Project: Chef InSpec (Provisioning / Security & Compliance)
File: user.md

+++ title = "user resource" draft = false gh_repo = "inspec" platform = "os" [menu] [menu.inspec] title = "user" identifier = "inspec/resources/os/user.md user resource" parent = "inspec/resources/os" +++ Use the `user` Chef InSpec audit resource to test user profiles of a single, known or expected local user, including the groups to which the user belongs, the frequency of password changes, and the directory paths to home and shell. This resource is distributed with Chef InSpec. This resource is available from InSpec version 1.0.0. A `user` resource block declares a user name and then one (or more) matchers. ```ruby describe user('root') do it { should exist } its('uid') { should eq 1234 } its('gid') { should eq 1234 } its('group') { should eq 'root' } its('groups') { should eq ['root', 'other']} its('home') { should eq '/root' } its('shell') { should eq '/bin/bash' } its('mindays') { should eq 0 } its('maxdays') { should eq 90 } its('warndays') { should eq 8 } its('passwordage') { should eq 355 } its('maxbadpasswords') { should eq nil } // Only valid on Windows OS its('badpasswordattempts') { should eq 0 } its('lastlogin') { should eq nil } // Only valid on Windows OS end ``` Where `('root')` is the user to be tested. `it { should exist }` tests if the user exists. `gid`, `group`, `groups`, `home`, `maxdays`, `mindays`, `shell`, `uid`, `warndays`, `passwordage`, `maxbadpasswords`, `badpasswordattempts`, and `lastlogin` are valid matchers for this resource. The `gid` property tests the group identifier. ```ruby its('gid') { should eq 1234 } ``` Where `1234` represents the user identifier. The `gid` option is only available on Linux and returns `nil` for Windows OS (Operating System). The `group` property tests the group to which the user belongs. ```ruby its('group') { should eq 'root' } ``` where `root` represents the group. The `group` option is only available on Linux and returns `nil` for Windows OS. The `groups` property tests two (or more) groups to which the user belongs. ```ruby its('groups') { should eq ['root', 'other'] } ``` The `home` property tests the home directory path for the user. ```ruby its('home') { should eq '/root' } ``` The `maxdays` property tests the maximum number of days between password changes. ```ruby its('maxdays') { should eq 99 } ``` where `99` represents the maximum number of days. The `maximumdaysbetweenpasswordchange` property is equivalent to `maxdays`. This property tests the maximum number of days between password changes. ```ruby its('maximumdaysbetweenpasswordchange') { should eq 99 } ``` where `99` represents the maximum number of days. The `mindays` property tests the minimum number of days between password changes. ```ruby its('mindays') { should eq 0 } ``` where `0` represents the minimum number of days. The `minimumdaysbetweenpasswordchange` property is equivalent to `mindays`. ```ruby its('minimumdaysbetweenpasswordchange') { should eq 0 } ``` where `0` represents the minimum number of days. The `shell` property tests the path to the default shell for the user. ```ruby its('shell') { should eq '/bin/bash' } ``` The `uid` property tests the user identifier. ```ruby its('uid') { should eq 1234 } ``` where `1234` represents the user identifier. The `warndays` property tests the number of days a user is warned before a password should be

```ruby its('warndays') { should eq 5 } ``` where `5` represents the number of days a user is warned. The `passwordage` property tests the number of days a user changed the password. ```ruby its('passwordage') { should_be <= 365 } ``` where `365` represents the number of days since the last password change. The `maxbadpasswords` property tests the count of maximum number of incorrect password settings for a specific user. ```ruby its('maxbadpasswords') { should eq 7 } ``` where `7` is the count of maximum incorrect password settings. The `badpasswordattempts` property tests the count of incorrect password attempts for a user. ```ruby its('badpasswordattempts') { should eq 0 } ``` where `0` is the count of incorrect passwords for a user. These settings reset to `0` depending on your operating system configuration. For Linux-based operating systems, it relies on `lastb`, and for Windows OS, it uses information stored for the user object. The `lastlogin` property tests the last login date for a specific user. ```ruby its('lastlogin') { should eq nil } ``` The `nil` value means this user has never logged in. The `encrypted_password` property allows tests against the hashed password stored in shadow files on Unix systems with `getent` utility. ```ruby its('encrypted_password') { should eq "!" } ``` The `!` value means the user cannot log in to the system using password authentication. The following examples show how to use this Chef InSpec audit resource. ```ruby describe user('ROOT') do it { should exist } its('uid') { should eq 0 } its('groups') { should eq ['ROOT'] } end describe user('MYSQL') do it { should_not exist } end ``` The `nginx` user is typical `www-data`, but it's `nginx` on CentOS. The following example shows how to test for the `nginx` user with a single test but accounting for all platforms. ```ruby web_user = 'www-data' web_user = 'nginx' if os[:family] == 'centos' describe user(web_user) do it { should exist } end ``` {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `exist` matcher tests if the named user exists: ```ruby it { should exist } ``` The `havehomedirectory` matcher tests if the given path is the home directory path. This matcher is similar to `home` property. ```ruby it { should havehomedirectory '/home/ubuntu' } ``` The `haveloginshell` matcher tests if the given path to shell is the default shell for the user. This matcher is similar to `shell` property. ```ruby it { should haveloginshell '/bin/bash' } ``` The `have_uid` matcher tests if the given user identifier is true. This matcher is similar to `uid` property. ```ruby it { should have_uid 1234 } ``` where `1234` represents the user identifier. The `belongtoprimary_group` matcher tests if the given group is the primary group for the user. This matcher is similar to `group` property. ```ruby it { should belongtoprimary_group 'ubuntu' } ``` The `belongtogroup` matcher tests if the given group is a valid group for the user. This group can be either primary or any other group. ```ruby it { should belongtogroup 'sudo' } ``` The `haveauthorizedkeys` matcher tests if the given key is valid as part of the `authorized_keys` file. ```ruby it { should haveauthorizedkey 'ssh-ed25519 50m3r4nd0m57r1ng mockkey' } ```