add "apt_remove" in lib/utils.sh

in order to manage DEBIAN_FRONTEND

tests/hardening/chrony_is_enabled_and_running.sh

@@ -0,0 +1,18 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+
+    describe Ensure package is installed
+
+    # install dependencies
+    apt update
+    apt install -y chrony
+
+    # not much to test here, we are running in a container, we wont check service state
+    describe Checking blank host
+    register_test retvalshouldbe 0
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    apt remove -y chrony
+
+}

tests/hardening/network_services_listening.sh

@@ -0,0 +1,33 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe Prepare exceptions tests
+    apt install -y netcat-traditional
+    timeout 5s nc -lp 123 | true &
+
+    describe Running succesfull check
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run success "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe Prepare on purpose failing tests
+    timeout 5s nc -lp 80 | true &
+
+    describe Running failed check
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe correcting situation
+    # just wait for timeout to expire
+    sleep 5
+
+    describe Checking resolved state
+    register_test retvalshouldbe 0
+    run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe clean installation
+    apt remove -y netcat-traditional
+    apt autoremove -y
+
+}

tests/hardening/tftp_is_disabled.sh

@@ -0,0 +1,36 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+
+    describe Prepare on purpose failed test
+    apt install -y tftpd-hpa
+    # running on a container, will can only test the package installation, not the service management
+
+    describe Running on purpose failed test
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe correcting situation
+    sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
+    "${CIS_CHECKS_DIR}/${script}.sh" --apply || true
+
+    describe Checking resolved state
+    register_test retvalshouldbe 0
+    run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe Prepare test package dependencies
+    # try to install a package that depends on 'tftpd-hpa'
+    apt install -y tftp-hpa-dbg
+    # running on a container, we can only test the package installation, not the service management
+
+    describe Running successfull test
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe clean installation
+    apt remove -y tftp-hpa-dbg tftpd-hpa
+    apt autoremove -y
+
+}

tests/hardening/use_time_sync.sh

@@ -3,7 +3,6 @@
 test_audit() {
     describe Running on blank host
     register_test retvalshouldbe 1
-    dismiss_count_for_test
     # shellcheck disable=2154
     run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
 
@@ -14,6 +13,11 @@ test_audit() {
     # Finally assess that your corrective actions end up with a compliant system
     describe Checking resolved state
     register_test retvalshouldbe 0
-    register_test contain "Time synchronization is available through"
     run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    # we can not check the presence of multiple time synchronization from debian packages, as they are mutually exclusive
+    describe clean installation
+    apt remove -y ntp
+    apt autoremove -y
+
 }