Add Support for Extra Configuration Options #173

bdwyertech · 2017-03-31T05:32:43Z

Add support for extra configuration options at the end of the config files for override support.

This assists with the flexibility issue discussed in #89

# => Example Extra Crap
default['ssh-hardening']['ssh']['server']['extras'].tap do |extra|
  extra['#Some Comment'] = 'Heres the Comment'
  extra['AuthenticationMethods'] =  'publickey,keyboard-interactive'
end

The block syntax swap is somewhat opinionated, but is more readable for long hash's

coveralls · 2017-03-31T05:43:25Z

Coverage remained the same at 100.0% when pulling 917c9a3 on bdwyertech:extras into d4dc236 on dev-sec:master.

artem-sidorenko

@bdwyertech thanks for this PR! It makes definitely sense, open points from my POV:

Documentation in README.md
Tests - if something is configured and not, please see Tests for GH-131 and GH-132 #155 if you want an example
See the suggestions on the implementation in the template and attributes, this would allow to have such tests

artem-sidorenko · 2017-03-31T07:07:18Z

attributes/default.rb

@@ -1,4 +1,5 @@
 # encoding: utf-8
+# rubocop: disable BlockLength


Can we have it for a particular block and not for the entire file?

Yeah, I can swap that to just cover the two blocks

artem-sidorenko · 2017-03-31T07:07:34Z

attributes/default.rb

-# http://undeadly.org/cgi?action=article&sid=20160114142733
-default['ssh-hardening']['ssh']['client']['roaming']       = false
-default['ssh-hardening']['ssh']['client']['send_env']      = ['LANG', 'LC_*', 'LANGUAGE']
+default['ssh-hardening']['ssh']['client'].tap do |client|


.tap is a cool idea and improvement :-)

artem-sidorenko · 2017-03-31T07:10:39Z

attributes/default.rb

+  client['send_env']      = ['LANG', 'LC_*', 'LANGUAGE']
+
+  # Extra Client Configuration Options
+  client['extras'].tap do |extra|


I think we should have this in the documentation (and maybe add an example chapter/code 'how to add extra options'). As we do not use/fill it with defaults, I would expect to have only client['extras'] = {} here

artem-sidorenko · 2017-03-31T07:49:45Z

templates/default/openssh.conf.erb

@@ -117,3 +117,8 @@ UseRoaming <%= @node['ssh-hardening']['ssh']['client']['roaming'] ? 'yes' : 'no'
 # Send locale environment variables
 SendEnv <%= @node['ssh-hardening']['ssh']['client']['send_env'].join(' ') %>
 <% end %>
+
+# Extra Configuration Options


Maybe we should do here something like

<% if @node['ssh-hardening']['ssh']['client']['extras'].empty? %> # Extra Configuration Options <%- @node['ssh-hardening']['ssh']['client']['extras'].each do |key, value| %> <%= key %> <%= value %> <% end -%> <% end -%>

This would allow us two tests:

Test if something configured - additional option will be added and '# Extra Configuration Options' is included in the file

Test if nothing is configured - there should be no '# Extra Configuration Options' in the file

coveralls · 2017-03-31T13:48:33Z

Coverage remained the same at 100.0% when pulling 741635f on bdwyertech:extras into d4dc236 on dev-sec:master.

bdwyertech · 2017-03-31T13:54:47Z

Should be good to go @artem-sidorenko

I am traveling and having trouble getting the coveralls gem to install, but here is what I think a test might look like:

  context 'without custom extraconfig value' do
    cached(:chef_run) do
      ChefSpec::ServerRunner.new do |node|
        node.normal['ssh-hardening']['ssh']['server']['extras'] = {}
      end.converge(described_recipe)
    end

    it 'does not have any extraconfig options' do
      expect(chef_run).to render_file('/etc/ssh/sshd_config').
        without_content(/^# Extra Configuration Options/)
    end
  end

  context 'with custom extraconfig value' do
    cached(:chef_run) do
      ChefSpec::ServerRunner.new do |node|
        node.normal['ssh-hardening']['ssh']['server']['extras']['#ExtraConfig'] = 'Value'
      end.converge(described_recipe)
    end

    it 'uses the extraconfig attributes' do
      expect(chef_run).to render_file('/etc/ssh/sshd_config').
        with_content(/^# Extra Configuration Options/).
        with_content(/^#ExtraConfig Value/)
    end
  end

coveralls · 2017-03-31T13:58:11Z

Coverage remained the same at 100.0% when pulling e65f964 on bdwyertech:extras into d4dc236 on dev-sec:master.

coveralls · 2017-03-31T14:03:34Z

Coverage remained the same at 100.0% when pulling e65f964 on bdwyertech:extras into d4dc236 on dev-sec:master.

artem-sidorenko · 2017-03-31T18:14:53Z

attributes/default.rb

+  client['send_env']      = ['LANG', 'LC_*', 'LANGUAGE']
+
+  # extra client configuration options
+  client['extras'].tap    = {}


@bdwyertech .tap ;-)

artem-sidorenko · 2017-03-31T18:15:35Z

templates/default/openssh.conf.erb

@@ -117,3 +117,10 @@ UseRoaming <%= @node['ssh-hardening']['ssh']['client']['roaming'] ? 'yes' : 'no'
 # Send locale environment variables
 SendEnv <%= @node['ssh-hardening']['ssh']['client']['send_env'].join(' ') %>
 <% end %>
+
+<%- unless Array(@node['ssh-hardening']['ssh']['client']['extras']).empty? %>


@bdwyertech you don't have to use Array(), the value is defined as Hash in the default attributes. You can do unless @node[...].empty?

artem-sidorenko · 2017-03-31T18:24:46Z

@bdwyertech looks great, some suggestions:

  describe 'extra configuration values' do # <---- describe would be a cool container here

  context 'without custom extra config value' do
    cached(:chef_run) do
      ChefSpec::ServerRunner.new.converge(described_recipe) # <----- you can work with defaults here
    end

    it 'does not have any extra config options' do
      expect(chef_run).to render_file('/etc/ssh/sshd_config').
        without_content(/^# Extra Configuration Options/)
    end
  end

  context 'with custom extra config value' do
    cached(:chef_run) do
      ChefSpec::ServerRunner.new do |node|
        node.normal['ssh-hardening']['ssh']['server']['extras']['#ExtraConfig'] = 'Value'
      end.converge(described_recipe)
    end

    it 'uses the extra config attributes' do
      expect(chef_run).to render_file('/etc/ssh/sshd_config').with_content(/^# Extra Configuration Options/)
      expect(chef_run).to render_file('/etc/ssh/sshd_config').with_content(/^#ExtraConfig Value/) # <----- as far I remember chefspec has some problems with chained matchers (`.with_content.with_content`), so its better to have two expects
    end
  end

  end

coveralls · 2017-04-06T19:49:15Z

Coverage remained the same at 100.0% when pulling 1de5714 on bdwyertech:extras into d4dc236 on dev-sec:master.

bdwyertech · 2017-04-06T19:49:53Z

Should be good to go @artem-sidorenko

Thanks for the lesson in ChefSpec! Right now I'm only using Inspec

coveralls · 2017-04-06T20:03:44Z

Coverage remained the same at 100.0% when pulling d8cd272 on bdwyertech:extras into d4dc236 on dev-sec:master.

coveralls · 2017-04-06T20:09:16Z

Coverage remained the same at 100.0% when pulling d8cd272 on bdwyertech:extras into d4dc236 on dev-sec:master.

artem-sidorenko · 2017-04-07T07:22:50Z

README.md

@@ -124,6 +124,24 @@ Configure attributes:

 This will enable the SFTP Server and chroot every user in the `sftpusers` group to the `/home/sftp/%u` directory.

+## Extra Configuration Options


@bdwyertech cool, thanks for adding this to the docs. Can you please add something like

.... * `['ssh-hardening']['ssh']['server']['extras']` - `{}`. Add extra configuration options, see [below](#extra-configuration-options) for details .... * `['ssh-hardening']['ssh']['client']['extras']` - `{}`. Add extra configuration options, see [below](#extra-configuration-options) for details

to the attribute documentation above?

Can you do me a favor and cleanup a commit history by squashing the commits?

Then we can merge it :-)

artem-sidorenko · 2017-04-07T12:53:44Z

@atomic111 any remarks?

…ith block syntax Signed-off-by: Brian Dwyer <[email protected]>

bdwyertech · 2017-04-07T15:17:33Z

Alrighty @artem-sidorenko , I think it's finally good!

coveralls · 2017-04-07T15:19:56Z

Coverage remained the same at 100.0% when pulling 17194d7 on bdwyertech:extras into d4dc236 on dev-sec:master.

artem-sidorenko

@bdwyertech many thanks for very good collaboration! :)

@atomic111 LGTM

coveralls · 2017-04-07T15:31:32Z

Coverage remained the same at 100.0% when pulling 925f81e on bdwyertech:extras into d4dc236 on dev-sec:master.

atomic111

great, thanks for adding the extra config attribute

artem-sidorenko requested changes Mar 31, 2017

View reviewed changes

bdwyertech force-pushed the extras branch 2 times, most recently from 741635f to 71e661c Compare March 31, 2017 13:46

artem-sidorenko requested changes Mar 31, 2017

View reviewed changes

bdwyertech force-pushed the extras branch from 1de5714 to f055cbf Compare April 6, 2017 19:47

bdwyertech force-pushed the extras branch from f055cbf to d8cd272 Compare April 6, 2017 19:51

artem-sidorenko mentioned this pull request Apr 7, 2017

Authorized keys custom path #172

Merged

artem-sidorenko reviewed Apr 7, 2017

View reviewed changes

bdwyertech force-pushed the extras branch from d8cd272 to 17194d7 Compare April 7, 2017 15:07

Add support for extra configuration options and improve readability w…

925f81e

…ith block syntax Signed-off-by: Brian Dwyer <[email protected]>

bdwyertech force-pushed the extras branch from 17194d7 to 925f81e Compare April 7, 2017 15:16

artem-sidorenko approved these changes Apr 7, 2017

View reviewed changes

atomic111 approved these changes Apr 10, 2017

View reviewed changes

atomic111 merged commit eaf6c11 into dev-sec:master Apr 10, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Support for Extra Configuration Options #173

Add Support for Extra Configuration Options #173

bdwyertech commented Mar 31, 2017 •

edited

Loading

coveralls commented Mar 31, 2017

artem-sidorenko left a comment

artem-sidorenko Mar 31, 2017

bdwyertech Mar 31, 2017

artem-sidorenko Mar 31, 2017

artem-sidorenko Mar 31, 2017

artem-sidorenko Mar 31, 2017

coveralls commented Mar 31, 2017

bdwyertech commented Mar 31, 2017 •

edited

Loading

coveralls commented Mar 31, 2017

coveralls commented Mar 31, 2017

artem-sidorenko Mar 31, 2017 •

edited

Loading

artem-sidorenko Mar 31, 2017

artem-sidorenko commented Mar 31, 2017

coveralls commented Apr 6, 2017

bdwyertech commented Apr 6, 2017

coveralls commented Apr 6, 2017

coveralls commented Apr 6, 2017

artem-sidorenko Apr 7, 2017

artem-sidorenko commented Apr 7, 2017

bdwyertech commented Apr 7, 2017

coveralls commented Apr 7, 2017

artem-sidorenko left a comment

coveralls commented Apr 7, 2017

atomic111 left a comment

		@@ -1,4 +1,5 @@
		# encoding: utf-8
		# rubocop: disable BlockLength

		@@ -124,6 +124,24 @@ Configure attributes:

		This will enable the SFTP Server and chroot every user in the `sftpusers` group to the `/home/sftp/%u` directory.

		## Extra Configuration Options

Add Support for Extra Configuration Options #173

Add Support for Extra Configuration Options #173

Conversation

bdwyertech commented Mar 31, 2017 • edited Loading

coveralls commented Mar 31, 2017

artem-sidorenko left a comment

Choose a reason for hiding this comment

artem-sidorenko Mar 31, 2017

Choose a reason for hiding this comment

bdwyertech Mar 31, 2017

Choose a reason for hiding this comment

artem-sidorenko Mar 31, 2017

Choose a reason for hiding this comment

artem-sidorenko Mar 31, 2017

Choose a reason for hiding this comment

artem-sidorenko Mar 31, 2017

Choose a reason for hiding this comment

coveralls commented Mar 31, 2017

bdwyertech commented Mar 31, 2017 • edited Loading

coveralls commented Mar 31, 2017

coveralls commented Mar 31, 2017

artem-sidorenko Mar 31, 2017 • edited Loading

Choose a reason for hiding this comment

artem-sidorenko Mar 31, 2017

Choose a reason for hiding this comment

artem-sidorenko commented Mar 31, 2017

coveralls commented Apr 6, 2017

bdwyertech commented Apr 6, 2017

coveralls commented Apr 6, 2017

coveralls commented Apr 6, 2017

artem-sidorenko Apr 7, 2017

Choose a reason for hiding this comment

artem-sidorenko commented Apr 7, 2017

bdwyertech commented Apr 7, 2017

coveralls commented Apr 7, 2017

artem-sidorenko left a comment

Choose a reason for hiding this comment

coveralls commented Apr 7, 2017

atomic111 left a comment

Choose a reason for hiding this comment

bdwyertech commented Mar 31, 2017 •

edited

Loading

bdwyertech commented Mar 31, 2017 •

edited

Loading

artem-sidorenko Mar 31, 2017 •

edited

Loading