<commit_before>####Table of Contents

1. [Overview](#overview)
2. [Module Description - What the module does and why it is useful](#module-description)
3. [Setup - The basics of getting started with puppet_audit](#setup)
    * [What puppet_audit affects](#what-puppet_audit-affects)
    * [Setup requirements](#setup-requirements)
    * [Beginning with puppet_audit](#beginning-with-puppet_audit)
4. [Usage - Configuration options and additional functionality](#usage)
5. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
5. [Limitations - OS compatibility, etc.](#limitations)
6. [Development - Guide for contributing to the module](#development)

##Overview

This module allows you to be *alerted* of changes to files and directories that you need
to audit but do not necessarily want to *change*.

##Module Description

Puppet has had Tripwire-style functionality for a while, but the previous implementation
(using the `audit` metaparameter in conjunction with the `puppet inspect` subcommend) had
some significant drawbacks. This module provides similar benefits to the `puppet inspect`
method, but does so using regular Puppet resources and reports, so its provides a clean,
supported workflow.

It implements a few defined types, `puppet_audit::directory`, `puppet_audit::link`, and `puppet_audit::file`,
which will check (but not manage) properties that you assert about the each instantiation
of the type. Differences between the desired state and the actual state on the system will
trigger a report entry describing the difference, but because each resource has the `noop`
metaparameter set to `true`, will *not* change the state of the filesystem.

This is useful if, for example, you work in an environment where a security team is interested
in using Puppet for Tripwire / Samhain / Nessus style functionality but does not want to
actively manage the files in question, and simply be alerted using Puppet's reporting mechanism if there has been drift.
=======
The puppet_audit module packages 3 defined resource types to check the presence / integrity of sensitive files, directories and symbolic links.

##Module Description

A standalone module which consumes hiera hash data pertinent to files, directories and symbolic links in the following example form:
  @@@ bash

  ---
  'profiles::puppet_audit_files':
    '/etc/passwd':
      fileMD5: '{md5}0c4305ed79b2292299b00ebcb691a0e4'
      group: '0'
      mode: '644'
      owner: '0'
    '/etc/group':
      fileMD5: '{md5}51c9981096429f8e37696806c7b0050f'
      group: '0'
      mode: '644'
      owner: '0'
  'profiles::puppet_audit_directories':
    '/etc/rc.d':
      group: '0'
      owner: '0'
      mode: '755'
    '/etc/xinetd.d':
      group: '0'
      owner: '0'
      mode: '755'
  'profiles::puppet_audit_links':
    '/etc/grub.conf':
      group: '0'
      owner: '0'
      mode: '777'
      target: '../boot/grub/grub.conf'


##Setup

 Install the module from the forge and classify appropriate nodes with the profiles::puppet_audit class.
<commit_msg>update for amrkdown<commit_after>####Table of Contents

1. [Overview](#overview)
2. [Module Description - What the module does and why it is useful](#module-description)
3. [Setup - The basics of getting started with puppet_audit](#setup)
    * [What puppet_audit affects](#what-puppet_audit-affects)
    * [Setup requirements](#setup-requirements)
    * [Beginning with puppet_audit](#beginning-with-puppet_audit)
4. [Usage - Configuration options and additional functionality](#usage)
5. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
5. [Limitations - OS compatibility, etc.](#limitations)
6. [Development - Guide for contributing to the module](#development)

##Overview

This module allows you to be *alerted* of changes to files and directories that you need
to audit but do not necessarily want to *change*.

##Module Description

Puppet has had Tripwire-style functionality for a while, but the previous implementation
(using the `audit` metaparameter in conjunction with the `puppet inspect` subcommend) had
some significant drawbacks. This module provides similar benefits to the `puppet inspect`
method, but does so using regular Puppet resources and reports, so its provides a clean,
supported workflow.

It implements a few defined types, `puppet_audit::directory`, `puppet_audit::link`, and `puppet_audit::file`,
which will check (but not manage) properties that you assert about the each instantiation
of the type. Differences between the desired state and the actual state on the system will
trigger a report entry describing the difference, but because each resource has the `noop`
metaparameter set to `true`, will *not* change the state of the filesystem.

This is useful if, for example, you work in an environment where a security team is interested
in using Puppet for Tripwire / Samhain / Nessus style functionality but does not want to
actively manage the files in question, and simply be alerted using Puppet's reporting mechanism if there has been drift.
=======
The puppet_audit module packages 3 defined resource types to check the presence / integrity of sensitive files, directories and symbolic links.

##Module Description

A standalone module which consumes hiera hash data pertinent to files, directories and symbolic links in the following example form:
<code>
  ---
  'profiles::puppet_audit_files':
    '/etc/passwd':
      fileMD5: '{md5}0c4305ed79b2292299b00ebcb691a0e4'
      group: '0'
      mode: '644'
      owner: '0'
    '/etc/group':
      fileMD5: '{md5}51c9981096429f8e37696806c7b0050f'
      group: '0'
      mode: '644'
      owner: '0'
  'profiles::puppet_audit_directories':
    '/etc/rc.d':
      group: '0'
      owner: '0'
      mode: '755'
    '/etc/xinetd.d':
      group: '0'
      owner: '0'
      mode: '755'
  'profiles::puppet_audit_links':
    '/etc/grub.conf':
      group: '0'
      owner: '0'
      mode: '777'
      target: '../boot/grub/grub.conf'
</code>

##Setup

 Install the module from the forge and classify appropriate nodes with the profiles::puppet_audit class.

{'fraction_non_alphanumeric': 0.08948909860071591, 'fraction_numerical': 0.02733485193621868, 'mean_word_length': 4.113976705490849, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1015673', 'n_tokens_mistral': 1922, 'n_tokens_neox': 1749, 'n_words': 735}