131 lines
3.7 KiB
Bash
Executable File
131 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ©AngelaMos | 2026
|
|
# test_05_access.sh
|
|
#
|
|
# Tests for CIS Section 5 (Access) SSH hardening checks
|
|
#
|
|
# Uses pass and fail fixture directories to verify sshd_config
|
|
# parsing for LogLevel (5.2.4), MaxAuthTries (5.2.6), X11Forwarding
|
|
# (5.2.5), IgnoreRhosts (5.2.7), PermitRootLogin (5.2.8),
|
|
# PermitEmptyPasswords (5.2.9), and weak cipher rejection (5.2.11).
|
|
# Each test asserts the expected status and evidence substrings
|
|
# against fixture sshd_config files containing compliant and
|
|
# non-compliant directive values.
|
|
#
|
|
# Connects to:
|
|
# checks/05_access.sh - check functions under test
|
|
# tests/test_helpers.sh - setup_test, assert_status,
|
|
# assert_evidence_contains
|
|
|
|
test_5_2_4_pass() {
|
|
CURRENT_TEST="test_5_2_4_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_5_2_4
|
|
assert_status "5.2.4" "PASS"
|
|
assert_evidence_contains "5.2.4" "LogLevel"
|
|
}
|
|
|
|
test_5_2_4_fail() {
|
|
CURRENT_TEST="test_5_2_4_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_5_2_4
|
|
assert_status "5.2.4" "FAIL"
|
|
assert_evidence_contains "5.2.4" "QUIET"
|
|
}
|
|
|
|
test_5_2_6_pass() {
|
|
CURRENT_TEST="test_5_2_6_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_5_2_6
|
|
assert_status "5.2.6" "PASS"
|
|
assert_evidence_contains "5.2.6" "MaxAuthTries = 4"
|
|
}
|
|
|
|
test_5_2_6_fail() {
|
|
CURRENT_TEST="test_5_2_6_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_5_2_6
|
|
assert_status "5.2.6" "FAIL"
|
|
assert_evidence_contains "5.2.6" "expected 4 or less"
|
|
}
|
|
|
|
test_5_2_8_pass() {
|
|
CURRENT_TEST="test_5_2_8_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_5_2_8
|
|
assert_status "5.2.8" "PASS"
|
|
assert_evidence_contains "5.2.8" "root login is disabled"
|
|
}
|
|
|
|
test_5_2_8_fail() {
|
|
CURRENT_TEST="test_5_2_8_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_5_2_8
|
|
assert_status "5.2.8" "FAIL"
|
|
assert_evidence_contains "5.2.8" "expected no"
|
|
}
|
|
|
|
test_5_2_9_pass() {
|
|
CURRENT_TEST="test_5_2_9_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_5_2_9
|
|
assert_status "5.2.9" "PASS"
|
|
assert_evidence_contains "5.2.9" "empty passwords are disabled"
|
|
}
|
|
|
|
test_5_2_9_fail() {
|
|
CURRENT_TEST="test_5_2_9_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_5_2_9
|
|
assert_status "5.2.9" "FAIL"
|
|
assert_evidence_contains "5.2.9" "expected no"
|
|
}
|
|
|
|
test_5_2_11_pass() {
|
|
CURRENT_TEST="test_5_2_11_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_5_2_11
|
|
assert_status "5.2.11" "PASS"
|
|
assert_evidence_contains "5.2.11" "strong SSH ciphers"
|
|
}
|
|
|
|
test_5_2_11_fail() {
|
|
CURRENT_TEST="test_5_2_11_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_5_2_11
|
|
assert_status "5.2.11" "FAIL"
|
|
assert_evidence_contains "5.2.11" "Weak SSH ciphers"
|
|
}
|
|
|
|
test_5_2_5_pass() {
|
|
CURRENT_TEST="test_5_2_5_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_5_2_5
|
|
assert_status "5.2.5" "PASS"
|
|
assert_evidence_contains "5.2.5" "X11Forwarding is disabled"
|
|
}
|
|
|
|
test_5_2_5_fail() {
|
|
CURRENT_TEST="test_5_2_5_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_5_2_5
|
|
assert_status "5.2.5" "FAIL"
|
|
assert_evidence_contains "5.2.5" "expected no"
|
|
}
|
|
|
|
test_5_2_7_pass() {
|
|
CURRENT_TEST="test_5_2_7_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_5_2_7
|
|
assert_status "5.2.7" "PASS"
|
|
assert_evidence_contains "5.2.7" "IgnoreRhosts = yes"
|
|
}
|
|
|
|
test_5_2_7_fail() {
|
|
CURRENT_TEST="test_5_2_7_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_5_2_7
|
|
assert_status "5.2.7" "FAIL"
|
|
assert_evidence_contains "5.2.7" "expected yes"
|
|
}
|