feat: add debian12 scripts

ufw_is_installed.sh				-> 4.1.1
iptables_persistent_is_not_installed.sh		-> 4.1.2
ufw_is_enabled					-> 4.1.3
nftables_is_not_installed.sh 			-> 4.3.1.2
libpam_runtime_is_version 			-> 5.3.1.1

tests/hardening/iptables_persistent_is_not_installed.sh

@@ -0,0 +1,23 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe set up successful check
+    apt remove -y ufw iptables-persistent
+
+    describe Running success test
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run failure "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe set up failed check
+    DEBIAN_FRONTEND='noninteractive' apt -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install iptables-persistent apt-utils -y
+
+    describe running failed check
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run success "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    apt remove -y iptables-persistent
+    apt autoremove -y
+
+}

tests/hardening/libpam_runtime_is_version.sh

@@ -0,0 +1,10 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    # at the time of writing, there is only one version of libpam-runtim available:wq
+    describe Checking on blank host
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}

tests/hardening/nftables_not_installed_with_iptables.sh

@@ -0,0 +1,23 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe set up successful check
+    apt remove -y nftables
+
+    describe Running success test
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run failure "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe set up failed check
+    DEBIAN_FRONTEND='noninteractive' apt -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install nftables apt-utils -y
+
+    describe running failed check
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run success "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    apt remove -y nftables
+    apt autoremove -y
+
+}

tests/hardening/ufw_is_enabled.sh

@@ -0,0 +1,11 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+
+    # not much to test here, we are running in a container, we wont check service state
+    describe Checking blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}

tests/hardening/ufw_is_installed.sh

@@ -0,0 +1,39 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe set up failed check
+    apt remove -y ufw iptables-persistent
+
+    describe Running failed test
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run failure "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe set up failed resolution
+    DEBIAN_FRONTEND='noninteractive' apt -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install iptables-persistent apt-utils -y
+    sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
+
+    describe running failed resolution
+    # shellcheck disable=2154
+    "${CIS_CHECKS_DIR}/${script}.sh" --apply || true
+
+    describe running failed run after apply audit
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run success "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe fix resolution
+    apt remove -y iptables-persistent
+
+    describe running successfull resolution
+    # shellcheck disable=2154
+    "${CIS_CHECKS_DIR}/${script}.sh" --apply || true
+
+    describe running successfull audit
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run success "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    apt remove -y ufw
+    apt autoremove -y
+}