search

pyllyukko / harden.yml

Ansible playbook for Linux hardening
MIT License
75 stars 9 forks source link

PAM: Proper tests with libpamtest #61

Open pyllyukko opened 4 years ago

pyllyukko commented 4 years ago

https://cwrap.org/pam_wrapper.html

Relates to #17

How

Mimic regular services and their PAM stacks by replacing pam_unix with pam_matrix and running tests with libpamtest. This needs to be done in a temporary container, because we modify files such as /etc/pam.d/common-auth and affect whole authentication of the system.

Test cases

Services (at least the following):

Service Modifications Group Account Password Expected result
login With pam_unix & pam_securetty disabled auth root ✗ Denied by pam_unix
login pam_unix replaced with pam_matrix auth root ✓ Denied by pam_securetty
login With pam_matrix & pam_securetty disabled auth root ✓ Allowed
pyllyukko commented 4 years ago

First tests:

asciicast