Project: Chef InSpec (Provisioning / Security & Compliance)
File: iis_site.md

+++ title = "iis_site resource" draft = false gh_repo = "inspec" platform = "windows" [menu] [menu.inspec] title = "iis_site" identifier = "inspec/resources/os/iissite.md iissite resource" parent = "inspec/resources/os" +++ Use the `iis_site` Chef InSpec audit resource to test the state of IIS on Windows Server 2012 (and later). {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v1.0.0 of InSpec. An `iis_site` resource block declares details about the named site: describe iissite('sitename') do it { should exist } it { should be_running } it { should haveapppool('apppoolname') } it { should havebinding('bindingdetails') } it { should havepath('pathto_site') } end where `'site_name'` is the name of the site, such as `'Default Web Site'` `('apppoolname')` is the name of the application pool in which the site's root application is run, such as `'DefaultAppPool'` `('bindingdetails')` is a binding for the site, such as `'net.pipe *'`. A site may have multiple bindings; therefore, use a `havebinding` matcher for each site binding to be tested `('pathtosite')` is the path to the site, such as `'C:\\inetpub\\wwwroot'` For example: describe iis_site('Default Web Site') do it { should exist } it { should be_running } it { should haveapppool('DefaultAppPool') } it { should have_binding('https :443:www.contoso.com sslFlags=0') } it { should have_binding('net.pipe *') } it { should have_path('C:\\inetpub\\wwwroot') } end app_pool, bindings, path, state The following examples show how to use this Chef InSpec audit resource. describe iis_site('Default Web Site') do it { should exist } it { should be_running } it { should haveapppool('DefaultAppPool') } it { should have_binding('http *:80:') } it { should have_path('%SystemDrive%\\inetpub\\wwwroot') } end describe service('W3SVC') do it { should be_installed } it { should be_running } end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `be_running` matcher tests if the site is running: it { should be_running } The `exist` matcher tests if the site exists: it { should exist } The `haveapppool` matcher tests if the named application pool exists for the site: it { should haveapppool('DefaultAppPool') } For example, testing if a site's application pool inherits the settings of the parent application pool: it { should haveapppool('/') } The `have_binding` matcher tests if the specified binding exists for the site: it { should have_binding('http :80:*') } or: it { should have_binding('net.pipe *') } A site may have multiple bindings; use a `have_binding` matcher for each unique site binding to be tested. The `have_binding` matcher can also test attributes that are defined for a site binding. For example, the `sslFlags` attribute defines if SSL is enabled, and (when enabled) what level of SSL is applied to the site. Testing a site with SSL disabled: it { should have_binding('https :443:www.contoso.com sslFlags=0') } Testing a site with SSL enabled: it { should have_binding('https :443:www.contoso.com sslFlags=Ssl') } Testing a site with certificate mapping authentication enabled: it { should have_binding('https :443:www.contoso.com sslFlags=SslMapCert') } Testing a site with 128-bit SSL enabled: it { should have_binding('https :443:www.contoso.com sslFlags=Ssl128') } The `have_path` matcher tests if the named path is defined for the site: it { should have_path('C:\\inetpub\\wwwroot') }