Project: Chef InSpec (Provisioning / Security & Compliance)
File: firewalld.md

+++ title = "firewalld resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "firewalld" identifier = "inspec/resources/os/firewalld.md firewalld resource" parent = "inspec/resources/os" +++ Use the `firewalld` Chef InSpec audit resource to test that firewalld is configured to allow and deny access to specific hosts, services and ports on a system. A firewalld has a number of zones that can be configured to allow and deny access to specific hosts, services, and ports. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.40.0 of InSpec. describe firewalld do it { should be_running } its('default_zone') { should eq 'public' } it { should haveserviceenabledinzone('ssh', 'public') } it { should haveruleenabled('family=ipv4 source address=192.168.0.14 accept', 'public') } end Use the where clause to test open interfaces, sources, and services that are in active zones. describe firewalld.where { zone == 'public' } do its('interfaces') { should cmp ['enp0s3', 'eno2'] } its('sources') { should cmp ['192.168.1.0/24', '192.168.1.2'] } its('services') { should cmp ['ssh', 'icmp'] } its('target') { should cmp ['default'] } end The `interfaces` property is used in conjunction with the where class to display open interfaces in an active zone. describe firewalld.where { zone == 'public' } do its('interfaces') { should cmp ['enp0s3', 'eno2'] } end The `sources` property is used in conjunction with the where class to display open sources in an active zone. describe firewalld.where { zone == 'public' } do its('sources') { should cmp ['192.168.1.0/24', '192.168.1.2'] } end The `services` property is used in conjunction with the where class to display open services in an active zone. describe firewalld.where { zone == 'public' } do its('services') { should cmp ['ssh', 'icmp'] } end The `target` property is used in conjunction with the where class to display the target action in an active zone. describe

{ zone == 'public' } do its('target') { should cmp ['default'] } # or ['DROP'], ['ACCEPT'], etc. end The `ports` property is used in conjunction with the where class to display the ports used by an active zone. describe firewalld.where { zone == 'public' } do its('ports') { should cmp ["80/tcp", "443/tcp"] } end The `protocols` property is used in conjunction with the where class to display the protocols used by an active zone. describe firewalld.where { zone == 'public' } do its('protocols') { should cmp ["icmp", "ipv4"] } end The `default_zone` property displays the default active zone to be used. its('default_zone') { should eq 'public' } {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `be_installed` matcher tests if the firewalld service is installed: it { should be_installed } The `be_running` matcher tests if the firewalld service is running: it { should be_running } `have_zone` returns true or false if the zone is set on firewalld. It does not mean the zone is active. it { should have_zone('public') } `haveserviceenabledinzone` returns true or false if the service is allowed in the specified zone. it { should haveserviceenabledinzone('ssh', 'public') } `haveportenabledinzone` returns true or false if the port is allowed in the specified zone. it { should haveportenabledinzone('22/tcp', 'public') } `haveruleenabled` returns true or false if the rich-rule has been specified in the zone. it { should haveruleenabled('family=ipv4 source address=192.168.0.14 accept', 'public') } It is not necessary to add the "rule" string, and you can start with the optional flags that are used in firewalld and end with the action. `haveicmpblockinversionenabled` returns true or false if ICMP block inversion flag is set for the indicated zone. it { should haveicmpblockinversionenabled } `havemasqueradeenabled` returns true or false if the masquerade flag is set for the indicated zone. it { should havemasqueradeenabled }