+
+# Bundler #
+###########
+vendor/*
+Gemfile
+Gemfile.lock
+
+# Policyfile #
+##############
+Policyfile.rb
+Policyfile.lock.json
+
+# Cookbooks #
+#############
+CHANGELOG*
+CONTRIBUTING*
+TESTING*
+CODE_OF_CONDUCT*
+
+# Vagrant #
+###########
+.vagrant
+Vagrantfile

cookbooks/centos7/kitchen.yml

@@ -0,0 +1,38 @@
+---
+driver:
+  name: vagrant
+
+## The forwarded_port port feature lets you connect to ports on the VM guest via
+## localhost on the host.
+## see also: https://www.vagrantup.com/docs/networking/forwarded_ports.html
+
+#  network:
+#    - ["forwarded_port", {guest: 80, host: 8080}]
+
+provisioner:
+  name: chef_zero
+  # always_update_cookbooks: true
+  # client_rb:
+  #   data_collector.server_url: 'https://192.168.59.199/data-collector/v0/'
+  #   data_collector.token: 'OI36GCZlPuvhmVermEDYUfhRtN8='
+  #   verify_api_cert: false
+  #   ssl_verify_mode: :verify_none
+
+
+  ## product_name and product_version specifies a specific Chef product and version to install.
+  ## see the Chef documentation for more details: https://docs.chef.io/config_yml_kitchen.html
+  #  product_name: chef
+  #  product_version: 15
+
+verifier:
+  name: inspec
+
+platforms:
+  - name: centos-7
+
+suites:
+  - name: default
+    verifier:
+      inspec_tests:
+        - test/integration/default
+    attributes:

cookbooks/centos7/metadata.rb

@@ -0,0 +1,16 @@
+name 'centos7'
+maintainer 'Steve Fraser'
+maintainer_email 'sfraser@chef.io'
+license 'All Rights Reserved'
+description 'Configures standard centos7 security settings'
+version '0.4.3'
+chef_version '>= 14.0'
+
+depends 'audit'
+
+%w( redhat centos ).each do |os|
+  supports os
+end
+
+issues_url 'https://github.com/pocsteve/workshops/issues_url'
+source_url 'https://github.com/pocsteve/workshops'

cookbooks/centos7/policyfile.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# Policyfile.rb - Describe how you want Chef Infra Client to build your system.
+#
+# For more information on the Policyfile feature, visit
+# https://docs.chef.io/policyfile.html
+
+# A name that describes what the system you're building with Chef does.
+name 'centos7'
+
+# Where to find external cookbooks:
+default_source :supermarket
+
+# run_list: chef-client will run these recipes in the order specified.
+run_list 'centos7::default'
+
+# Specify a custom source for a single cookbook:
+cookbook 'centos7', path: '.'