dev-sec / ssl-baseline

DevSec SSL/TLS Baseline - InSpec Profile
https://dev-sec.io/baselines/ssl/
Apache License 2.0
67 stars 23 forks source link

force_ssl disable the check for SSL #28

Closed micheelengronne closed 4 years ago

micheelengronne commented 4 years ago

This new attribute enforce SSL tests on every listed ports. It assumes SSL is enabled on all of them and do not check if it is.

chris-rock commented 4 years ago

Thank you @micheelengronne That is an interesting addition. Could you be sharing a bit more about the use case you are trying to cover?

micheelengronne commented 4 years ago

Ok.

Let's imagine this profile integrated in a CI to test an ansible role.

The ansible role configures a port with ssl.

The profile detects it and checks its configuration.

Everything works, the CI is green.

A commit later on the ansible role, the ssl support on the port is completely removed (by mistake).

The profile does not detect the port as SSL enabled so it gives a green check.

Now, we have a big problem. The SSL is dropped on this port but the CI didn't detect it.

chris-rock commented 4 years ago

Nice, thanks. That makes perfect sense. Thank you for sharing!

micheelengronne commented 4 years ago

Thanks. Can you trigger a tag ? My CI respects SemVer.

chris-rock commented 4 years ago

A new release has been done

micheelengronne commented 4 years ago

Thanks.