#NEWLINE# def testPamSshDefaultDeniesAuth( self ) : #NEWLINE# #INDENT# "Test we detect when PAM ssh service doesn't deny auth by default." #NEWLINE# good1_contents = 'auth required pam_deny.so\n' #NEWLINE# good2_contents = 'auth [success=ok new_authtok_reqd=ok default=die] pam_unix.so try_first_pass\n' #NEWLINE# bad_contents = 'auth required pam_foobar.so\n' #NEWLINE# pam_good1 = { #NEWLINE# #INDENT# '/etc/pam.d/ssh' : good1_contents , #NEWLINE# #UNINDENT# } #NEWLINE# pam_good2 = { #NEWLINE# #INDENT# '/etc/pam.d/ssh' : good2_contents , #NEWLINE# #UNINDENT# } #NEWLINE# pam_bad = { #NEWLINE# #INDENT# '/etc/pam.d/ssh' : bad_contents , #NEWLINE# #UNINDENT# } #NEWLINE# sym = 'Missing attribute: PAM ssh service must default to denying auth.' #NEWLINE# found = [ 'Expected state was not found' ] #NEWLINE# results = self . RunChecks ( self . GenFileData ( 'PamConfig' , pam_bad , parser = self . parser ) ) #NEWLINE# self . assertCheckDetectedAnom ( 'PAM-SSH-DEFAULT-DENIES-AUTH' , results , sym , found ) #NEWLINE# results = self . RunChecks ( self . GenFileData ( 'PamConfig' , pam_good1 , parser = self . parser ) ) #NEWLINE# self . assertCheckUndetected ( 'PAM-SSH-DEFAULT-DENIES-AUTH' , results ) #NEWLINE# results = self . RunChecks ( self . GenFileData ( 'PamConfig' , pam_good2 , parser = self . parser ) ) #NEWLINE# self . assertCheckUndetected ( 'PAM-SSH-DEFAULT-DENIES-AUTH' , results )