From fec0ac159c7df90681cf8a7782ae2e04cef1c590 Mon Sep 17 00:00:00 2001
From: Thibault Ayanides <thibault.ayanides@ovhcloud.com>
Date: Tue, 27 Oct 2020 11:24:40 +0100
Subject: [PATCH] IMP(6.2.18,6.2.19,6.2.20): add purposely failing tests

---
 .../6.2.18_check_duplicate_username.sh         | 15 ++++++++++++++-
 .../6.2.19_check_duplicate_groupname.sh        | 15 ++++++++++++++-
 tests/hardening/6.2.20_shadow_group_empty.sh   | 18 +++++++++++++++++-
 3 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/tests/hardening/6.2.18_check_duplicate_username.sh b/tests/hardening/6.2.18_check_duplicate_username.sh
index b333419..95d6b2b 100644
--- a/tests/hardening/6.2.18_check_duplicate_username.sh
+++ b/tests/hardening/6.2.18_check_duplicate_username.sh
@@ -6,5 +6,18 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    local test_user="testduplicateuser"
+    local dir="/etc/passwd"
+
+    describe Tests purposely failing 
+    useradd $test_user
+    temp=$(tail -1 $dir)
+    echo $temp >> $dir
+    register_test retvalshouldbe 1
+    register_test contain "Duplicate username"
+    run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+    # cleanup
+    sed -i '$ d' $dir
+    userdel $test_user
 }
diff --git a/tests/hardening/6.2.19_check_duplicate_groupname.sh b/tests/hardening/6.2.19_check_duplicate_groupname.sh
index b333419..ce9d96d 100644
--- a/tests/hardening/6.2.19_check_duplicate_groupname.sh
+++ b/tests/hardening/6.2.19_check_duplicate_groupname.sh
@@ -6,5 +6,18 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    local test_group="testduplicategroup"
+    local dir="/etc/group"
+
+    describe Tests purposely failing 
+    useradd $test_group
+    temp=$(tail -1 $dir)
+    echo $temp >> $dir
+    register_test retvalshouldbe 1
+    register_test contain "Duplicate group"
+    run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
+    # cleanup
+    sed -i '$ d' $dir
+    userdel $test_group
 }
diff --git a/tests/hardening/6.2.20_shadow_group_empty.sh b/tests/hardening/6.2.20_shadow_group_empty.sh
index b333419..92f1a56 100644
--- a/tests/hardening/6.2.20_shadow_group_empty.sh
+++ b/tests/hardening/6.2.20_shadow_group_empty.sh
@@ -6,5 +6,21 @@ test_audit() {
     # shellcheck disable=2154
     run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
 
-    # TODO fill comprehensive tests
+    local test_user="testshadowuser"
+
+    describe Tests purposely failing 
+    useradd $test_user
+    usermod -aG shadow $test_user
+    register_test retvalshouldbe 1
+    register_test contain "Some users belong to shadow group"
+    run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    userdel $test_user
+
+    describe Tests purposely failing 
+    useradd --no-user-group -g shadow $test_user
+    register_test retvalshouldbe 1
+    register_test contain "Some users have shadow id as their primary group"
+    run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+    userdel $test_user
+    
 }