diff --git a/tests/hardening/6.2.18_check_duplicate_username.sh b/tests/hardening/6.2.18_check_duplicate_username.sh index b333419..95d6b2b 100644 --- a/tests/hardening/6.2.18_check_duplicate_username.sh +++ b/tests/hardening/6.2.18_check_duplicate_username.sh @@ -6,5 +6,18 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + local test_user="testduplicateuser" + local dir="/etc/passwd" + + describe Tests purposely failing + useradd $test_user + temp=$(tail -1 $dir) + echo $temp >> $dir + register_test retvalshouldbe 1 + register_test contain "Duplicate username" + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + # cleanup + sed -i '$ d' $dir + userdel $test_user } diff --git a/tests/hardening/6.2.19_check_duplicate_groupname.sh b/tests/hardening/6.2.19_check_duplicate_groupname.sh index b333419..ce9d96d 100644 --- a/tests/hardening/6.2.19_check_duplicate_groupname.sh +++ b/tests/hardening/6.2.19_check_duplicate_groupname.sh @@ -6,5 +6,18 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + local test_group="testduplicategroup" + local dir="/etc/group" + + describe Tests purposely failing + useradd $test_group + temp=$(tail -1 $dir) + echo $temp >> $dir + register_test retvalshouldbe 1 + register_test contain "Duplicate group" + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + # cleanup + sed -i '$ d' $dir + userdel $test_group } diff --git a/tests/hardening/6.2.20_shadow_group_empty.sh b/tests/hardening/6.2.20_shadow_group_empty.sh index b333419..92f1a56 100644 --- a/tests/hardening/6.2.20_shadow_group_empty.sh +++ b/tests/hardening/6.2.20_shadow_group_empty.sh @@ -6,5 +6,21 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + local test_user="testshadowuser" + + describe Tests purposely failing + useradd $test_user + usermod -aG shadow $test_user + register_test retvalshouldbe 1 + register_test contain "Some users belong to shadow group" + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + userdel $test_user + + describe Tests purposely failing + useradd --no-user-group -g shadow $test_user + register_test retvalshouldbe 1 + register_test contain "Some users have shadow id as their primary group" + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + userdel $test_user + }