Increase test coverage

[pyllyukko]

What started in the tests branch...

General

• Make sure parallelism doesn't break the Debian tests

PAM

• pam_lastlog in /etc/pam.d/gdm-password
• limiting password reuse in *
• removing nullok from /etc/pam.d/common-auth
• configuring pwquality
• Everything against CentOS

Easy ones

• disable_gdm3_user_list()
• Certificates?
  • Test ca-certificates.conf.new by connecting to bunch of places
• PGP keys
• sysstat
• configure_password_policies()

Lot of work

• All the rest 👅

TODO / Ideas

• Molecule
  • https://alien.slackbook.org/blog/my-docker-packages-for-slackware-current/
  • kernel tag requires procps-ng package
  • sudoers: Overcome sorry, you must have a tty to run sudo
    • https://stackoverflow.com/questions/35597076/ansible-sudo-sorry-you-must-have-a-tty-to-run-sudo suggests to use paramiko
  • filesystem idempotence:
    • fstab
    • CAP_NET_RAW in ping
  • Debian Docker image does not have systemd?!
  • Order of tasks with Debian:
    • logrotate installs exim4 and creates Debian-exim account. If login_defs is ran before logging at least the idempotence of ftpusers will fail.

TASK [Copy /etc/sudoers.new to /etc/sudoers] ***********************************
changed: [molecule-slackware]

TASK [Remove /etc/sudoers.new] *************************************************
fatal: [molecule-slackware]: FAILED! => {"changed": false, "module_stderr": "sudo: sorry, you must have a tty to run sudo\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

A plan

• Add "minimal" support for Ubuntu for GH runner(s)
• Run playbook by tag
  • --skip-tags slackware
• Run Lynis (Use Lynis to test hardenings before & after #21)
  • Collect Lynis log as artifact?
  • Fail on low score?
• Start with something simple and measurable (and in userland)
  • Banners
  • PAM
  • Umask