Increase test coverage

[pyllyukko]

What started in the tests branch...

General

• Make sure parallelism doesn't break the Debian tests

PAM

• pam_lastlog in /etc/pam.d/gdm-password
• limiting password reuse in *
• removing nullok from /etc/pam.d/common-auth
• configuring pwquality
• Everything against CentOS
• PAM: Proper tests with libpamtest #61

Easy ones

• disable_gdm3_user_list()
• Certificates?
  • Test ca-certificates.conf.new by connecting to bunch of places
  • Also do make crls
• PGP keys
• sysstat
• configure_password_policies()

Lot of work

• All the rest 👅

TODO / Ideas

• Molecule
  • https://alien.slackbook.org/blog/my-docker-packages-for-slackware-current/
  • kernel tag requires procps-ng package
  • sudoers: Overcome sorry, you must have a tty to run sudo
    • https://stackoverflow.com/questions/35597076/ansible-sudo-sorry-you-must-have-a-tty-to-run-sudo suggests to use paramiko
  • filesystem idempotence:
    • fstab
    • CAP_NET_RAW in ping
  • Debian Docker image does not have systemd?!
  • Order of tasks with Debian:
    • logrotate installs exim4 and creates Debian-exim account. If login_defs is ran before logging at least the idempotence of ftpusers will fail. Also the idempotence of "Lock system accounts" probably fails if it's run before any account creating tasks. logrotate also installs cron, which breaks more things.
  • audit is difficult, as rules are downloaded, modded and generated
  • Test aide in Debian (because with Slackware it would have to be installed through SBo)
  • Verifier! (verify.yml)
  • molecule-idempotence-notest tag?
  • Skip yara tag with ClamAV
  • How to get artifacts from within the containers before Molecule executes destroy?
    • Added docker volume mounting ansible/molecule#277
  • Collect changes from debsums

TASK [Copy /etc/sudoers.new to /etc/sudoers] ***********************************
changed: [molecule-slackware]

TASK [Remove /etc/sudoers.new] *************************************************
fatal: [molecule-slackware]: FAILED! => {"changed": false, "module_stderr": "sudo: sorry, you must have a tty to run sudo\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

Installation of logrotate:

The following NEW packages will be installed:
  bsd-mailx ca-certificates cron cron-daemon-common exim4-base exim4-config exim4-daemon-light krb5-locales libbsd0 libevent-2.1-7 libgnutls-dane0 libgssapi-krb5-2 libidn12 libk5crypto3
  libkeyutils1 libkrb5-3 libkrb5support0 liblockfile-bin liblockfile1 libnsl2 libpopt0 libssl3 libtirpc-common libtirpc3 libunbound8 logrotate netbase openssl psmisc sensible-utils

A plan

• Add "minimal" support for Ubuntu for GH runner(s)
• Run playbook by tag
  • --skip-tags slackware
• Run Lynis (Use Lynis to test hardenings before & after #21)
  • Collect Lynis log as artifact?
  • Fail on low score?
• Start with something simple and measurable (and in userland)
  • Banners
  • PAM
  • Umask