######################################################################## | |||||
# File managed by Salt at <{{ source }}>. | |||||
# Your changes will be overwritten. | |||||
######################################################################## | |||||
<Location "/server-status"> | <Location "/server-status"> | ||||
SetHandler server-status | SetHandler server-status | ||||
{%- if apache.version == '2.4' %} | {%- if apache.version == '2.4' %} |
- module: apache-reload | - module: apache-reload | ||||
- service: apache | - service: apache | ||||
{% if grains['os_family']=="Debian" %} | |||||
a2endisconf server-status: | |||||
{%- if grains['os_family'] == "Debian" %} | |||||
a2enconf server-status: | |||||
cmd.run: | cmd.run: | ||||
{% if apache.get('server_status_require') is defined %} | |||||
- name: a2enconf server-status | |||||
- unless: test -L /etc/apache2/conf-enabled/server-status.conf | |||||
{% else %} | |||||
- name: a2disconf server-status | |||||
- onlyif: test -L /etc/apache2/conf-enabled/server-status.conf | |||||
{% endif %} | |||||
- unless: 'test -L /etc/apache2/conf-enabled/server-status.conf' | |||||
- order: 225 | - order: 225 | ||||
- require: | - require: | ||||
- pkg: apache | - pkg: apache |
base: | base: | ||||
'*': | '*': | ||||
- apache | - apache | ||||
- apache.mod_security | |||||
- apache.config | |||||
pillars: | pillars: | ||||
top.sls: | top.sls: | ||||
base: | base: | ||||
verifier: | verifier: | ||||
inspec_tests: | inspec_tests: | ||||
- path: test/integration/default | - path: test/integration/default | ||||
- name: modules | |||||
provisioner: | |||||
state_top: | |||||
base: | |||||
'*': | |||||
- apache | |||||
- apache.mod_security | |||||
- apache.server_status | |||||
pillars: | |||||
top.sls: | |||||
base: | |||||
'*': | |||||
- apache | |||||
pillars_from_files: | |||||
apache.sls: test/salt/pillar/modules.sls | |||||
verifier: | |||||
inspec_tests: | |||||
- path: test/integration/modules |
control 'apache configuration' do | control 'apache configuration' do | ||||
title 'should match desired lines' | title 'should match desired lines' | ||||
describe file('/etc/apache2/apache2.conf') do | |||||
config_file = | |||||
case platform[:family] | |||||
when 'debian' | |||||
'/etc/apache2/apache2.conf' | |||||
when 'redhat', 'fedora' | |||||
'/etc/httpd/conf/httpd.conf' | |||||
when 'suse' | |||||
'/etc/apache2/httpd.conf' | |||||
# `linux` here is sufficient for `arch` | |||||
when 'linux' | |||||
'/etc/httpd/conf/httpd.conf' | |||||
end | |||||
describe file(config_file) do | |||||
it { should be_file } | it { should be_file } | ||||
it { should be_owned_by 'root' } | it { should be_owned_by 'root' } | ||||
it { should be_grouped_into 'root' } | it { should be_grouped_into 'root' } | ||||
end | end | ||||
end | end | ||||
end | end | ||||
control 'apache configuration' do | |||||
title 'should be valid' | |||||
describe command('apachectl -t') do | |||||
its('stdout') { should eq '' } | |||||
its('stderr') { should include 'Syntax OK' } | |||||
its('exit_status') { should eq 0 } | |||||
end | |||||
end |
# frozen_string_literal: true | # frozen_string_literal: true | ||||
# Overide by OS | |||||
package_name = 'bash' | |||||
package_name = 'cronie' if (os[:name] == 'centos') && os[:release].start_with?('6') | |||||
control 'apache package' do | control 'apache package' do | ||||
title 'should be installed' | title 'should be installed' | ||||
package_name = | package_name = | ||||
case platform[:family] | case platform[:family] | ||||
when 'debian', 'suse' | when 'debian', 'suse' | ||||
'apache2' | |||||
'apache2' | |||||
when 'redhat', 'fedora' | when 'redhat', 'fedora' | ||||
'httpd' | |||||
when 'arch' | |||||
'apache' | |||||
'httpd' | |||||
# `linux` here is sufficient for `arch` | |||||
when 'linux' | |||||
'apache' | |||||
end | end | ||||
describe package(package_name) do | describe package(package_name) do |
# frozen_string_literal: true | # frozen_string_literal: true | ||||
# Overide by OS | |||||
service_name = 'apache2' | |||||
service_name = 'httpd' if (os[:name] == 'centos') | |||||
control 'apache service' do | control 'apache service' do | ||||
impact 0.5 | impact 0.5 | ||||
title 'should be running and enabled' | title 'should be running and enabled' | ||||
service_name = | |||||
case platform[:family] | |||||
when 'debian', 'suse' | |||||
'apache2' | |||||
when 'redhat', 'fedora', 'linux' | |||||
'httpd' | |||||
end | |||||
describe service(service_name) do | describe service(service_name) do | ||||
it { should be_enabled } | it { should be_enabled } | ||||
it { should be_running } | it { should be_running } |
'/etc/httpd/conf.d/mod_security.conf' | '/etc/httpd/conf.d/mod_security.conf' | ||||
when 'debian' | when 'debian' | ||||
'/etc/modsecurity/modsecurity.conf-recommended' | '/etc/modsecurity/modsecurity.conf-recommended' | ||||
when 'suse' | |||||
'/etc/apache2/conf.d/mod_security2.conf' | |||||
end | end | ||||
describe file(modspec_file) do | describe file(modspec_file) do |
package_name = | package_name = | ||||
case platform[:family] | case platform[:family] | ||||
when 'debian', 'suse' | |||||
'libapache2-mod-security2' | |||||
when 'debian' | |||||
'libapache2-mod-security2' | |||||
when 'redhat', 'fedora' | when 'redhat', 'fedora' | ||||
'mod_security' | |||||
'mod_security' | |||||
when 'suse' | when 'suse' | ||||
'apache2-mod_security2' | |||||
'apache2-mod_security2' | |||||
end | end | ||||
describe package(package_name) do | describe package(package_name) do |
control 'apache server_status configuration' do | control 'apache server_status configuration' do | ||||
title 'should match desired lines' | title 'should match desired lines' | ||||
server_status_stanza = <<-SS_STANZA | |||||
<Location "/server-status"> | |||||
SetHandler server-status | |||||
Require local | |||||
Require host foo.example.com | |||||
Require ip 10.8.8.0/24 | |||||
</Location> | |||||
SS_STANZA | |||||
server_status_stanza = <<~SS_STANZA | |||||
<Location "/server-status"> | |||||
SetHandler server-status | |||||
Require local | |||||
Require host foo.example.com | |||||
Require ip 10.8.8.0/24 | |||||
</Location> | |||||
SS_STANZA | |||||
confdir = | confdir = | ||||
case platform[:family] | case platform[:family] | ||||
'/etc/httpd/conf.d' | '/etc/httpd/conf.d' | ||||
when 'suse' | when 'suse' | ||||
'/etc/apache2/conf.d' | '/etc/apache2/conf.d' | ||||
when 'arch' | |||||
# `linux` here is sufficient for `arch` | |||||
when 'linux' | |||||
'/etc/httpd/conf/extra' | '/etc/httpd/conf/extra' | ||||
end | end | ||||
# frozen_string_literal: true | # frozen_string_literal: true | ||||
# Overide by OS | |||||
service_name = 'apache2' | |||||
service_name = 'httpd' if (os[:name] == 'centos') | |||||
control 'apache service' do | control 'apache service' do | ||||
impact 0.5 | impact 0.5 | ||||
title 'should be running and enabled' | title 'should be running and enabled' | ||||
service_name = | |||||
case platform[:family] | |||||
when 'debian', 'suse' | |||||
'apache2' | |||||
when 'redhat', 'fedora', 'linux' | |||||
'httpd' | |||||
end | |||||
describe service(service_name) do | describe service(service_name) do | ||||
it { should be_enabled } | it { should be_enabled } | ||||
it { should_not be_running } | it { should_not be_running } |