playbook makes OS undetectable

Question

playbook makes OS undetectable

kidbrax opened this issue 7 years ago · comments

I launched an AWS Linux AMI, ami-275ffe31, which is their ECS-optimized image. Inspec detects it as a AWS box. But then when I run this playbook, Inspec can no longer detect the OS. When I run Inspec detect after running this playbook, I get:

== Operating System Details

Name:      
Family:    unknown
Release:   
Arch:      This account is currently not available.

Is this expected behavior? Or has anyone else seen similar behavior? I basically can't use Inspec anymore after running this playbook.

Sebastian Gumprich · Answer 1 · Wed May 03 2017 00:19:40 GMT+0800 (China Standard Time)

With what account do you run inspec? The message This account is currently not available looks like there's a problem logging in.

Braxton Beyer · Answer 2 · Wed May 03 2017 01:53:46 GMT+0800 (China Standard Time)

The account is ec2-user. It works before I run the playbook, but then fails after the playbook has been run with the above output.

To clarify, that is the user I'm connecting with, the ssh user. Not the user on my local machine.

Braxton Beyer · Answer 3 · Wed May 03 2017 23:36:06 GMT+0800 (China Standard Time)

FYI, this passes before the playbook is run but not after.
test -f /etc/system-release && cat /etc/system-release
That seems to be what keeps inspec from getting the right OS.

Sebastian Gumprich · Answer 4 · Sun May 07 2017 19:12:47 GMT+0800 (China Standard Time)

I'll spin up a instance on AWS and check it.

andy shaw · Answer 5 · Wed Aug 02 2017 13:58:43 GMT+0800 (China Standard Time)

We're also seeing this with the official Centos 6 image. Inspec runs fine on a bare box, but after applying this playbook, the test fails with:
Failed to complete #verify action: [This OS/platform () is not supported by this profile.] on dev-sec-centos6

andy shaw · Answer 6 · Wed Aug 02 2017 14:17:38 GMT+0800 (China Standard Time)

Adding the default user of your AMI to the ignore_users seems to do the trick. So for us:
os_ignore_users: ['centos']

Would be good if this could be included in this list from the auto-detected user, or even just added to the readme.

Sebastian Gumprich · Answer 7 · Wed Aug 02 2017 15:06:12 GMT+0800 (China Standard Time)

Thanks for the clarification, @HenryTheHamster.

Would be good if this could be included in this list from the auto-detected user

For centos-machines it seems to be the user centos, for ubuntu the user ubuntu. However I could not find the user for other operating systems.

I also do not want to exclude a list of users as this would weaken the hardening. So I guess your proposal to add this to the readme is the best option. Would you mind opening a PR for this?