smford22

<?xml version='1.0' encoding='UTF-8'?>
<project>
  <actions/>
  <description></description>
  <keepDependencies>false</keepDependencies>
  <properties>
    <com.coravy.hudson.plugins.github.GithubProjectProperty plugin="github@1.11">
      <projectUrl>https://github.com/smford22/sample-cookbook/</projectUrl>
    </com.coravy.hudson.plugins.github.GithubProjectProperty>
    <hudson.model.ParametersDefinitionProperty>

smford22

<?xml version='1.0' encoding='UTF-8'?>
<project>
  <actions/>
  <description></description>
  <keepDependencies>false</keepDependencies>
  <properties>
    <com.coravy.hudson.plugins.github.GithubProjectProperty plugin="github@1.11">
      <projectUrl>https://github.com/smford22/chef-repo/</projectUrl>
    </com.coravy.hudson.plugins.github.GithubProjectProperty>
    <hudson.model.ParametersDefinitionProperty>

smford22

rules 'local-user-account-creation'
  rule on run_resource
  when
    resource_type = 'user'
      and
    resource_result = 'create'
  then
   alert:warn('Local user account {{message.resource_name}} created on {{message.run.node_name}}')
 notify('slack', '

smford22

rules 'updated-resources'
  rule on run_converge
  when
    updated_resource_count > 0
  then
   notify('slack', '
{
"username": "Chef Server",
"icon_emoji": ":chef:",

smford22

rules 'failed-audit'
 rule on run_control_group
 when
   status != 'success'
 then
   alert:warn('{{message.cookbook_name}} {{message.recipe_name}} audit failed')
   notify('slack', '
{
"username": "Audit Alarm",

smford22

rules 'Unauthorized Cookbook Upload'
  rule on action
  when
    parent_type = 'cookbook' and requestor_name != 'jenkins_user'
  then
    audit:error("An unauthorized user updated the {{message.parent_name}} cookbook at {{message.recorded_at}} UTC! USERNAME: {{message.requestor_name}}!")
   notify('slack', '
{
"username": "Audit Alarm",

smford22

Getting Started with the Chef Compliance API

Demo how to setup accessing the Chef Compliance server's api and some of the useful things you can do with it.

Access tokens

In order to make requests against the Chef Compliance's API you need to have a token to authenticate. There are two types of token:

1. Refresh Tokens - A long-lived token that can be used to initially identify with the service, in exchange for an access token
2. Access Tokens - A short-lived (12 hours) and used for every request against the API.

Obtaining Tokens

There are a couple of ways to get refresh tokens and access tokens which are explained on the doc.chef.io

smford22

{
  "version": "2",
  "build_cookbook": {
    "name": "build_cookbook",
    "path": ".delivery/build_cookbook"
  },
  "delivery-truck": {
    "publish": {
      "chef_server": true
    }

smford22

Overview

The folloiwng example shows how to add valid SSL certs to your Chef Automate server

/etc/delivery/delivery.rb

delivery["ssl_certificates"] = {
  "<my_hostname>" => {
    "crt" => "file:///etc/delivery/certificate_chained.pem",
    "key" => "file:///etc/delivery/key.pem"
 }

smford22

name "base_linux"
description "A base role for all linux nodes"
run_list 'recipe[cookbook::recipe]', 'recipe[cookbook::recipe]'
default_attributes({
  "audit" => {
    "collector" => "chef-server-visibility",
    "profiles" => [
      {
 "name" => 'linux-patch-baseline',