Add: Tests for base recipe, especially hardening

The EFG environment has very high requirements for security, so
the base recipe implements a range of hardening features.

These tests are at present pretty primitive, in that they do not
actually test the functionality, but they do at least document it
and check that config is in place to deliver it.
Add: SSH Hardening

Do not permit root logins, and run ssh on a high port.

Remember that this will mean you can't connect to your kitchen
instance unless you modify the port forwarding rule!
Add: Implement IP-level security hardening

- Ignore ICMP broadcast requests
- Disable source packet routing
- Ignore send redirects
- Block SYN attacks
- Log Martians
- Ignore ICMP redirects
- Ignore Directed pings
Fix: Correct assertion for redirects
Fix: procps is not a running service

Procps simply updates the kernel config - so it is an execute resource.
Add: Send reports weekly rather than daily

The reports generated by accounting, logwatch and rootkit finders
all should be sent weekly.
Change: Test fixes

- The correct matcher for file existence is `be_file`
- Test for procps not needed
Add: scripts to be run by cron
Add: attributes for ssh and fail2ban

The ssh config is currently set to use port 22, as the higher port
will require firewall and ssh config reconfiguration.

The fail2ban config for nginx request limiting is disabled as there
are a couple of issues with it:

- machines without nginx won't have the log, which will prevent
  fail2ban from starting
- the action for the jail is embedded in a substitution by the
  upstream cookbook template, which is not valid, and thus also
  prevents the service from starting
Add: basic firewall and include fail2ban cookbook

We use the upstream community fail2ban cookbook for our fail2ban stuff. This
seems to be ok, but there is an issue with the nginx jail which needs to be
resolved.

We set a basic firewall which permits all the main services to all the machines.
Make a private network available to test fail2ban
Merge branch 'master' into hardening

Conflicts:
	metadata.rb
Merge branch 'hardening'