Rewrite system account detection and hardening and create tests (#621)

* rewrite system account detection and hardening * resolve failures created when resolving merge conflicts Signed-off-by: Sebastian Gumprich <[email protected]> * add tests for shell removal tasks Signed-off-by: Sebastian Gumprich <[email protected]> * Update molecule/os_hardening/prepare.yml Signed-off-by: Martin Schurz <[email protected]> * split tasks for locking and setting shell Signed-off-by: Martin Schurz <[email protected]> * fix some more linting Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Martin Schurz <[email protected]> Co-authored-by: donestefan <[email protected]> Co-authored-by: schurzi <[email protected]>
2023-01-27 11:01:03 +01:00
1 parent f1169749f4
commit 89138be4ec
@@ -30,6 +30,7 @@
    os_yum_repo_file_whitelist: ['foo.repo']
    os_users_without_password_ageing: ['pw_no_ageing']
    os_netrc_enabled: false
+    os_ignore_users: ["shell_sys_acc"]
    sysctl_config:
      net.ipv4.ip_forward: 0
      net.ipv6.conf.all.forwarding: 0
@@ -64,3 +64,6 @@

    - name: include password ageing prepare tasks
      include_tasks: prepare_tasks/pw_ageing.yml
+
+    - name: include system account shell prepare tasks
+      include_tasks: prepare_tasks/sys_account_shell.yml
@@ -0,0 +1,5 @@
+---
+- name: Create system user with shell that should keep it
+  user:
+    name: "shell_sys_acc"
+    shell: "/bin/bash"
@@ -37,6 +37,9 @@
        name: procps
      when: ansible_facts.os_family == 'Debian'

+    - name: include system account shell tests
+      include_tasks: verify_tasks/sys_account_shell.yml
+
    - name: include password ageing tests
      include_tasks: verify_tasks/pw_ageing.yml

@@ -0,0 +1,8 @@
+- name: Read local linux user database
+  getent:
+    database: passwd
+
+- name: Check that shell_sys_acc's shell is still bash
+  assert:
+    that:
+      - getent_passwd['shell_sys_acc'][5] == "/bin/bash"