mirror of
https://github.com/cisagov/ScubaGoggles.git
synced 2026-07-16 16:37:00 +02:00
Andrew Huynh
512188b66c
Run Link Checker for Cron Job / markdown-link-check (push) Has been cancelled
Run CI Pipeline for ScubaGoggles / Pylint (push) Has been cancelled
Run CI Pipeline for ScubaGoggles / Run OPA Tests (push) Has been cancelled
Run CI Pipeline for ScubaGoggles / Run Markdown Link Check (push) Has been cancelled
Run CI Pipeline for ScubaGoggles / Run Python Tests (push) Has been cancelled
Run Smoke Test / configuration (push) Has been cancelled
Run Smoke Test / smoke-test (push) Has been cancelled
Run Smoke Test / lhci (push) Has been cancelled
* add in indicators * update unit tests to include new bod 25-01 badge * update to pass pylint * update smoke tests * updated drivedocs.1.9 indicators * update commoncontrols.10.1 to be required by the bod and automated * Update meet.5.1 and meet.5.2 to be required by the bod and automated
Developed by CISA, ScubaGoggles is an assessment tool that verifies a Google Workspace (GWS) organization's configuration conforms to the policies described in the Secure Cloud Business Applications (SCuBA) Secure Configuration Baseline documents.
For the Microsoft 365 (M365) rendition of this tool, see ScubaGear.
Overview
We use a three-step process:
- Export. In this step, we primarily use the Google Admin SDK API to export and serialize all the relevant logs and settings into json. ScubaGoggles also uses various other Google APIs to grab organization metadata, user privileges etc.
- Verify. Compare the exported settings from the previous step with the configuration prescribed in the baselines. We do this using OPA Rego, a declarative query language for defining policy.
- Report. Package the results as HTML and JSON.
Table of Contents
Installation
Prerequisites
Authentication
Usage
- Usage: Parameters
- Usage: Config File
- Configuration UI — web-based form for building config files
- Usage: Examples
- Reviewing Output
- Limitations
Troubleshooting
- Not Authorized to Access This Resource
- macOS: Certificate Verification Error
- WinError 10013 Permission Error
- Unable to view HTML report due to environment limitations
- ScubaGoggles lists failures for the SPF, DKIM, and DMARC policies (GWS.GMAIL.2 through GWS.GMAIL.4) even though you have published the applicable DNS records
Misc
Project License
Unless otherwise noted, this project is distributed under the Creative Commons Zero license. With developer approval, contributions may be submitted with an alternate compatible license. If accepted, those contributions will be listed herein with the appropriate license.