Expand docs and hardware support for recent Intel NUCs

[zenmonkeykstop]

Description

7-series NUCs were discontinued in mid-April and are no longer officially available from Intel (tho probably still sporadically available at retail for a while). The recommended hardware list should be updated to include NUC models that can be reasonably expected to be available long-term. Given that 10-series NUCs are now available, it may make sense to add both 8-series and 10-series NUCs to recommendations.

The last update had issues with Ethernet chipset support in the kernel. The 8- and 10-series NUCs use the same chipset (Intel i219-v) as the 7-series, so this will probably work, but hardware testing is still required to be safe..

Tasks

• [x] acquire NUC8i5BEH and NUC10i5FNH kits, RAM, storage
• For each:
  • [x] verify Xenial server installation works, system boots with default kernel without error
  • [x] install latest SD grsec kernel, verify system boots with new kernel without error
  • verify kernel builds
  • [x] verify that changes not required for NUC8
  • [x] flag 5.4+patch requirement for NUC10
  • [x] update documentation references
  • [x] update QA matrix to include NUC8
  • [ ] Provide a 5.4 kernel with NUC10 support - #5479
  • [ ] Add NUC10 to hardware recommendations
  • [ ] Ensure that BIOS update instructions are applicable to NUC10: https://docs.securedrop.org/en/stable/update_bios.html
  • [ ] Add NUC10 to QA matrix template

User Research Evidence

(Feedback from folks looking into setting up instances)

[eloquence]

Still awaiting hardware - deferring for current sprint/1.5.0, we'll see where we are mid-sprint.

[eloquence]

Hardware obtained. For the 8/20-9/2 sprint, @zenmonkeykstop committed to step through and document the install procedure on Ubuntu 16.04, in the second half of the sprint.

[zenmonkeykstop]

Initial testing done against NUC10i5FNH, Ubuntu 16.04.6 server install:

• onboard NIC not detected (as expected) so a generic USB Ethernet adapter was used instead
• after installation and update to latest Ubuntu 4.4 series kernel, NIC still not detected.
• downloaded and installed latest SD grsec kernel (4.14.188) - NIC still not detected.
• did a bit of research, looks like despite the fact that the same chipset is listed as for NUC7s, there is an updated serial code somewhere that is not included in the Kaby Lake patch we're applying at kernel build time. 10th-gen NUCs are supported under Linux 5.5, and it looks like support was also backported into the 20.04 Focal kernel.

[eloquence]

Discussed in sprint planning today. We've got NUC8s on order and will test those in late September. The NUC7s are still available in retail (including online: Amazon, Newegg, etc.) but getting stale.

[rocodes]

I have a NUC8 and have (briefly) gone over the initial testing with @zenmonkeykstop. I'll plan to step through and document results as well during the coming sprint.

[eloquence]

Per above @rocodes will do some testing on the NUC8 during the sprint, but we're not aiming to QA 1.6.0 on it yet.

[rocodes]

Partial update on NUC8 hardware testing:

• [x] Ubuntu 16.04 LTS installed successfully. NIC was not recognized during installation wizard, nor was the USB ethernet adapter (Tripp-Lite USB 3.0 Adapter U336-000-GBW, and I also tried an Asus adapter I had lying around). However, once Ubuntu was installed, a quick lspci indicates that the ethernet adapter device is actually detected, but the interface wasn't configured, so this is quickly fixable and the USB ethernet adapter is usable in Ubuntu. (I didn't spend any time trying to figure out if it was possible to get the NIC recognized in vanilla Ubuntu since I wanted to focus on grsec, but I could do).

• [ ] securedrop-grsec-4.14.188 kernel installation not completed. Installing the linux-headers-4.14.188-securedrop-grsec and linux-image-4.14.188-securedrop-grsec occurs without issue, but the securedrop metapackage requires a fallback kernel, and in the apt repo, we only seem to have linux-image-4.14.175 but not the headers package, so the installation of 4.14.175 is not successful. Therefore, the securedrop-grsec-4.14.188 metapackage cannot successfully be installed (it complains about a missing dependency).

• [ ] Booting into the grsec 4.14.188 kernel from the GRUB menu, it currently hangs. This sounds like an issue similar to what @zenmonkeykstop encountered historically with the NUC7s, which required a kernel update to mitigate. Conducting further diagnostics to gather more information.

• [x] Ubuntu 20.04 Focal installs and boots successfully and ethernet connection is detected successfully without the use of a USB adapter.

• [ ] Compiling and installing a grsec-5.4.68 kernel (back on Xenial on the NUC8) is also unsuccessful, and hangs at initrd in the same way the 4.14.188 kernel did. (Thanks to @conorsch for much assistance with this and other steps!) Also under conor's watchful eye, the problem persists after pulling in the two Kaby Lake patches from https://github.com/freedomofpress/ansible-role-grsecurity-build/tree/main/files and recompiling this kernel. I can confirm that the kernel boots on a Xenial-based qube, so it appears to have been compiled correctly.

[rocodes]

Unfortunately, even after building a new 5.4.68 kernel based on a new kernel config provided by @emkll today, I'm unable to boot into it on the NUC8, though I can boot into it on a Xenial qube, same as with the kernel I built yesterday.

I do notice the following console output when installing the kernel: [...] Ignoring non-Xen Kernel on Xen domU host: vmlinuz-5.4.68-grsec

Some quick searching tells me this is grub trying to be clever, however, a) the kernel still shows up in the grub menu and b) this message is also displayed in the Xenial qube when installing the kernel, which then goes on to boot just fine.

Stay tuned folks... Sorry it's not a happier update.

[eloquence]

@rocodes and @zenmonkeykstop will continue their work on this in the 10/1-10/15 sprint, aiming for no more than 16 person hours total time spent during this sprint. Our goal right now is to get the NUC8s running on a 4.14 series grsec kernel, so we can potentially ship support in a point release or 1.7.0. Additional 5.4 testing is out scope for now, but we'll revisit 5.4+ kernel support as part of the Focal migration (#4768) at the latest.

[rocodes]

At @emkll's suggestion I tried compiling a 4.14 series kernel without grsec patches to see if it would boot on the NUC8, thereby helping us determine whether the issue is with the grsec patches or not. Unfortunately, a 4.14.188 kernel without grsec patches does boot successfully on the NUC8, while the 4.14.188 kernel from the apt repo that includes grsecurity patches does not.

But wait there's more! In both cases (the kernel that successfully boots and the one that does not), during installation I see the following warning:

W: Possible missing firmware /lib/firmware/i915/kbl_guc_ver9_14.bin for module i915
W: Possible missing firmware /lib/firmware/i915/bxt_guc_ver8_7.bin for module i915 

However, installing the appropriate drivers has not enabled the grsec kernel to boot.

[zenmonkeykstop]

tested on the NUC8i5BEK as provided by @rocodes:

• 16.04.7 installer with built-in NIC: NIC not detected
• 16.04.7 installer with USB Ethernet dongle (TP-Link UE300): USB NIC detected, installation as normal
• installed 4.14.188-grsec kernel+headers from apt-test with dpkg and rebooted: boot frozen after loading initial ramdisk
• added debug ignore_loglevel earlyprintk=efi,keep to grsec kernel parameters for more info - found boot freezes after ACPI: 8 ACPI AML tables successfully acquired and loaded
• futzed around for a bit with no joy, but then...
• ...checked kernel parameters for a working grsec install.
• added missing mds=full,nosmt noefiflags: boot successful!
• verified built-in NIC support

tried out an SD install with the dongle:

• install proceeded as normal with default settings
• after ./securedrop-admin install sshed to app server and switched default interfaces in /etc/network/interfaces
• rebooted but had a bit of a chicken-egg moment, given potential iptables woes decided best procedure would probably be:
  • install with ssh enabled
  • switch NICs as above
  • rerun sdconfig to switch to ssh-over-tor and rerun install playbook.

With a working USB adaptor, it looks like the NUC8s are a viable install option, though it would be worth going through a full install run as above to verify and document the process.

(One thing to note, paxtest tests pass but one meltdown test (for the Foreshadow SGX vulnerability mitigation) fails.)

[eloquence]

(Per most recent findings it sounds like only docs additions may be needed fro NUC8 support, so migrated to securedrop-docs repo.)

[zenmonkeykstop]

IMO this should move back to SD core - NUC10 support will require a kernel build.

[eloquence]

(Retitled and checklist updated for clarity.)

[eloquence]

One observation from NUC10s is that the BIOS instructions now recommend downloading a CAP file for the F7 update method, not a BIO file as stated in our docs. I've added a checkbox to the epic to ensure that we update this as warranted.

[eloquence]

Except for the above minor detail, no issues migrating an Ubuntu 16.04 instance on Mac Minis to Ubuntu 20.04 on NUC10s :tada:

[rocodes]

The NUC8i5s in our hardware docs were officially discontinued on Oct 2020 (https://www.intel.ca/content/www/ca/en/support/articles/000016234/intel-nuc.html), although they'll get security updates til Oct 2023. A further round of NUC8s were discontinued Feb 2021, getting security updates til early 2024.

Would be great to add NUC10s (and LIbrems?) to our hardware recommendations to get a bit ahead of this.

[eloquence]

I ran the testinfra tests from Conor's #5848 branch (i.e. including paxtest) using USE_FOCAL=1 ./securedrop-admin --force verify on my NUC10. The results were as expected (i.e. only successes or xfail), full details below. Next up is the meltdown check.

Glory to testinfra

``` $ USE_FOCAL=1 ./securedrop-admin --force verify INFO: Skipping update check because --force argument was provided. INFO: Running configuration tests: Tails workstation detected, continuing... ============================================================================= test session starts ============================================================================== platform linux -- Python 3.7.3, pytest-6.1.1, py-1.9.0, pluggy-0.13.1 -- /home/amnesia/Persistent/securedrop/admin/.venv3/bin/python3 cachedir: .pytest_cache rootdir: /home/amnesia/Persistent/securedrop/molecule, configfile: pytest.ini plugins: testinfra-5.3.1, forked-1.3.0, xdist-2.1.0 [gw0] linux Python 3.7.3 cwd: /home/amnesia/Persistent/securedrop/molecule/testinfra [gw1] linux Python 3.7.3 cwd: /home/amnesia/Persistent/securedrop/molecule/testinfra [gw0] Python 3.7.3 (default, Jul 25 2020, 13:03:44) -- [GCC 8.3.0] [gw1] Python 3.7.3 (default, Jul 25 2020, 13:03:44) -- [GCC 8.3.0] gw0 [472] / gw1 [472] scheduling tests via LoadScheduling app/test_apparmor.py::test_apparmor_pkg[paramiko:/app-apparmor] app/test_apparmor.py::test_apparmor_pkg[paramiko:/app-apparmor-utils] [gw0] [ 0%] PASSED app/test_apparmor.py::test_apparmor_pkg[paramiko:/app-apparmor] app/test_apparmor.py::test_apparmor_enabled[paramiko:/app] [gw1] [ 0%] PASSED app/test_apparmor.py::test_apparmor_pkg[paramiko:/app-apparmor-utils] app/test_apparmor.py::test_apparmor_apache_capabilities[paramiko:/app-dac_override] [gw0] [ 0%] PASSED app/test_apparmor.py::test_apparmor_enabled[paramiko:/app] app/test_apparmor.py::test_apparmor_apache_capabilities[paramiko:/app-kill] [gw1] [ 0%] PASSED app/test_apparmor.py::test_apparmor_apache_capabilities[paramiko:/app-dac_override] app/test_apparmor.py::test_apparmor_apache_capabilities[paramiko:/app-net_bind_service] [gw0] [ 1%] PASSED app/test_apparmor.py::test_apparmor_apache_capabilities[paramiko:/app-kill] app/test_apparmor.py::test_apparmor_apache_capabilities[paramiko:/app-sys_ptrace] [gw1] [ 1%] PASSED app/test_apparmor.py::test_apparmor_apache_capabilities[paramiko:/app-net_bind_service] app/test_apparmor.py::test_apparmor_apache_exact_capabilities[paramiko:/app] [gw0] [ 1%] PASSED app/test_apparmor.py::test_apparmor_apache_capabilities[paramiko:/app-sys_ptrace] app/test_apparmor.py::test_apparmor_tor_capabilities[paramiko:/app-setgid] [gw1] [ 1%] PASSED app/test_apparmor.py::test_apparmor_apache_exact_capabilities[paramiko:/app] app/test_apparmor.py::test_apparmor_tor_exact_capabilities[paramiko:/app] [gw0] [ 1%] PASSED app/test_apparmor.py::test_apparmor_tor_capabilities[paramiko:/app-setgid] app/test_apparmor.py::test_apparmor_ensure_not_disabled[paramiko:/app-focal] [gw1] [ 2%] PASSED app/test_apparmor.py::test_apparmor_tor_exact_capabilities[paramiko:/app] app/test_apparmor.py::test_apparmor_ensure_not_disabled[paramiko:/app-xenial] [gw0] [ 2%] PASSED app/test_apparmor.py::test_apparmor_ensure_not_disabled[paramiko:/app-focal] app/test_apparmor.py::test_app_apparmor_complain[paramiko:/app-complain_pkg0] [gw0] [ 2%] SKIPPED app/test_apparmor.py::test_app_apparmor_complain[paramiko:/app-complain_pkg0] app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-sbin/dhclient] [gw1] [ 2%] PASSED app/test_apparmor.py::test_apparmor_ensure_not_disabled[paramiko:/app-xenial] app/test_apparmor.py::test_app_apparmor_complain_count[paramiko:/app] [gw0] [ 2%] PASSED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-sbin/dhclient] app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/lib/connman/scripts/dhclient-script] [gw1] [ 3%] PASSED app/test_apparmor.py::test_app_apparmor_complain_count[paramiko:/app] app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/lib/NetworkManager/nm-dhcp-client.action] [gw0] [ 3%] PASSED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/lib/connman/scripts/dhclient-script] app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-system_tor] [gw1] [ 3%] PASSED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/lib/NetworkManager/nm-dhcp-client.action] app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/sbin/tcpdump] [gw0] [ 3%] PASSED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-system_tor] app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/sbin/apache2/DEFAULT_URI] [gw1] [ 4%] PASSED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/sbin/tcpdump] app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/sbin/apache2] [gw0] [ 4%] PASSED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/sbin/apache2/DEFAULT_URI] app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/sbin/tor] [gw1] [ 4%] PASSED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/sbin/apache2] app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/sbin/apache2/HANDLING_UNTRUSTED_INPUT] [gw0] [ 4%] PASSED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/sbin/tor] app/test_apparmor.py::test_aastatus_unconfined[paramiko:/app] [gw1] [ 4%] PASSED app/test_apparmor.py::test_apparmor_enforced[paramiko:/app-/usr/sbin/apache2/HANDLING_UNTRUSTED_INPUT] app/test_apparmor.py::test_apparmor_total_profiles[paramiko:/app] [gw0] [ 5%] PASSED app/test_apparmor.py::test_aastatus_unconfined[paramiko:/app] app/test_appenv.py::test_app_pip_deps[paramiko:/app-exp_pip_pkg0] [gw1] [ 5%] PASSED app/test_apparmor.py::test_apparmor_total_profiles[paramiko:/app] app/test_apparmor.py::test_aa_no_denies_in_syslog[paramiko:/app] [gw0] [ 5%] PASSED app/test_appenv.py::test_app_pip_deps[paramiko:/app-exp_pip_pkg0] app/test_appenv.py::test_app_directories[paramiko:/app-/var/www/securedrop] [gw1] [ 5%] PASSED app/test_apparmor.py::test_aa_no_denies_in_syslog[paramiko:/app] app/test_appenv.py::test_pidfile[paramiko:/app] [gw1] [ 5%] PASSED app/test_appenv.py::test_pidfile[paramiko:/app] app/test_appenv.py::test_app_directories[paramiko:/app-/var/lib/securedrop] [gw0] [ 6%] PASSED app/test_appenv.py::test_app_directories[paramiko:/app-/var/www/securedrop] app/test_appenv.py::test_app_directories[paramiko:/app-/var/lib/securedrop/store] [gw1] [ 6%] PASSED app/test_appenv.py::test_app_directories[paramiko:/app-/var/lib/securedrop] app/test_appenv.py::test_app_directories[paramiko:/app-/var/lib/securedrop/keys] [gw0] [ 6%] PASSED app/test_appenv.py::test_app_directories[paramiko:/app-/var/lib/securedrop/store] app/test_appenv.py::test_app_directories[paramiko:/app-/var/lib/securedrop/tmp] [gw1] [ 6%] PASSED app/test_appenv.py::test_app_directories[paramiko:/app-/var/lib/securedrop/keys] app/test_appenv.py::test_app_code_pkg[paramiko:/app] [gw0] [ 6%] PASSED app/test_appenv.py::test_app_directories[paramiko:/app-/var/lib/securedrop/tmp] app/test_appenv.py::test_app_code_venv[paramiko:/app] [gw1] [ 7%] PASSED app/test_appenv.py::test_app_code_pkg[paramiko:/app] app/test_appenv.py::test_supervisor_not_installed[paramiko:/app] [gw0] [ 7%] PASSED app/test_appenv.py::test_app_code_venv[paramiko:/app] app/test_appenv.py::test_ensure_logo[paramiko:/app] [gw1] [ 7%] PASSED app/test_appenv.py::test_supervisor_not_installed[paramiko:/app] app/test_appenv.py::test_securedrop_tmp_clean_cron[paramiko:/app] [gw1] [ 7%] PASSED app/test_appenv.py::test_securedrop_tmp_clean_cron[paramiko:/app] app/test_ossec_agent.py::test_ossec_service_start_style[paramiko:/app] [gw1] [ 8%] PASSED app/test_ossec_agent.py::test_ossec_service_start_style[paramiko:/app] app/test_ossec_agent.py::test_ossec_agent_installed[paramiko:/app] [gw0] [ 8%] PASSED app/test_appenv.py::test_ensure_logo[paramiko:/app] app/test_ossec_agent.py::test_hosts_files[paramiko:/app] [gw1] [ 8%] PASSED app/test_ossec_agent.py::test_ossec_agent_installed[paramiko:/app] app/test_paxctld.py::test_paxctld_installed[paramiko:/app] [gw1] [ 8%] PASSED app/test_paxctld.py::test_paxctld_installed[paramiko:/app] app/test_paxctld.py::test_paxctld_service[paramiko:/app] [gw1] [ 8%] PASSED app/test_paxctld.py::test_paxctld_service[paramiko:/app] app/test_tor_config.py::test_tor_service_running[paramiko:/app] [gw0] [ 9%] PASSED app/test_ossec_agent.py::test_hosts_files[paramiko:/app] app/test_ossec_agent.py::test_hosts_duplicate[paramiko:/app] [gw0] [ 9%] PASSED app/test_ossec_agent.py::test_hosts_duplicate[paramiko:/app] app/test_ossec_agent.py::test_ossec_keyfile_present[paramiko:/app] [gw1] [ 9%] PASSED app/test_tor_config.py::test_tor_service_running[paramiko:/app] app/test_tor_config.py::test_tor_torrc_options[paramiko:/app-SafeLogging 1] [gw1] [ 9%] PASSED app/test_tor_config.py::test_tor_torrc_options[paramiko:/app-SafeLogging 1] app/test_tor_config.py::test_tor_torrc_sandbox[paramiko:/app] [gw0] [ 9%] XFAIL app/test_ossec_agent.py::test_ossec_keyfile_present[paramiko:/app] app/test_paxctld.py::test_paxctld_config[paramiko:/app] [gw0] [ 10%] PASSED app/test_paxctld.py::test_paxctld_config[paramiko:/app] app/test_tor_config.py::test_tor_packages[paramiko:/app-tor] [gw1] [ 10%] PASSED app/test_tor_config.py::test_tor_torrc_sandbox[paramiko:/app] app/apache/test_apache_journalist_interface.py::test_apache_headers_journalist_interface[paramiko:/app-X-Content-Type-Options-nosniff] [gw0] [ 10%] PASSED app/test_tor_config.py::test_tor_packages[paramiko:/app-tor] app/test_tor_config.py::test_tor_torrc_options[paramiko:/app-SocksPort 0] [gw0] [ 10%] PASSED app/test_tor_config.py::test_tor_torrc_options[paramiko:/app-SocksPort 0] app/test_tor_config.py::test_tor_torrc_options[paramiko:/app-RunAsDaemon 1] [gw1] [ 11%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_headers_journalist_interface[paramiko:/app-X-Content-Type-Options-nosniff] app/apache/test_apache_journalist_interface.py::test_apache_headers_journalist_interface[paramiko:/app-Content-Security-Policy-default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';] [gw0] [ 11%] PASSED app/test_tor_config.py::test_tor_torrc_options[paramiko:/app-RunAsDaemon 1] app/apache/test_apache_journalist_interface.py::test_apache_headers_journalist_interface[paramiko:/app-X-XSS-Protection-1; mode=block] [gw1] [ 11%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_headers_journalist_interface[paramiko:/app-Content-Security-Policy-default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-WSGIDaemonProcess journalist processes=2 threads=30 display-name=%{GROUP} python-path=/var/www/securedrop] [gw0] [ 11%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_headers_journalist_interface[paramiko:/app-X-XSS-Protection-1; mode=block] app/apache/test_apache_journalist_interface.py::test_apache_headers_journalist_interface[paramiko:/app-X-Download-Options-noopen] [gw1] [ 11%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-WSGIDaemonProcess journalist processes=2 threads=30 display-name=%{GROUP} python-path=/var/www/securedrop] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-WSGIPassAuthorization On] [gw0] [ 12%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_headers_journalist_interface[paramiko:/app-X-Download-Options-noopen] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-] [gw1] [ 12%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-WSGIPassAuthorization On] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-Alias /static /var/www/securedrop/static] [gw0] [ 12%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-WSGIScriptAlias / /var/www/journalist.wsgi process-group=journalist application-group=journalist] [gw1] [ 12%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-Alias /static /var/www/securedrop/static] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-LimitRequestBody 524288000] [gw0] [ 12%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-WSGIScriptAlias / /var/www/journalist.wsgi process-group=journalist application-group=journalist] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-Header set Cache-Control "no-store"] [gw1] [ 13%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-LimitRequestBody 524288000] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-XSendFilePath /var/lib/securedrop/tmp/] [gw0] [ 13%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-Header set Cache-Control "no-store"] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-XSendFile On] [gw1] [ 13%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-XSendFilePath /var/lib/securedrop/tmp/] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-CustomLog /var/log/apache2/journalist-access.log combined] [gw0] [ 13%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-XSendFile On] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-XSendFilePath /var/lib/securedrop/store/] [gw1] [ 13%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-CustomLog /var/log/apache2/journalist-access.log combined] app/apache/test_apache_journalist_interface.py::test_apache_logging_journalist_interface[paramiko:/app] [gw0] [ 14%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-XSendFilePath /var/lib/securedrop/store/] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-ErrorLog /var/log/apache2/journalist-error.log] [gw1] [ 14%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_logging_journalist_interface[paramiko:/app] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_focal[paramiko:/app-\n Require all granted\n # Cache static resources for 1 hour\n Header set Cache-Control "max-age=3600"\n] [gw1] [ 14%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_focal[paramiko:/app-\n Require all granted\n # Cache static resources for 1 hour\n Header set Cache-Control "max-age=3600"\n] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_xenial[paramiko:/app-\n Options None\n AllowOverride None\n Order deny,allow\n Deny from all\n] [gw1] [ 14%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_xenial[paramiko:/app-\n Options None\n AllowOverride None\n Order deny,allow\n Deny from all\n] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_xenial[paramiko:/app-\n Options None\n AllowOverride None\n \n Order allow,deny\n allow from 127.0.0.1\n \n \n Order deny,allow\n Deny from all\n \n] [gw1] [ 15%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_xenial[paramiko:/app-\n Options None\n AllowOverride None\n \n Order allow,deny\n allow from 127.0.0.1\n \n \n Order deny,allow\n Deny from all\n \n] app/apache/test_apache_service.py::test_apache_enabled_sites[paramiko:/app-journalist] [gw1] [ 15%] PASSED app/apache/test_apache_service.py::test_apache_enabled_sites[paramiko:/app-journalist] app/apache/test_apache_service.py::test_apache_service[paramiko:/app] [gw0] [ 15%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface[paramiko:/app-ErrorLog /var/log/apache2/journalist-error.log] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_headers_per_distro[paramiko:/app] [gw1] [ 15%] PASSED app/apache/test_apache_service.py::test_apache_service[paramiko:/app] app/apache/test_apache_service.py::test_apache_listening[paramiko:/app-80] [gw1] [ 15%] PASSED app/apache/test_apache_service.py::test_apache_listening[paramiko:/app-80] app/apache/test_apache_source_interface.py::test_apache_headers_source_interface[paramiko:/app-X-XSS-Protection-1; mode=block] [gw0] [ 16%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_headers_per_distro[paramiko:/app] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_focal[paramiko:/app-\n Options None\n AllowOverride None\n Require all denied\n] [gw0] [ 16%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_focal[paramiko:/app-\n Options None\n AllowOverride None\n Require all denied\n] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_focal[paramiko:/app-\n Options None\n AllowOverride None\n \n Require ip 127.0.0.1\n \n \n Require all denied\n \n] [gw0] [ 16%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_focal[paramiko:/app-\n Options None\n AllowOverride None\n \n Require ip 127.0.0.1\n \n \n Require all denied\n \n] app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_xenial[paramiko:/app-\n Order allow,deny\n Allow from all\n # Cache static resources for 1 hour\n Header set Cache-Control "max-age=3600"\n] [gw0] [ 16%] PASSED app/apache/test_apache_journalist_interface.py::test_apache_config_journalist_interface_access_control_xenial[paramiko:/app-\n Order allow,deny\n Allow from all\n # Cache static resources for 1 hour\n Header set Cache-Control "max-age=3600"\n] app/apache/test_apache_service.py::test_apache_enabled_sites[paramiko:/app-source] [gw0] [ 16%] PASSED app/apache/test_apache_service.py::test_apache_enabled_sites[paramiko:/app-source] app/apache/test_apache_service.py::test_apache_disabled_sites[paramiko:/app-000-default] [gw0] [ 17%] PASSED app/apache/test_apache_service.py::test_apache_disabled_sites[paramiko:/app-000-default] app/apache/test_apache_service.py::test_apache_user[paramiko:/app] [gw1] [ 17%] PASSED app/apache/test_apache_source_interface.py::test_apache_headers_source_interface[paramiko:/app-X-XSS-Protection-1; mode=block] app/apache/test_apache_source_interface.py::test_apache_headers_source_interface[paramiko:/app-X-Download-Options-noopen] [gw0] [ 17%] PASSED app/apache/test_apache_service.py::test_apache_user[paramiko:/app] app/apache/test_apache_service.py::test_apache_listening[paramiko:/app-8080] [gw0] [ 17%] PASSED app/apache/test_apache_service.py::test_apache_listening[paramiko:/app-8080] app/apache/test_apache_source_interface.py::test_apache_headers_source_interface[paramiko:/app-X-Content-Type-Options-nosniff] [gw1] [ 18%] PASSED app/apache/test_apache_source_interface.py::test_apache_headers_source_interface[paramiko:/app-X-Download-Options-noopen] app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-] [gw0] [ 18%] PASSED app/apache/test_apache_source_interface.py::test_apache_headers_source_interface[paramiko:/app-X-Content-Type-Options-nosniff] app/apache/test_apache_source_interface.py::test_apache_headers_source_interface[paramiko:/app-Content-Security-Policy-default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';] [gw1] [ 18%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-] app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-WSGIProcessGroup source] [gw1] [ 18%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-WSGIProcessGroup source] app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-Header set Cache-Control "no-store"] [gw0] [ 18%] PASSED app/apache/test_apache_source_interface.py::test_apache_headers_source_interface[paramiko:/app-Content-Security-Policy-default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';] app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-WSGIDaemonProcess source processes=2 threads=30 display-name=%{GROUP} python-path=/var/www/securedrop] [gw0] [ 19%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-WSGIDaemonProcess source processes=2 threads=30 display-name=%{GROUP} python-path=/var/www/securedrop] app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-WSGIScriptAlias / /var/www/source.wsgi] [gw1] [ 19%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-Header set Cache-Control "no-store"] app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-Alias /static /var/www/securedrop/static] [gw0] [ 19%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-WSGIScriptAlias / /var/www/source.wsgi] app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-Header unset Etag] [gw1] [ 19%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-Alias /static /var/www/securedrop/static] app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-LimitRequestBody 524288000] [gw0] [ 19%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-Header unset Etag] app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-XSendFile Off] [gw1] [ 20%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-LimitRequestBody 524288000] app/apache/test_apache_source_interface.py::test_apache_config_source_interface_headers_per_distro[paramiko:/app] [gw0] [ 20%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-XSendFile Off] app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-ErrorLog /dev/null] [gw1] [ 20%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface_headers_per_distro[paramiko:/app] app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_focal[paramiko:/app-\n Require all granted\n # Cache static resources for 1 hour\n Header set Cache-Control "max-age=3600"\n] [gw1] [ 20%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_focal[paramiko:/app-\n Require all granted\n # Cache static resources for 1 hour\n Header set Cache-Control "max-age=3600"\n] app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_xenial[paramiko:/app-\n Options None\n AllowOverride None\n Order deny,allow\n Deny from all\n] [gw1] [ 20%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_xenial[paramiko:/app-\n Options None\n AllowOverride None\n Order deny,allow\n Deny from all\n] app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_xenial[paramiko:/app-\n Options None\n AllowOverride None\n \n Order allow,deny\n allow from 127.0.0.1\n \n \n Order deny,allow\n Deny from all\n \n] [gw1] [ 21%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_xenial[paramiko:/app-\n Options None\n AllowOverride None\n \n Order allow,deny\n allow from 127.0.0.1\n \n \n Order deny,allow\n Deny from all\n \n] app/apache/test_apache_system_config.py::test_apache_security_config_deprecated[paramiko:/app] [gw1] [ 21%] PASSED app/apache/test_apache_system_config.py::test_apache_security_config_deprecated[paramiko:/app] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-PidFile ${APACHE_PID_FILE}] [gw0] [ 21%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface[paramiko:/app-ErrorLog /dev/null] app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_focal[paramiko:/app-\n Options None\n AllowOverride None\n Require all denied\n] [gw0] [ 21%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_focal[paramiko:/app-\n Options None\n AllowOverride None\n Require all denied\n] app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_focal[paramiko:/app-\n Options None\n AllowOverride None\n \n Require ip 127.0.0.1\n \n \n Require all denied\n \n] [gw0] [ 22%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_focal[paramiko:/app-\n Options None\n AllowOverride None\n \n Require ip 127.0.0.1\n \n \n Require all denied\n \n] app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_xenial[paramiko:/app-\n Order allow,deny\n Allow from all\n # Cache static resources for 1 hour\n Header set Cache-Control "max-age=3600"\n] [gw0] [ 22%] PASSED app/apache/test_apache_source_interface.py::test_apache_config_source_interface_access_control_xenial[paramiko:/app-\n Order allow,deny\n Allow from all\n # Cache static resources for 1 hour\n Header set Cache-Control "max-age=3600"\n] app/apache/test_apache_system_config.py::test_apache_apt_packages[paramiko:/app-libapache2-mod-xsendfile] [gw0] [ 22%] PASSED app/apache/test_apache_system_config.py::test_apache_apt_packages[paramiko:/app-libapache2-mod-xsendfile] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-Mutex file:${APACHE_LOCK_DIR} default] [gw1] [ 22%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-PidFile ${APACHE_PID_FILE}] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-KeepAlive On] [gw0] [ 22%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-Mutex file:${APACHE_LOCK_DIR} default] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-Timeout 60] [gw1] [ 23%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-KeepAlive On] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-KeepAliveTimeout 5] [gw0] [ 23%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-Timeout 60] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-MaxKeepAliveRequests 100] [gw1] [ 23%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-KeepAliveTimeout 5] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-Group www-data] [gw0] [ 23%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-MaxKeepAliveRequests 100] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-User www-data] [gw1] [ 23%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-Group www-data] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-DefaultType None] [gw0] [ 24%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-User www-data] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-AddDefaultCharset UTF-8] [gw1] [ 24%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-DefaultType None] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-ErrorLog /dev/null] [gw0] [ 24%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-AddDefaultCharset UTF-8] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-HostnameLookups Off] [gw1] [ 24%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-ErrorLog /dev/null] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-LogLevel crit] [gw0] [ 25%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-HostnameLookups Off] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-redis-server] [gw1] [ 25%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-LogLevel crit] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-IncludeOptional mods-enabled/*.load] [gw0] [ 25%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-redis-server] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-securedrop-config] [gw0] [ 25%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-securedrop-config] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-securedrop-keyring] [gw0] [ 25%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-securedrop-keyring] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-sqlite3] [gw0] [ 26%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-sqlite3] app-code/test_securedrop_app_code.py::test_securedrop_application_sqlite_db[paramiko:/app] [gw1] [ 26%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-IncludeOptional mods-enabled/*.load] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-IncludeOptional mods-enabled/*.conf] [gw0] [ 26%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_sqlite_db[paramiko:/app] app-code/test_securedrop_rqrequeue.py::test_securedrop_rqrequeue_service[paramiko:/app] [gw1] [ 26%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-IncludeOptional mods-enabled/*.conf] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-Include ports.conf] [gw1] [ 26%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-Include ports.conf] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-IncludeOptional sites-enabled/*.conf] [gw0] [ 27%] PASSED app-code/test_securedrop_rqrequeue.py::test_securedrop_rqrequeue_service[paramiko:/app] app-code/test_securedrop_rqworker.py::test_securedrop_rqworker_service[paramiko:/app] [gw1] [ 27%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-IncludeOptional sites-enabled/*.conf] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-ServerTokens Prod] [gw0] [ 27%] PASSED app-code/test_securedrop_rqworker.py::test_securedrop_rqworker_service[paramiko:/app] app-code/test_securedrop_shredder_configuration.py::test_securedrop_shredder_service[paramiko:/app] [gw1] [ 27%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-ServerTokens Prod] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-ServerSignature Off] [gw1] [ 27%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-ServerSignature Off] app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-TraceEnable Off] [gw0] [ 28%] PASSED app-code/test_securedrop_shredder_configuration.py::test_securedrop_shredder_service[paramiko:/app] app-code/test_securedrop_source_deleter_configuration.py::test_securedrop_source_deleter_service[paramiko:/app] [gw1] [ 28%] PASSED app/apache/test_apache_system_config.py::test_apache_config_settings[paramiko:/app-TraceEnable Off] app/apache/test_apache_system_config.py::test_apache_ports_config[paramiko:/app-80] [gw0] [ 28%] PASSED app-code/test_securedrop_source_deleter_configuration.py::test_securedrop_source_deleter_service[paramiko:/app] common/test_automatic_updates.py::test_automatic_updates_dependencies[paramiko:/app] [gw1] [ 28%] PASSED app/apache/test_apache_system_config.py::test_apache_ports_config[paramiko:/app-80] app/apache/test_apache_system_config.py::test_apache_ports_config[paramiko:/app-8080] [gw1] [ 29%] PASSED app/apache/test_apache_system_config.py::test_apache_ports_config[paramiko:/app-8080] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-access_compat] [gw0] [ 29%] PASSED common/test_automatic_updates.py::test_automatic_updates_dependencies[paramiko:/app] common/test_automatic_updates.py::test_cron_apt_config[paramiko:/app] [gw1] [ 29%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-access_compat] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-authn_core] [gw0] [ 29%] PASSED common/test_automatic_updates.py::test_cron_apt_config[paramiko:/app] common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/app-deb http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security main] [gw1] [ 29%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-authn_core] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-alias] [gw0] [ 30%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/app-deb http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security main] common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/app-deb-src http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security main] [gw1] [ 30%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-alias] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-authz_core] [gw0] [ 30%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/app-deb-src http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security main] common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/app-deb http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security universe] [gw1] [ 30%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-authz_core] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-authz_host] [gw0] [ 30%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/app-deb http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security universe] common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/app-deb-src http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security universe] [gw1] [ 31%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-authz_host] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-authz_user] [gw0] [ 31%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/app-deb-src http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security universe] common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/app-deb [arch=amd64] {fpf_apt_repo_url} {securedrop_target_distribution} main] [gw1] [ 31%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-authz_user] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-deflate] [gw0] [ 31%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/app-deb [arch=amd64] {fpf_apt_repo_url} {securedrop_target_distribution} main] common/test_automatic_updates.py::test_sources_list[paramiko:/app-deb http:/security.ubuntu.com/ubuntu {securedrop_target_platform}-security main] [gw1] [ 31%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-deflate] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-filter] [gw1] [ 32%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-filter] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-dir] [gw1] [ 32%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-dir] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-headers] [gw0] [ 32%] PASSED common/test_automatic_updates.py::test_sources_list[paramiko:/app-deb http:/security.ubuntu.com/ubuntu {securedrop_target_platform}-security main] common/test_automatic_updates.py::test_sources_list[paramiko:/app-deb http:/security.ubuntu.com/ubuntu {securedrop_target_platform}-security universe] [gw1] [ 32%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-headers] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-mime] [gw1] [ 33%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-mime] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-mpm_event] [gw1] [ 33%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-mpm_event] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-negotiation] [gw1] [ 33%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-negotiation] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-reqtimeout] [gw0] [ 33%] PASSED common/test_automatic_updates.py::test_sources_list[paramiko:/app-deb http:/security.ubuntu.com/ubuntu {securedrop_target_platform}-security universe] common/test_automatic_updates.py::test_sources_list[paramiko:/app-deb http:/archive.ubuntu.com/ubuntu/ {securedrop_target_platform}-updates main] [gw1] [ 33%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-reqtimeout] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-rewrite] [gw1] [ 34%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-rewrite] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-wsgi] [gw1] [ 34%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-wsgi] app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-xsendfile] [gw1] [ 34%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_present[paramiko:/app-xsendfile] app/apache/test_apache_system_config.py::test_apache_modules_absent[paramiko:/app-auth_basic] [gw0] [ 34%] PASSED common/test_automatic_updates.py::test_sources_list[paramiko:/app-deb http:/archive.ubuntu.com/ubuntu/ {securedrop_target_platform}-updates main] common/test_automatic_updates.py::test_sources_list[paramiko:/app-deb http:/archive.ubuntu.com/ubuntu/ {securedrop_target_platform} main] [gw1] [ 34%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_absent[paramiko:/app-auth_basic] app/apache/test_apache_system_config.py::test_apache_modules_absent[paramiko:/app-authn_file] [gw1] [ 35%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_absent[paramiko:/app-authn_file] app/apache/test_apache_system_config.py::test_apache_modules_absent[paramiko:/app-autoindex] [gw1] [ 35%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_absent[paramiko:/app-autoindex] app/apache/test_apache_system_config.py::test_apache_modules_absent[paramiko:/app-env] [gw1] [ 35%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_absent[paramiko:/app-env] app/apache/test_apache_system_config.py::test_apache_modules_absent[paramiko:/app-status] [gw0] [ 35%] PASSED common/test_automatic_updates.py::test_sources_list[paramiko:/app-deb http:/archive.ubuntu.com/ubuntu/ {securedrop_target_platform} main] common/test_automatic_updates.py::test_cron_apt_repo_config_update[paramiko:/app] [gw1] [ 36%] PASSED app/apache/test_apache_system_config.py::test_apache_modules_absent[paramiko:/app-status] app/apache/test_apache_system_config.py::test_apache_logfiles_present[paramiko:/app-/var/log/apache2/access.log] [gw0] [ 36%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_config_update[paramiko:/app] common/test_automatic_updates.py::test_cron_apt_delete_vanilla_kernels[paramiko:/app] [gw0] [ 36%] PASSED common/test_automatic_updates.py::test_cron_apt_delete_vanilla_kernels[paramiko:/app] common/test_automatic_updates.py::test_cron_apt_repo_config_upgrade[paramiko:/app] [gw1] [ 36%] PASSED app/apache/test_apache_system_config.py::test_apache_logfiles_present[paramiko:/app-/var/log/apache2/access.log] app/apache/test_apache_system_config.py::test_apache_logfiles_present[paramiko:/app-/var/log/apache2/error.log] [gw0] [ 36%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_config_upgrade[paramiko:/app] common/test_automatic_updates.py::test_cron_apt_config_deprecated[paramiko:/app] [gw0] [ 37%] PASSED common/test_automatic_updates.py::test_cron_apt_config_deprecated[paramiko:/app] common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/app-cron_job0] [gw1] [ 37%] PASSED app/apache/test_apache_system_config.py::test_apache_logfiles_present[paramiko:/app-/var/log/apache2/error.log] app/apache/test_apache_system_config.py::test_apache_logfiles_present[paramiko:/app-/var/log/apache2/journalist-access.log] [gw0] [ 37%] PASSED common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/app-cron_job0] common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/app-cron_job1] [gw0] [ 37%] PASSED common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/app-cron_job1] common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/app-cron_job2] [gw1] [ 37%] PASSED app/apache/test_apache_system_config.py::test_apache_logfiles_present[paramiko:/app-/var/log/apache2/journalist-access.log] app/apache/test_apache_system_config.py::test_apache_logfiles_present[paramiko:/app-/var/log/apache2/journalist-error.log] [gw0] [ 38%] PASSED common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/app-cron_job2] common/test_automatic_updates.py::test_unattended_upgrades_config[paramiko:/app] [gw1] [ 38%] PASSED app/apache/test_apache_system_config.py::test_apache_logfiles_present[paramiko:/app-/var/log/apache2/journalist-error.log] app/apache/test_apache_system_config.py::test_apache_logfiles_present[paramiko:/app-/var/log/apache2/other_vhosts_access.log] [gw1] [ 38%] PASSED app/apache/test_apache_system_config.py::test_apache_logfiles_present[paramiko:/app-/var/log/apache2/other_vhosts_access.log] app/apache/test_apache_system_config.py::test_apache_logfiles_no_extras[paramiko:/app] [gw0] [ 38%] PASSED common/test_automatic_updates.py::test_unattended_upgrades_config[paramiko:/app] common/test_automatic_updates.py::test_unattended_securedrop_specific[paramiko:/app] [gw1] [ 38%] PASSED app/apache/test_apache_system_config.py::test_apache_logfiles_no_extras[paramiko:/app] app-code/test_haveged.py::test_haveged_config[paramiko:/app] [gw0] [ 39%] PASSED common/test_automatic_updates.py::test_unattended_securedrop_specific[paramiko:/app] common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/app-APT::Periodic::Update-Package-Lists "1";] [gw1] [ 39%] PASSED app-code/test_haveged.py::test_haveged_config[paramiko:/app] app-code/test_haveged.py::test_haveged_no_duplicate_lines[paramiko:/app] [gw1] [ 39%] PASSED app-code/test_haveged.py::test_haveged_no_duplicate_lines[paramiko:/app] app-code/test_haveged.py::test_haveged_is_running[paramiko:/app] [gw1] [ 39%] PASSED app-code/test_haveged.py::test_haveged_is_running[paramiko:/app] app-code/test_securedrop_app_code.py::test_apache_default_docroot_is_absent[paramiko:/app] [gw0] [ 40%] PASSED common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/app-APT::Periodic::Update-Package-Lists "1";] common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/app-APT::Periodic::Unattended-Upgrade "1";] [gw1] [ 40%] PASSED app-code/test_securedrop_app_code.py::test_apache_default_docroot_is_absent[paramiko:/app] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-apache2] [gw1] [ 40%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-apache2] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-apparmor-utils] [gw1] [ 40%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-apparmor-utils] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-coreutils] [gw1] [ 40%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-coreutils] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-gnupg2] [gw0] [ 41%] PASSED common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/app-APT::Periodic::Unattended-Upgrade "1";] common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/app-APT::Periodic::AutocleanInterval "1";] [gw1] [ 41%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-gnupg2] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-haveged] [gw1] [ 41%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-haveged] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-libapache2-mod-xsendfile] [gw1] [ 41%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-libapache2-mod-xsendfile] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-libpython3.8] [gw1] [ 41%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-libpython3.8] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-paxctld] [gw0] [ 42%] PASSED common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/app-APT::Periodic::AutocleanInterval "1";] common/test_automatic_updates.py::test_unattended_upgrades_functional[paramiko:/app] [gw1] [ 42%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-paxctld] app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-python3] [gw1] [ 42%] PASSED app-code/test_securedrop_app_code.py::test_securedrop_application_apt_dependencies[paramiko:/app-python3] common/test_automatic_updates.py::test_automatic_updates_dependencies[paramiko:/mon] [gw0] [ 42%] PASSED common/test_automatic_updates.py::test_unattended_upgrades_functional[paramiko:/app] common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/app-apt-daily] [gw0] [ 43%] PASSED common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/app-apt-daily] common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/app-apt-daily.timer] [gw0] [ 43%] PASSED common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/app-apt-daily.timer] common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/app-apt-daily-upgrade] [gw0] [ 43%] PASSED common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/app-apt-daily-upgrade] common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/app-apt-daily-upgrade.timer] [gw0] [ 43%] PASSED common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/app-apt-daily-upgrade.timer] common/test_automatic_updates.py::test_reboot_required_cron[paramiko:/app] [gw0] [ 43%] PASSED common/test_automatic_updates.py::test_reboot_required_cron[paramiko:/app] common/test_automatic_updates.py::test_all_packages_updated[paramiko:/app] [gw1] [ 44%] PASSED common/test_automatic_updates.py::test_automatic_updates_dependencies[paramiko:/mon] common/test_automatic_updates.py::test_cron_apt_config[paramiko:/mon] [gw1] [ 44%] PASSED common/test_automatic_updates.py::test_cron_apt_config[paramiko:/mon] common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/mon-deb http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security main] [gw0] [ 44%] PASSED common/test_automatic_updates.py::test_all_packages_updated[paramiko:/app] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-WLAN] [gw1] [ 44%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/mon-deb http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security main] common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/mon-deb-src http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security main] [gw1] [ 44%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/mon-deb-src http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security main] common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/mon-deb http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security universe] [gw0] [ 45%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-WLAN] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-NFC] [gw1] [ 45%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/mon-deb http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security universe] common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/mon-deb-src http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security universe] [gw1] [ 45%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/mon-deb-src http:/security.ubuntu.com/ubuntu {securedrop_target_distribution}-security universe] common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/mon-deb [arch=amd64] {fpf_apt_repo_url} {securedrop_target_distribution} main] [gw0] [ 45%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-NFC] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-WIMAX] [gw1] [ 45%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_list[paramiko:/mon-deb [arch=amd64] {fpf_apt_repo_url} {securedrop_target_distribution} main] common/test_automatic_updates.py::test_sources_list[paramiko:/mon-deb http:/security.ubuntu.com/ubuntu {securedrop_target_platform}-security main] [gw0] [ 46%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-WIMAX] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-WIRELESS] [gw1] [ 46%] PASSED common/test_automatic_updates.py::test_sources_list[paramiko:/mon-deb http:/security.ubuntu.com/ubuntu {securedrop_target_platform}-security main] common/test_automatic_updates.py::test_sources_list[paramiko:/mon-deb http:/security.ubuntu.com/ubuntu {securedrop_target_platform}-security universe] [gw0] [ 46%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-WIRELESS] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-HAMRADIO] [gw0] [ 46%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-HAMRADIO] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-IRDA] [gw1] [ 47%] PASSED common/test_automatic_updates.py::test_sources_list[paramiko:/mon-deb http:/security.ubuntu.com/ubuntu {securedrop_target_platform}-security universe] common/test_automatic_updates.py::test_sources_list[paramiko:/mon-deb http:/archive.ubuntu.com/ubuntu/ {securedrop_target_platform}-updates main] [gw0] [ 47%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-IRDA] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-BT] [gw0] [ 47%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/app-BT] common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/app-CONFIG_X86_INTEL_TSX_MODE_OFF] [gw1] [ 47%] PASSED common/test_automatic_updates.py::test_sources_list[paramiko:/mon-deb http:/archive.ubuntu.com/ubuntu/ {securedrop_target_platform}-updates main] common/test_automatic_updates.py::test_sources_list[paramiko:/mon-deb http:/archive.ubuntu.com/ubuntu/ {securedrop_target_platform} main] [gw0] [ 47%] PASSED common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/app-CONFIG_X86_INTEL_TSX_MODE_OFF] common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/app-CONFIG_PAX] [gw0] [ 48%] PASSED common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/app-CONFIG_PAX] common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/app-CONFIG_GRKERNSEC] [gw0] [ 48%] PASSED common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/app-CONFIG_GRKERNSEC] common/test_grsecurity.py::test_mds_mitigations_and_smt_disabled[paramiko:/app] [gw1] [ 48%] PASSED common/test_automatic_updates.py::test_sources_list[paramiko:/mon-deb http:/archive.ubuntu.com/ubuntu/ {securedrop_target_platform} main] common/test_automatic_updates.py::test_cron_apt_repo_config_update[paramiko:/mon] [gw1] [ 48%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_config_update[paramiko:/mon] common/test_automatic_updates.py::test_cron_apt_delete_vanilla_kernels[paramiko:/mon] [gw0] [ 48%] PASSED common/test_grsecurity.py::test_mds_mitigations_and_smt_disabled[paramiko:/app] common/test_grsecurity.py::test_kernel_boot_options[paramiko:/app] [gw1] [ 49%] PASSED common/test_automatic_updates.py::test_cron_apt_delete_vanilla_kernels[paramiko:/mon] common/test_automatic_updates.py::test_cron_apt_repo_config_upgrade[paramiko:/mon] [gw0] [ 49%] PASSED common/test_grsecurity.py::test_kernel_boot_options[paramiko:/app] common/test_grsecurity.py::test_ssh_motd_disabled[paramiko:/mon] [gw1] [ 49%] PASSED common/test_automatic_updates.py::test_cron_apt_repo_config_upgrade[paramiko:/mon] common/test_automatic_updates.py::test_cron_apt_config_deprecated[paramiko:/mon] [gw1] [ 49%] PASSED common/test_automatic_updates.py::test_cron_apt_config_deprecated[paramiko:/mon] common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/mon-cron_job0] [gw1] [ 50%] PASSED common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/mon-cron_job0] common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/mon-cron_job1] [gw1] [ 50%] PASSED common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/mon-cron_job1] common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/mon-cron_job2] [gw1] [ 50%] PASSED common/test_automatic_updates.py::test_cron_apt_cron_jobs[paramiko:/mon-cron_job2] common/test_automatic_updates.py::test_unattended_upgrades_config[paramiko:/mon] [gw0] [ 50%] PASSED common/test_grsecurity.py::test_ssh_motd_disabled[paramiko:/mon] common/test_grsecurity.py::test_grsecurity_apt_packages[paramiko:/mon-linux-image-{}-grsec-securedrop] [gw1] [ 50%] PASSED common/test_automatic_updates.py::test_unattended_upgrades_config[paramiko:/mon] common/test_automatic_updates.py::test_unattended_securedrop_specific[paramiko:/mon] [gw0] [ 51%] PASSED common/test_grsecurity.py::test_grsecurity_apt_packages[paramiko:/mon-linux-image-{}-grsec-securedrop] common/test_grsecurity.py::test_grsecurity_apt_packages[paramiko:/mon-securedrop-grsec] [gw0] [ 51%] PASSED common/test_grsecurity.py::test_grsecurity_apt_packages[paramiko:/mon-securedrop-grsec] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-linux-signed-image-generic-lts-utopic] [gw0] [ 51%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-linux-signed-image-generic-lts-utopic] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-linux-signed-image-generic] [gw0] [ 51%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-linux-signed-image-generic] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-linux-signed-generic-lts-utopic] [gw1] [ 51%] PASSED common/test_automatic_updates.py::test_unattended_securedrop_specific[paramiko:/mon] common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/mon-APT::Periodic::Update-Package-Lists "1";] [gw0] [ 52%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-linux-signed-generic-lts-utopic] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-linux-signed-generic] [gw0] [ 52%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-linux-signed-generic] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-^linux-image-.*generic$] [gw0] [ 52%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-^linux-image-.*generic$] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-^linux-headers-.*] [gw0] [ 52%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/mon-^linux-headers-.*] common/test_grsecurity.py::test_grsecurity_lock_file[paramiko:/mon] [gw1] [ 52%] PASSED common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/mon-APT::Periodic::Update-Package-Lists "1";] common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/mon-APT::Periodic::Unattended-Upgrade "1";] [gw0] [ 53%] PASSED common/test_grsecurity.py::test_grsecurity_lock_file[paramiko:/mon] common/test_grsecurity.py::test_grsecurity_kernel_is_running[paramiko:/mon] [gw0] [ 53%] PASSED common/test_grsecurity.py::test_grsecurity_kernel_is_running[paramiko:/mon] common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/mon-sysctl_opt0] [gw1] [ 53%] PASSED common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/mon-APT::Periodic::Unattended-Upgrade "1";] common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/mon-APT::Periodic::AutocleanInterval "1";] [gw0] [ 53%] PASSED common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/mon-sysctl_opt0] common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/mon-sysctl_opt1] [gw0] [ 54%] PASSED common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/mon-sysctl_opt1] common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/mon-sysctl_opt2] [gw0] [ 54%] PASSED common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/mon-sysctl_opt2] common/test_grsecurity.py::test_grsecurity_paxtest[paramiko:/mon] [gw1] [ 54%] PASSED common/test_automatic_updates.py::test_auto_upgrades_config[paramiko:/mon-APT::Periodic::AutocleanInterval "1";] common/test_automatic_updates.py::test_unattended_upgrades_functional[paramiko:/mon] [gw1] [ 54%] PASSED common/test_automatic_updates.py::test_unattended_upgrades_functional[paramiko:/mon] common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/mon-apt-daily] [gw1] [ 54%] PASSED common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/mon-apt-daily] common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/mon-apt-daily.timer] [gw1] [ 55%] PASSED common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/mon-apt-daily.timer] common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/mon-apt-daily-upgrade] [gw1] [ 55%] PASSED common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/mon-apt-daily-upgrade] common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/mon-apt-daily-upgrade.timer] [gw1] [ 55%] PASSED common/test_automatic_updates.py::test_apt_daily_services_and_timers_enabled[paramiko:/mon-apt-daily-upgrade.timer] common/test_automatic_updates.py::test_reboot_required_cron[paramiko:/mon] [gw1] [ 55%] PASSED common/test_automatic_updates.py::test_reboot_required_cron[paramiko:/mon] common/test_automatic_updates.py::test_all_packages_updated[paramiko:/mon] [gw1] [ 55%] PASSED common/test_automatic_updates.py::test_all_packages_updated[paramiko:/mon] common/test_basic_configuration.py::test_system_time[paramiko:/app] [gw0] [ 56%] PASSED common/test_grsecurity.py::test_grsecurity_paxtest[paramiko:/mon] common/test_grsecurity.py::test_apt_autoremove[paramiko:/mon] [gw0] [ 56%] PASSED common/test_grsecurity.py::test_apt_autoremove[paramiko:/mon] common/test_grsecurity.py::test_paxctl[paramiko:/mon] [gw0] [ 56%] PASSED common/test_grsecurity.py::test_paxctl[paramiko:/mon] common/test_grsecurity.py::test_paxctld_xenial[paramiko:/mon] [gw0] [ 56%] PASSED common/test_grsecurity.py::test_paxctld_xenial[paramiko:/mon] common/test_grsecurity.py::test_paxctld_focal[paramiko:/mon] [gw1] [ 56%] PASSED common/test_basic_configuration.py::test_system_time[paramiko:/app] common/test_basic_configuration.py::test_system_time[paramiko:/mon] [gw0] [ 57%] PASSED common/test_grsecurity.py::test_paxctld_focal[paramiko:/mon] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-WLAN] [gw0] [ 57%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-WLAN] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-NFC] [gw1] [ 57%] PASSED common/test_basic_configuration.py::test_system_time[paramiko:/mon] common/test_fpf_apt_repo.py::test_fpf_apt_repo_present[paramiko:/app] [gw1] [ 57%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_present[paramiko:/app] common/test_fpf_apt_repo.py::test_fpf_apt_repo_fingerprint[paramiko:/app] [gw0] [ 58%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-NFC] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-WIMAX] [gw1] [ 58%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_fingerprint[paramiko:/app] common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/app-pub 4096R/FC9F6818 2014-10-26 [expired: 2016-10-27]] [gw0] [ 58%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-WIMAX] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-WIRELESS] [gw1] [ 58%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/app-pub 4096R/FC9F6818 2014-10-26 [expired: 2016-10-27]] common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/app-pub 4096R/00F4AD77 2016-10-20 [expires: 2017-10-20]] [gw0] [ 58%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-WIRELESS] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-HAMRADIO] [gw1] [ 59%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/app-pub 4096R/00F4AD77 2016-10-20 [expires: 2017-10-20]] common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/app-pub 4096R/00F4AD77 2016-10-20 [expired: 2017-10-20]] [gw0] [ 59%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-HAMRADIO] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-IRDA] [gw1] [ 59%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/app-pub 4096R/00F4AD77 2016-10-20 [expired: 2017-10-20]] common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/app-uid Freedom of the Press Foundation Master Signing Key] [gw1] [ 59%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/app-uid Freedom of the Press Foundation Master Signing Key] common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/app-B89A 29DB 2128 160B 8E4B 1B4C BADD E0C7 FC9F 6818] [gw0] [ 59%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-IRDA] common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-BT] [gw1] [ 60%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/app-B89A 29DB 2128 160B 8E4B 1B4C BADD E0C7 FC9F 6818] common/test_fpf_apt_repo.py::test_fpf_apt_repo_present[paramiko:/mon] [gw0] [ 60%] PASSED common/test_grsecurity.py::test_wireless_disabled_in_kernel_config[paramiko:/mon-BT] common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/mon-CONFIG_X86_INTEL_TSX_MODE_OFF] [gw1] [ 60%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_present[paramiko:/mon] common/test_fpf_apt_repo.py::test_fpf_apt_repo_fingerprint[paramiko:/mon] [gw0] [ 60%] PASSED common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/mon-CONFIG_X86_INTEL_TSX_MODE_OFF] common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/mon-CONFIG_PAX] [gw1] [ 61%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_fingerprint[paramiko:/mon] common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/mon-pub 4096R/FC9F6818 2014-10-26 [expired: 2016-10-27]] [gw0] [ 61%] PASSED common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/mon-CONFIG_PAX] common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/mon-CONFIG_GRKERNSEC] [gw1] [ 61%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/mon-pub 4096R/FC9F6818 2014-10-26 [expired: 2016-10-27]] common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/mon-pub 4096R/00F4AD77 2016-10-20 [expires: 2017-10-20]] [gw1] [ 61%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/mon-pub 4096R/00F4AD77 2016-10-20 [expires: 2017-10-20]] common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/mon-pub 4096R/00F4AD77 2016-10-20 [expired: 2017-10-20]] [gw0] [ 61%] PASSED common/test_grsecurity.py::test_kernel_options_enabled_config[paramiko:/mon-CONFIG_GRKERNSEC] common/test_grsecurity.py::test_mds_mitigations_and_smt_disabled[paramiko:/mon] [gw1] [ 62%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/mon-pub 4096R/00F4AD77 2016-10-20 [expired: 2017-10-20]] common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/mon-uid Freedom of the Press Foundation Master Signing Key] [gw0] [ 62%] PASSED common/test_grsecurity.py::test_mds_mitigations_and_smt_disabled[paramiko:/mon] common/test_grsecurity.py::test_kernel_boot_options[paramiko:/mon] [gw1] [ 62%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/mon-uid Freedom of the Press Foundation Master Signing Key] common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/mon-B89A 29DB 2128 160B 8E4B 1B4C BADD E0C7 FC9F 6818] [gw0] [ 62%] PASSED common/test_grsecurity.py::test_kernel_boot_options[paramiko:/mon] common/test_ip6tables.py::test_ip6tables_drop_everything_xenial[paramiko:/app] [gw0] [ 62%] PASSED common/test_ip6tables.py::test_ip6tables_drop_everything_xenial[paramiko:/app] common/test_ip6tables.py::test_ip6tables_drop_everything_focal[paramiko:/app] [gw1] [ 63%] PASSED common/test_fpf_apt_repo.py::test_fpf_apt_repo_old_pubkeys_absent[paramiko:/mon-B89A 29DB 2128 160B 8E4B 1B4C BADD E0C7 FC9F 6818] common/test_grsecurity.py::test_ssh_motd_disabled[paramiko:/app] [gw0] [ 63%] PASSED common/test_ip6tables.py::test_ip6tables_drop_everything_focal[paramiko:/app] common/test_ip6tables.py::test_ipv6_addresses_absent[paramiko:/app] [gw0] [ 63%] PASSED common/test_ip6tables.py::test_ipv6_addresses_absent[paramiko:/app] common/test_ip6tables.py::test_ip6tables_drop_everything_xenial[paramiko:/mon] [gw0] [ 63%] PASSED common/test_ip6tables.py::test_ip6tables_drop_everything_xenial[paramiko:/mon] common/test_ip6tables.py::test_ip6tables_drop_everything_focal[paramiko:/mon] [gw1] [ 63%] PASSED common/test_grsecurity.py::test_ssh_motd_disabled[paramiko:/app] common/test_grsecurity.py::test_grsecurity_apt_packages[paramiko:/app-linux-image-{}-grsec-securedrop] [gw0] [ 64%] PASSED common/test_ip6tables.py::test_ip6tables_drop_everything_focal[paramiko:/mon] common/test_ip6tables.py::test_ipv6_addresses_absent[paramiko:/mon] [gw0] [ 64%] PASSED common/test_ip6tables.py::test_ipv6_addresses_absent[paramiko:/mon] common/test_platform.py::test_ansible_version[paramiko:/app] [gw1] [ 64%] PASSED common/test_grsecurity.py::test_grsecurity_apt_packages[paramiko:/app-linux-image-{}-grsec-securedrop] common/test_grsecurity.py::test_grsecurity_apt_packages[paramiko:/app-securedrop-grsec] [gw0] [ 64%] PASSED common/test_platform.py::test_ansible_version[paramiko:/app] common/test_platform.py::test_platform[paramiko:/app] [gw0] [ 65%] PASSED common/test_platform.py::test_platform[paramiko:/app] common/test_platform.py::test_ansible_version[paramiko:/mon] [gw0] [ 65%] PASSED common/test_platform.py::test_ansible_version[paramiko:/mon] common/test_platform.py::test_platform[paramiko:/mon] [gw0] [ 65%] PASSED common/test_platform.py::test_platform[paramiko:/mon] common/test_release_upgrades.py::test_release_manager_installed[paramiko:/app] [gw1] [ 65%] PASSED common/test_grsecurity.py::test_grsecurity_apt_packages[paramiko:/app-securedrop-grsec] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-linux-signed-image-generic-lts-utopic] [gw0] [ 65%] PASSED common/test_release_upgrades.py::test_release_manager_installed[paramiko:/app] common/test_release_upgrades.py::test_release_manager_upgrade_channel[paramiko:/app] [gw1] [ 66%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-linux-signed-image-generic-lts-utopic] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-linux-signed-image-generic] [gw1] [ 66%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-linux-signed-image-generic] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-linux-signed-generic-lts-utopic] [gw0] [ 66%] PASSED common/test_release_upgrades.py::test_release_manager_upgrade_channel[paramiko:/app] common/test_release_upgrades.py::test_do_release_upgrade_is_installed[paramiko:/app] [gw1] [ 66%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-linux-signed-generic-lts-utopic] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-linux-signed-generic] [gw0] [ 66%] PASSED common/test_release_upgrades.py::test_do_release_upgrade_is_installed[paramiko:/app] common/test_release_upgrades.py::test_release_manager_installed[paramiko:/mon] [gw1] [ 67%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-linux-signed-generic] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-^linux-image-.*generic$] [gw0] [ 67%] PASSED common/test_release_upgrades.py::test_release_manager_installed[paramiko:/mon] common/test_release_upgrades.py::test_release_manager_upgrade_channel[paramiko:/mon] [gw1] [ 67%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-^linux-image-.*generic$] common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-^linux-headers-.*] [gw0] [ 67%] PASSED common/test_release_upgrades.py::test_release_manager_upgrade_channel[paramiko:/mon] common/test_release_upgrades.py::test_do_release_upgrade_is_installed[paramiko:/mon] [gw1] [ 68%] PASSED common/test_grsecurity.py::test_generic_kernels_absent[paramiko:/app-^linux-headers-.*] common/test_grsecurity.py::test_grsecurity_lock_file[paramiko:/app] [gw0] [ 68%] PASSED common/test_release_upgrades.py::test_do_release_upgrade_is_installed[paramiko:/mon] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt0] [gw0] [ 68%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt0] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt1] [gw1] [ 68%] PASSED common/test_grsecurity.py::test_grsecurity_lock_file[paramiko:/app] common/test_grsecurity.py::test_grsecurity_kernel_is_running[paramiko:/app] [gw0] [ 68%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt1] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt2] [gw1] [ 69%] PASSED common/test_grsecurity.py::test_grsecurity_kernel_is_running[paramiko:/app] common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/app-sysctl_opt0] [gw0] [ 69%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt2] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt3] [gw0] [ 69%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt3] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt4] [gw1] [ 69%] PASSED common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/app-sysctl_opt0] common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/app-sysctl_opt1] [gw0] [ 69%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt4] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt5] [gw1] [ 70%] PASSED common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/app-sysctl_opt1] common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/app-sysctl_opt2] [gw0] [ 70%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt5] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt6] [gw1] [ 70%] PASSED common/test_grsecurity.py::test_grsecurity_sysctl_options[paramiko:/app-sysctl_opt2] common/test_grsecurity.py::test_grsecurity_paxtest[paramiko:/app] [gw0] [ 70%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt6] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt7] [gw0] [ 70%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt7] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt8] [gw0] [ 71%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt8] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt9] [gw0] [ 71%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt9] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt10] [gw0] [ 71%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt10] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt11] [gw0] [ 71%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt11] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt12] [gw0] [ 72%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt12] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt13] [gw0] [ 72%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt13] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt14] [gw0] [ 72%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt14] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt15] [gw0] [ 72%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt15] common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt16] [gw0] [ 72%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/app-sysctl_opt16] common/test_system_hardening.py::test_dns_setting[paramiko:/app] [gw0] [ 73%] PASSED common/test_system_hardening.py::test_dns_setting[paramiko:/app] common/test_system_hardening.py::test_blacklisted_kernel_modules[paramiko:/app-bluetooth] [gw0] [ 73%] PASSED common/test_system_hardening.py::test_blacklisted_kernel_modules[paramiko:/app-bluetooth] common/test_system_hardening.py::test_blacklisted_kernel_modules[paramiko:/app-iwlwifi] [gw1] [ 73%] PASSED common/test_grsecurity.py::test_grsecurity_paxtest[paramiko:/app] common/test_grsecurity.py::test_apt_autoremove[paramiko:/app] [gw1] [ 73%] PASSED common/test_grsecurity.py::test_apt_autoremove[paramiko:/app] common/test_grsecurity.py::test_paxctl[paramiko:/app] [gw0] [ 73%] PASSED common/test_system_hardening.py::test_blacklisted_kernel_modules[paramiko:/app-iwlwifi] common/test_system_hardening.py::test_swap_disabled[paramiko:/app] [gw1] [ 74%] PASSED common/test_grsecurity.py::test_paxctl[paramiko:/app] common/test_grsecurity.py::test_paxctld_xenial[paramiko:/app] [gw1] [ 74%] PASSED common/test_grsecurity.py::test_paxctld_xenial[paramiko:/app] common/test_grsecurity.py::test_paxctld_focal[paramiko:/app] [gw0] [ 74%] PASSED common/test_system_hardening.py::test_swap_disabled[paramiko:/app] common/test_system_hardening.py::test_twofactor_disabled_on_tty[paramiko:/app] [gw0] [ 74%] PASSED common/test_system_hardening.py::test_twofactor_disabled_on_tty[paramiko:/app] common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts0] [gw0] [ 75%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts0] common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts1] [gw0] [ 75%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts1] common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts2] [gw0] [ 75%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts2] common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts3] [gw0] [ 75%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts3] common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts4] [gw1] [ 75%] PASSED common/test_grsecurity.py::test_paxctld_focal[paramiko:/app] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt0] [gw0] [ 76%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts4] common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts5] [gw1] [ 76%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt0] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt1] [gw0] [ 76%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts5] common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts6] [gw1] [ 76%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt1] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt2] [gw0] [ 76%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts6] common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts7] [gw1] [ 77%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt2] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt3] [gw0] [ 77%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts7] common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts8] [gw1] [ 77%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt3] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt4] [gw1] [ 77%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt4] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt5] [gw0] [ 77%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts8] common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts9] [gw1] [ 78%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt5] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt6] [gw0] [ 78%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/app-sshd_opts9] common/test_system_hardening.py::test_no_ecrypt_messages_in_logs[paramiko:/app-/var/log/auth.log] [gw1] [ 78%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt6] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt7] [gw1] [ 78%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt7] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt8] [gw0] [ 79%] PASSED common/test_system_hardening.py::test_no_ecrypt_messages_in_logs[paramiko:/app-/var/log/auth.log] common/test_system_hardening.py::test_no_ecrypt_messages_in_logs[paramiko:/app-/var/log/syslog] [gw1] [ 79%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt8] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt9] [gw1] [ 79%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt9] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt10] [gw1] [ 79%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt10] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt11] [gw0] [ 79%] PASSED common/test_system_hardening.py::test_no_ecrypt_messages_in_logs[paramiko:/app-/var/log/syslog] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-aptitude] [gw1] [ 80%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt11] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt12] [gw1] [ 80%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt12] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt13] [gw0] [ 80%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-aptitude] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-cloud-init] [gw1] [ 80%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt13] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt14] [gw1] [ 80%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt14] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt15] [gw1] [ 81%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt15] common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt16] [gw1] [ 81%] PASSED common/test_system_hardening.py::test_sysctl_options[paramiko:/mon-sysctl_opt16] common/test_system_hardening.py::test_dns_setting[paramiko:/mon] [gw0] [ 81%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-cloud-init] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-libiw30] [gw0] [ 81%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-libiw30] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-python-is-python2] [gw0] [ 81%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-python-is-python2] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-snapd] [gw0] [ 82%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-snapd] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-torsocks] [gw1] [ 82%] PASSED common/test_system_hardening.py::test_dns_setting[paramiko:/mon] common/test_system_hardening.py::test_blacklisted_kernel_modules[paramiko:/mon-bluetooth] [gw0] [ 82%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-torsocks] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-wireless-tools] [gw0] [ 82%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-wireless-tools] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-wpasupplicant] [gw1] [ 83%] PASSED common/test_system_hardening.py::test_blacklisted_kernel_modules[paramiko:/mon-bluetooth] common/test_system_hardening.py::test_blacklisted_kernel_modules[paramiko:/mon-iwlwifi] [gw0] [ 83%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/app-wpasupplicant] common/test_system_hardening.py::test_iptables_packages[paramiko:/app] [gw1] [ 83%] PASSED common/test_system_hardening.py::test_blacklisted_kernel_modules[paramiko:/mon-iwlwifi] common/test_system_hardening.py::test_swap_disabled[paramiko:/mon] [gw0] [ 83%] PASSED common/test_system_hardening.py::test_iptables_packages[paramiko:/app] common/test_system_hardening.py::test_snapd_absent[paramiko:/app] [gw1] [ 83%] PASSED common/test_system_hardening.py::test_swap_disabled[paramiko:/mon] common/test_system_hardening.py::test_twofactor_disabled_on_tty[paramiko:/mon] [gw1] [ 84%] PASSED common/test_system_hardening.py::test_twofactor_disabled_on_tty[paramiko:/mon] common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts0] [gw1] [ 84%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts0] common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts1] [gw1] [ 84%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts1] common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts2] [gw0] [ 84%] PASSED common/test_system_hardening.py::test_snapd_absent[paramiko:/app] common/test_system_hardening.py::test_no_ecrypt_messages_in_logs[paramiko:/mon-/var/log/syslog] [gw1] [ 84%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts2] common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts3] [gw1] [ 85%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts3] common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts4] [gw1] [ 85%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts4] common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts5] [gw0] [ 85%] PASSED common/test_system_hardening.py::test_no_ecrypt_messages_in_logs[paramiko:/mon-/var/log/syslog] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-aptitude] [gw1] [ 85%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts5] common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts6] [gw0] [ 86%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-aptitude] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-cloud-init] [gw1] [ 86%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts6] common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts7] [gw0] [ 86%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-cloud-init] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-libiw30] [gw1] [ 86%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts7] common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts8] [gw0] [ 86%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-libiw30] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-python-is-python2] [gw1] [ 87%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts8] common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts9] [gw0] [ 87%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-python-is-python2] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-snapd] [gw1] [ 87%] PASSED common/test_system_hardening.py::test_sshd_config[paramiko:/mon-sshd_opts9] common/test_system_hardening.py::test_no_ecrypt_messages_in_logs[paramiko:/mon-/var/log/auth.log] [gw0] [ 87%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-snapd] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-torsocks] [gw0] [ 87%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-torsocks] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-wireless-tools] [gw1] [ 88%] PASSED common/test_system_hardening.py::test_no_ecrypt_messages_in_logs[paramiko:/mon-/var/log/auth.log] common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/app-Key fingerprint = A3C4 F0F9 79CA A22C DBA8 F512 EE8C BC9E 886D DD89] [gw1] [ 88%] PASSED common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/app-Key fingerprint = A3C4 F0F9 79CA A22C DBA8 F512 EE8C BC9E 886D DD89] common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/app-deb.torproject.org archive signing key] [gw0] [ 88%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-wireless-tools] common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-wpasupplicant] [gw0] [ 88%] PASSED common/test_system_hardening.py::test_unused_packages_are_removed[paramiko:/mon-wpasupplicant] common/test_system_hardening.py::test_iptables_packages[paramiko:/mon] [gw1] [ 88%] PASSED common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/app-deb.torproject.org archive signing key] common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/app-deb.torproject.org] [gw0] [ 89%] PASSED common/test_system_hardening.py::test_iptables_packages[paramiko:/mon] common/test_system_hardening.py::test_snapd_absent[paramiko:/mon] [gw1] [ 89%] PASSED common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/app-deb.torproject.org] common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/app-tor-apt.freedom.press] [gw1] [ 89%] PASSED common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/app-tor-apt.freedom.press] common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/app-tor-apt-test.freedom.press] [gw1] [ 89%] PASSED common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/app-tor-apt-test.freedom.press] common/test_tor_mirror.py::test_tor_mirror_absent[paramiko:/mon-/etc/apt/sources.list.d/deb_torproject_org_torproject_org.list] [gw1] [ 90%] PASSED common/test_tor_mirror.py::test_tor_mirror_absent[paramiko:/mon-/etc/apt/sources.list.d/deb_torproject_org_torproject_org.list] common/test_tor_mirror.py::test_tor_keyring_absent[paramiko:/mon] [gw0] [ 90%] PASSED common/test_system_hardening.py::test_snapd_absent[paramiko:/mon] common/test_tor_mirror.py::test_tor_mirror_absent[paramiko:/app-/etc/apt/sources.list.d/deb_torproject_org_torproject_org.list] [gw1] [ 90%] PASSED common/test_tor_mirror.py::test_tor_keyring_absent[paramiko:/mon] common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/mon-pub 2048R/886DDD89 2009-09-04 [expires: 2020-08-29]] [gw0] [ 90%] PASSED common/test_tor_mirror.py::test_tor_mirror_absent[paramiko:/app-/etc/apt/sources.list.d/deb_torproject_org_torproject_org.list] common/test_tor_mirror.py::test_tor_keyring_absent[paramiko:/app] [gw1] [ 90%] PASSED common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/mon-pub 2048R/886DDD89 2009-09-04 [expires: 2020-08-29]] common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/mon-Key fingerprint = A3C4 F0F9 79CA A22C DBA8 F512 EE8C BC9E 886D DD89] [gw0] [ 91%] PASSED common/test_tor_mirror.py::test_tor_keyring_absent[paramiko:/app] common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/app-pub 2048R/886DDD89 2009-09-04 [expires: 2020-08-29]] [gw1] [ 91%] PASSED common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/mon-Key fingerprint = A3C4 F0F9 79CA A22C DBA8 F512 EE8C BC9E 886D DD89] common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/mon-deb.torproject.org archive signing key] [gw0] [ 91%] PASSED common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/app-pub 2048R/886DDD89 2009-09-04 [expires: 2020-08-29]] common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/mon-tor-apt.freedom.press] [gw1] [ 91%] PASSED common/test_tor_mirror.py::test_tor_mirror_fingerprint[paramiko:/mon-deb.torproject.org archive signing key] common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/mon-deb.torproject.org] [gw0] [ 91%] PASSED common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/mon-tor-apt.freedom.press] common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/mon-tor-apt-test.freedom.press] [gw1] [ 92%] PASSED common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/mon-deb.torproject.org] mon/test_ossec_ruleset.py::test_ossec_false_positives_suppressed[paramiko:/mon-log_event0] [gw0] [ 92%] PASSED common/test_tor_mirror.py::test_tor_repo_absent[paramiko:/mon-tor-apt-test.freedom.press] common/test_user_config.py::test_sudoers_config[paramiko:/app] [gw1] [ 92%] PASSED mon/test_ossec_ruleset.py::test_ossec_false_positives_suppressed[paramiko:/mon-log_event0] mon/test_ossec_ruleset.py::test_ossec_false_positives_suppressed[paramiko:/mon-log_event1] [gw1] [ 92%] PASSED mon/test_ossec_ruleset.py::test_ossec_false_positives_suppressed[paramiko:/mon-log_event1] mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event0] [gw1] [ 93%] PASSED mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event0] mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event1] [gw0] [ 93%] PASSED common/test_user_config.py::test_sudoers_config[paramiko:/app] common/test_user_config.py::test_sudoers_tmux_env[paramiko:/app] [gw1] [ 93%] PASSED mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event1] mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event2] [gw0] [ 93%] PASSED common/test_user_config.py::test_sudoers_tmux_env[paramiko:/app] common/test_user_config.py::test_tmux_installed[paramiko:/app] [gw1] [ 93%] PASSED mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event2] mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event3] [gw0] [ 94%] PASSED common/test_user_config.py::test_tmux_installed[paramiko:/app] common/test_user_config.py::test_sudoers_config[paramiko:/mon] [gw1] [ 94%] PASSED mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event3] mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event4] [gw1] [ 94%] PASSED mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event4] mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event5] [gw1] [ 94%] PASSED mon/test_ossec_ruleset.py::test_ossec_expected_alerts_are_present[paramiko:/mon-log_event5] mon/test_ossec_server.py::test_ossec_connectivity[paramiko:/mon] [gw1] [ 94%] PASSED mon/test_ossec_server.py::test_ossec_connectivity[paramiko:/mon] mon/test_ossec_server.py::test_ossec_service_start_style[paramiko:/mon] [gw0] [ 95%] PASSED common/test_user_config.py::test_sudoers_config[paramiko:/mon] common/test_user_config.py::test_sudoers_tmux_env[paramiko:/mon] [gw0] [ 95%] PASSED common/test_user_config.py::test_sudoers_tmux_env[paramiko:/mon] common/test_user_config.py::test_tmux_installed[paramiko:/mon] [gw0] [ 95%] PASSED common/test_user_config.py::test_tmux_installed[paramiko:/mon] mon/test_ossec_server.py::test_ossec_keyfiles[paramiko:/mon-/var/ossec/etc/sslmanager.cert] [gw1] [ 95%] PASSED mon/test_ossec_server.py::test_ossec_service_start_style[paramiko:/mon] mon/test_ossec_server.py::test_ossec_keyfiles[paramiko:/mon-/var/ossec/etc/sslmanager.key] [gw1] [ 95%] XFAIL mon/test_ossec_server.py::test_ossec_keyfiles[paramiko:/mon-/var/ossec/etc/sslmanager.key] mon/test_ossec_server.py::test_hosts_files[paramiko:/mon] [gw1] [ 96%] PASSED mon/test_ossec_server.py::test_hosts_files[paramiko:/mon] mon/test_ossec_server.py::test_ossec_log_contains_no_malformed_events[paramiko:/mon] [gw1] [ 96%] PASSED mon/test_ossec_server.py::test_ossec_log_contains_no_malformed_events[paramiko:/mon] mon/test_ossec_server.py::test_regression_hosts[paramiko:/mon] [gw0] [ 96%] XFAIL mon/test_ossec_server.py::test_ossec_keyfiles[paramiko:/mon-/var/ossec/etc/sslmanager.cert] mon/test_ossec_server.py::test_procmail_log[paramiko:/mon] [gw1] [ 96%] PASSED mon/test_ossec_server.py::test_regression_hosts[paramiko:/mon] mon/test_postfix.py::test_postfix_headers[paramiko:/mon-/^X-Originating-IP:/ IGNORE] [gw1] [ 97%] PASSED mon/test_postfix.py::test_postfix_headers[paramiko:/mon-/^X-Originating-IP:/ IGNORE] mon/test_postfix.py::test_postfix_headers[paramiko:/mon-/^X-Mailer:/ IGNORE] [gw0] [ 97%] XPASS mon/test_ossec_server.py::test_procmail_log[paramiko:/mon] mon/test_ossec_server.py::test_ossec_authd[paramiko:/mon] [gw0] [ 97%] PASSED mon/test_ossec_server.py::test_ossec_authd[paramiko:/mon] mon/test_postfix.py::test_postfix_headers[paramiko:/mon-/^User-Agent:/ IGNORE] [gw1] [ 97%] PASSED mon/test_postfix.py::test_postfix_headers[paramiko:/mon-/^X-Mailer:/ IGNORE] mon/test_postfix.py::test_postfix_headers[paramiko:/mon-/^Mime-Version:/ IGNORE] [gw0] [ 97%] PASSED mon/test_postfix.py::test_postfix_headers[paramiko:/mon-/^User-Agent:/ IGNORE] mon/test_postfix.py::test_postfix_headers[paramiko:/mon-/^Received:/ IGNORE] [gw1] [ 98%] PASSED mon/test_postfix.py::test_postfix_headers[paramiko:/mon-/^Mime-Version:/ IGNORE] mon/test_postfix.py::test_postfix_generic_maps[paramiko:/mon] [gw0] [ 98%] PASSED mon/test_postfix.py::test_postfix_headers[paramiko:/mon-/^Received:/ IGNORE] mon/test_postfix.py::test_postfix_service[paramiko:/mon] [gw1] [ 98%] PASSED mon/test_postfix.py::test_postfix_generic_maps[paramiko:/mon] ossec/test_journalist_mail.py::TestJournalistMail::test_procmail[local] [gw1] [ 98%] SKIPPED ossec/test_journalist_mail.py::TestJournalistMail::test_procmail[local] ossec/test_journalist_mail.py::TestJournalistMail::test_send_encrypted_alert[local] [gw1] [ 98%] SKIPPED ossec/test_journalist_mail.py::TestJournalistMail::test_send_encrypted_alert[local] ossec/test_journalist_mail.py::TestJournalistMail::test_missing_journalist_alert[local] [gw1] [ 99%] SKIPPED ossec/test_journalist_mail.py::TestJournalistMail::test_missing_journalist_alert[local] ossec/test_journalist_mail.py::TestJournalistMail::test_ossec_rule_journalist[local] [gw1] [ 99%] SKIPPED ossec/test_journalist_mail.py::TestJournalistMail::test_ossec_rule_journalist[local] ossec/test_journalist_mail.py::TestJournalistMail::test_journalist_mail_notification[local] [gw1] [ 99%] SKIPPED ossec/test_journalist_mail.py::TestJournalistMail::test_journalist_mail_notification[local] [gw0] [ 99%] PASSED mon/test_postfix.py::test_postfix_service[paramiko:/mon] ossec/test_journalist_mail.py::TestJournalistMail::test_process_submissions_today[local] [gw0] [100%] SKIPPED ossec/test_journalist_mail.py::TestJournalistMail::test_process_submissions_today[local] ================================================= 461 passed, 7 skipped, 3 xfailed, 1 xpassed, 8 warnings in 793.05s (0:13:13) ================================================= -------- Verification complete - to restore the default workstation environment, remove ~/Persistent/securedrop/admin/.venv3 and run 'cd ~/Persistent/securedrop && ./securedrop-admin setup' ```

[eloquence]

meltdown results on NUC10 looking good, detailed output below. Seeing the same test failure reported in #5040, likely for the same reason (also seeing the grsec denied write to CPU MSR directly caused by the script in syslog).

meltdown deets

Spectre and Meltdown mitigation detection tool v0.44+ Checking for vulnerabilities on current system Kernel is Linux 5.4.97-grsec-securedrop #1 SMP @1309379017 x86_64 CPU is Intel(R) Core(TM) i5-10210U CPU @ 1.60GHz Hardware check * Hardware support (CPU microcode) for mitigation techniques * Indirect Branch Restricted Speculation (IBRS) * SPEC_CTRL MSR is available: YES * CPU indicates IBRS capability: YES (SPEC_CTRL feature bit) * Indirect Branch Prediction Barrier (IBPB) * PRED_CMD MSR is available: NO * CPU indicates IBPB capability: YES (SPEC_CTRL feature bit) * Single Thread Indirect Branch Predictors (STIBP) * SPEC_CTRL MSR is available: YES * CPU indicates STIBP capability: YES (Intel STIBP feature bit) * Speculative Store Bypass Disable (SSBD) * CPU indicates SSBD capability: YES (Intel SSBD) * L1 data cache invalidation * FLUSH_CMD MSR is available: NO * CPU indicates L1D flush capability: YES (L1D flush feature bit) * Microarchitectural Data Sampling * VERW instruction is available: YES (MD_CLEAR feature bit) * Enhanced IBRS (IBRS_ALL) * CPU indicates ARCH_CAPABILITIES MSR availability: YES * ARCH_CAPABILITIES MSR advertises IBRS_ALL capability: YES * CPU explicitly indicates not being vulnerable to Meltdown/L1TF (RDCL_NO): YES * CPU explicitly indicates not being vulnerable to Variant 4 (SSB_NO): NO * CPU/Hypervisor indicates L1D flushing is not necessary on this system: YES * Hypervisor indicates host CPU might be vulnerable to RSB underflow (RSBA): NO * CPU explicitly indicates not being vulnerable to Microarchitectural Data Sampling (MDS_NO): YES * CPU explicitly indicates not being vulnerable to TSX Asynchronous Abort (TAA_NO): NO * CPU explicitly indicates not being vulnerable to iTLB Multihit (PSCHANGE_MSC_NO): NO * CPU explicitly indicates having MSR for TSX control (TSX_CTRL_MSR): NO * CPU supports Transactional Synchronization Extensions (TSX): NO * CPU supports Software Guard Extensions (SGX): YES * CPU supports Special Register Buffer Data Sampling (SRBDS): YES * CPU microcode is known to cause stability problems: NO (family 0x6 model 0x8e stepping 0xc ucode 0xde cpuid 0x806ec) * CPU microcode is the latest known available version: YES (latest version is 0xde dated 2020/05/18 according to builtin firmwares DB v165.20201021+i20200616) * CPU vulnerability to the speculative execution attack variants * Affected by CVE-2017-5753 (Spectre Variant 1, bounds check bypass): YES * Affected by CVE-2017-5715 (Spectre Variant 2, branch target injection): YES * Affected by CVE-2017-5754 (Variant 3, Meltdown, rogue data cache load): NO * Affected by CVE-2018-3640 (Variant 3a, rogue system register read): YES * Affected by CVE-2018-3639 (Variant 4, speculative store bypass): YES * Affected by CVE-2018-3615 (Foreshadow (SGX), L1 terminal fault): YES * Affected by CVE-2018-3620 (Foreshadow-NG (OS), L1 terminal fault): YES * Affected by CVE-2018-3646 (Foreshadow-NG (VMM), L1 terminal fault): YES * Affected by CVE-2018-12126 (Fallout, microarchitectural store buffer data sampling (MSBDS)): NO * Affected by CVE-2018-12130 (ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)): NO * Affected by CVE-2018-12127 (RIDL, microarchitectural load port data sampling (MLPDS)): NO * Affected by CVE-2019-11091 (RIDL, microarchitectural data sampling uncacheable memory (MDSUM)): NO * Affected by CVE-2019-11135 (ZombieLoad V2, TSX Asynchronous Abort (TAA)): NO * Affected by CVE-2018-12207 (No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)): YES * Affected by CVE-2020-0543 (Special Register Buffer Data Sampling (SRBDS)): NO CVE-2017-5753 aka 'Spectre Variant 1, bounds check bypass' * Mitigated according to the /sys interface: YES (Mitigation: usercopy/swapgs barriers and __user pointer sanitization (complete, automated)) * Kernel has array_index_mask_nospec: UNKNOWN (couldn't check (missing 'readelf' tool, please install it, usually it's in the 'binutils' package)) * Kernel has the Red Hat/Ubuntu patch: UNKNOWN (missing 'strings' tool, please install it, usually it's in the binutils package) * Kernel has mask_nospec64 (arm64): UNKNOWN (couldn't check (missing 'readelf' tool, please install it, usually it's in the 'binutils' package)) * Kernel has array_index_nospec (arm64): UNKNOWN (couldn't check (missing 'readelf' tool, please install it, usually it's in the 'binutils' package)) * Checking count of LFENCE instructions following a jump in kernel... UNKNOWN (couldn't check (missing 'readelf' tool, please install it, usually it's in the 'binutils' package)) > STATUS: NOT VULNERABLE (Mitigation: usercopy/swapgs barriers and __user pointer sanitization (complete, automated)) CVE-2017-5715 aka 'Spectre Variant 2, branch target injection' * Mitigated according to the /sys interface: YES (Mitigation: Enhanced IBRS, IBPB: conditional, RSB filling) * Mitigation 1 * Kernel is compiled with IBRS support: YES * IBRS enabled and active: YES (Enhanced flavor, performance impact will be greatly reduced) * Kernel is compiled with IBPB support: YES * IBPB enabled and active: YES * Mitigation 2 * Kernel has branch predictor hardening (arm): NO * Kernel compiled with retpoline option: YES * Kernel supports RSB filling: YES > STATUS: NOT VULNERABLE (Enhanced IBRS + IBPB are mitigating the vulnerability) CVE-2017-5754 aka 'Variant 3, Meltdown, rogue data cache load' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports Page Table Isolation (PTI): NO * PTI enabled and active: NO * Reduced performance impact of PTI: YES (CPU supports INVPCID, performance impact of PTI will be greatly reduced) * Running as a Xen PV DomU: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) CVE-2018-3640 aka 'Variant 3a, rogue system register read' * CPU microcode mitigates the vulnerability: YES > STATUS: NOT VULNERABLE (your CPU microcode mitigates the vulnerability) CVE-2018-3639 aka 'Variant 4, speculative store bypass' * Mitigated according to the /sys interface: YES (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) * Kernel supports disabling speculative store bypass (SSB): YES (found in /proc/self/status) * SSB mitigation is enabled and active: YES (per-thread through prctl) * SSB mitigation currently active for selected processes: YES (haveged irqbalance python3.8 redis-check-rdb systemd-journald systemd-logind systemd-networkd systemd-timesyncd systemd-udevd tor) > STATUS: NOT VULNERABLE (Mitigation: Speculative Store Bypass disabled via prctl and seccomp) CVE-2018-3615 aka 'Foreshadow (SGX), L1 terminal fault' * CPU microcode mitigates the vulnerability: NO > STATUS: VULNERABLE (your CPU supports SGX and the microcode is not up to date) CVE-2018-3620 aka 'Foreshadow-NG (OS), L1 terminal fault' * Mitigated according to the /sys interface: YES (Mitigation: PTE Inversion; VMX: flush not necessary, SMT vulnerable) * Kernel supports PTE inversion: UNKNOWN (missing 'strings' tool, please install it) * PTE inversion enabled and active: YES > STATUS: NOT VULNERABLE (Mitigation: PTE Inversion; VMX: flush not necessary, SMT vulnerable) CVE-2018-3646 aka 'Foreshadow-NG (VMM), L1 terminal fault' * Information from the /sys interface: Mitigation: PTE Inversion; VMX: flush not necessary, SMT vulnerable * This system is a host running a hypervisor: NO * Mitigation 1 (KVM) * EPT is disabled: NO * Mitigation 2 * L1D flush is supported by kernel: YES (found flush_l1d in /proc/cpuinfo) * L1D flush enabled: NO * Hardware-backed L1D flush supported: YES (performance impact of the mitigation will be greatly reduced) * Hyper-Threading (SMT) is enabled: YES > STATUS: NOT VULNERABLE (this system is not running a hypervisor) CVE-2018-12126 aka 'Fallout, microarchitectural store buffer data sampling (MSBDS)' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active: NO * SMT is either mitigated or disabled: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) CVE-2018-12130 aka 'ZombieLoad, microarchitectural fill buffer data sampling (MFBDS)' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active: NO * SMT is either mitigated or disabled: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) CVE-2018-12127 aka 'RIDL, microarchitectural load port data sampling (MLPDS)' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active: NO * SMT is either mitigated or disabled: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) CVE-2019-11091 aka 'RIDL, microarchitectural data sampling uncacheable memory (MDSUM)' * Mitigated according to the /sys interface: YES (Not affected) * Kernel supports using MD_CLEAR mitigation: YES (md_clear found in /proc/cpuinfo) * Kernel mitigation is enabled and active: NO * SMT is either mitigated or disabled: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) CVE-2019-11135 aka 'ZombieLoad V2, TSX Asynchronous Abort (TAA)' * Mitigated according to the /sys interface: YES (Not affected) * TAA mitigation is supported by kernel: UNKNOWN (missing 'readelf' tool, please install it, usually it's in the 'binutils' package) * TAA mitigation enabled and active: NO > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) CVE-2018-12207 aka 'No eXcuses, iTLB Multihit, machine check exception on page size changes (MCEPSC)' * Mitigated according to the /sys interface: YES (KVM: Mitigation: Split huge pages) * This system is a host running a hypervisor: NO * iTLB Multihit mitigation is supported by kernel: UNKNOWN (missing 'readelf' tool, please install it, usually it's in the 'binutils' package) * iTLB Multihit mitigation enabled and active: YES (KVM: Mitigation: Split huge pages) > STATUS: NOT VULNERABLE (this system is not running a hypervisor) CVE-2020-0543 aka 'Special Register Buffer Data Sampling (SRBDS)' * Mitigated according to the /sys interface: YES (Mitigation: TSX disabled) * SRBDS mitigation control is supported by the kernel: UNKNOWN (missing 'readelf' tool, please install it, usually it's in the 'binutils' package) * SRBDS mitigation control is enabled and active: YES (Mitigation: TSX disabled) > STATUS: NOT VULNERABLE (your CPU vendor reported your CPU model as not vulnerable) > SUMMARY: CVE-2017-5753:OK CVE-2017-5715:OK CVE-2017-5754:OK CVE-2018-3640:OK CVE-2018-3639:OK CVE-2018-3615:KO CVE-2018-3620:OK CVE-2018-3646:OK CVE-2018-12126:OK CVE-2018-12130:OK CVE-2018-12127:OK CVE-2019-11091:OK CVE-2019-11135:OK CVE-2018-12207:OK CVE-2020-0543:OK Need more detailed information about mitigation options? Use --explain A false sense of security is worse than no security at all, see --disclaimer

[eloquence]

Beyond that, I see three grsec lines in syslog / kern.log on boot, for setting time via systemd and for setting rwxmap_logging to 0 and grsec_lock to 1, as expected. Nothing else notable in logs, let me know if you'd like me to poke around further.