Chef InSpec

• https://github.com/dev-sec

• inspec exec linux-baseline

• PCI-DSS
• Center for Internet Security (CIS)
• DISA
• STIG
• ATO

Example: Install packages

control 'package-02' do
  impact 1.0
  title 'Do not install Telnet server'
  desc 'Telnet protocol uses unencrypted communication, that means the password and other sensitive data are unencrypted. 
http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf, Chapter 3.2.2'
  describe package('telnetd') do
    it { should_not be_installed }
  end
end

See also

• Chef, knife, chef-apply, Chef InSpec, knife vault, Chef Habitat, chef-solo,Chef apply --help, chef generate, Chef: Editing a file
• Hardening: CIS, OpenSCAP, Hardenite, patching, Chef InSpec

https://github.com/dev-sec/linux-baseline

https://github.com/dev-sec/linux-baseline/blob/master/controls/package_spec.rb