44 lines
1.4 KiB
Ruby
44 lines
1.4 KiB
Ruby
# Chef InSpec test for recipe kosmos-ejabberd::default
|
|
|
|
# The Chef InSpec reference, with examples and extensive documentation, can be
|
|
# found at https://docs.chef.io/inspec/resources/
|
|
|
|
describe package('ejabberd') do
|
|
it { should be_installed }
|
|
end
|
|
|
|
describe service('ejabberd') do
|
|
it { should be_enabled }
|
|
it { should be_running }
|
|
end
|
|
|
|
describe port(5222) do
|
|
it { should be_listening }
|
|
end
|
|
|
|
describe port(5269) do
|
|
it { should be_listening }
|
|
end
|
|
|
|
describe file('/opt/ejabberd/conf/ejabberd.yml') do
|
|
it { should exist }
|
|
its('mode') { should cmp '0640' }
|
|
|
|
# BOSH and S2S are intentionally enabled and are fixed in 26.09. They must
|
|
# keep working, so guard the handlers against accidental removal.
|
|
its('content') { should match(/mod_bosh:/) }
|
|
its('content') { should match(%r{"/bosh": mod_bosh}) }
|
|
its('content') { should match(/ejabberd_s2s_in/) }
|
|
|
|
# Regression guard for the unauthenticated RCE fixed in 26.09: mod_adhoc_api
|
|
# is one of the exploit prerequisites and must never be enabled.
|
|
its('content') { should_not match(/mod_adhoc_api:/) }
|
|
|
|
# mod_muc_occupantid was merged into mod_muc in 26.02 and the standalone
|
|
# module removed, so it must not be configured anymore.
|
|
its('content') { should_not match(/mod_muc_occupantid:/) }
|
|
|
|
# the listen option 'captcha' was deprecated in 26.09
|
|
its('content') { should_not match(/^\s*captcha:/) }
|
|
end
|