firewalld resource
Use the firewalld
Chef InSpec audit resource to test that firewalld is configured to allow and deny access to specific hosts, services and ports on a system.
A firewalld has a number of zones that can be configured to allow and deny access to specific hosts, services, and ports.
Availability
Install
This resource is distributed with Chef InSpec and is automatically available for use.Version
This resource first became available in v1.40.0 of InSpec.
Syntax
describe firewalld do
it { should be_running }
its('default_zone') { should eq 'public' }
it { should have_service_enabled_in_zone('ssh', 'public') }
it { should have_rule_enabled('family=ipv4 source address=192.168.0.14 accept', 'public') }
end
Use the where clause to test open interfaces, sources, and services that are in active zones.
describe firewalld.where { zone == 'public' } do
its('interfaces') { should cmp ['enp0s3', 'eno2'] }
its('sources') { should cmp ['192.168.1.0/24', '192.168.1.2'] }
its('services') { should cmp ['ssh', 'icmp'] }
its('target') { should cmp ['default'] }
end
Properties
interfaces
The interfaces
property is used in conjunction with the where class to display open interfaces in an active zone.
describe firewalld.where { zone == 'public' } do
its('interfaces') { should cmp ['enp0s3', 'eno2'] }
end
sources
The sources
property is used in conjunction with the where class to display open sources in an active zone.
describe firewalld.where { zone == 'public' } do
its('sources') { should cmp ['192.168.1.0/24', '192.168.1.2'] }
end
services
The services
property is used in conjunction with the where class to display open services in an active zone.
describe firewalld.where { zone == 'public' } do
its('services') { should cmp ['ssh', 'icmp'] }
end
target
The target
property is used in conjunction with the where class to display the target action in an active zone.
describe firewalld.where { zone == 'public' } do
its('target') { should cmp ['default'] } # or ['DROP'], ['ACCEPT'], etc.
end
ports
The ports
property is used in conjunction with the where class to display the ports used by an active zone.
describe firewalld.where { zone == 'public' } do
its('ports') { should cmp ["80/tcp", "443/tcp"] }
end
protocols
The protocols
property is used in conjunction with the where class to display the protocols used by an active zone.
describe firewalld.where { zone == 'public' } do
its('protocols') { should cmp ["icmp", "ipv4"] }
end
default_zone
The default_zone
property displays the default active zone to be used.
its('default_zone') { should eq 'public' }
Matchers
For a full list of available matchers, see our Universal Matchers page.This resource has the following special matchers.
be_installed
The be_installed
matcher tests if the firewalld service is installed:
it { should be_installed }
be_running
The be_running
matcher tests if the firewalld service is running:
it { should be_running }
have_zone
have_zone
returns true or false if the zone is set on firewalld. It does not mean the zone is active.
it { should have_zone('public') }
have_service_enabled_in_zone
have_service_enabled_in_zone
returns true or false if the service is allowed in the specified zone.
it { should have_service_enabled_in_zone('ssh', 'public') }
have_port_enabled_in_zone
have_port_enabled_in_zone
returns true or false if the port is allowed in the specified zone.
it { should have_port_enabled_in_zone('22/tcp', 'public') }
have_rule_enabled
have_rule_enabled
returns true or false if the rich-rule has been specified in the zone.
it { should have_rule_enabled('family=ipv4 source address=192.168.0.14 accept', 'public') }
It is not necessary to add the “rule” string, and you can start with the optional flags that are used in firewalld and end with the action.
have_icmp_block_inversion_enabled
have_icmp_block_inversion_enabled
returns true or false if ICMP block inversion flag is set for the indicated zone.
it { should have_icmp_block_inversion_enabled }
have_masquerade_enabled
have_masquerade_enabled
returns true or false if the masquerade flag is set for the indicated zone.
it { should have_masquerade_enabled }