improve testing in kitchen and travis (#313)

* improve local testing

don't use privileged mode, since this grants too much permissions.
Fixes several problems with PAM in test images.
REorder options in kitchen configuration to simplify it.

Signed-off-by: Martin Schurz <[email protected]>

* check all controls in travis

Signed-off-by: Martin Schurz <[email protected]>

* set env vars in travis correctly

according to documentation: https://docs.travis-ci.com/user/environment-variables/

Signed-off-by: Martin Schurz <[email protected]>

* add arch linux to local tests

Signed-off-by: Martin Schurz <[email protected]>

* shorten travis config

Signed-off-by: Martin Schurz <[email protected]>

* use correct init command for containers

Signed-off-by: Martin Schurz <[email protected]>

* try privileged again

Signed-off-by: Martin Schurz <[email protected]>

* arch seems to like privilege

Signed-off-by: Martin Schurz <[email protected]>

Author: schurzi

.kitchen.yml

@@ -2,7 +2,11 @@
 driver:
   name: docker
   use_sudo: false
-  privileged: true
+  cap_add:
+    - SYS_ADMIN
+  volume:
+    - /sys/fs/cgroup:/sys/fs/cgroup
+  run_command: /sbin/init
   http_proxy: <%= ENV['http_proxy'] || nil %>
   https_proxy: <%= ENV['https_proxy'] || nil %>
 
@@ -28,86 +32,96 @@ platforms:
   driver:
     image: rndmh3ro/docker-centos6-ansible:latest
     platform: centos
+    provision_command:
+      - sed -i '/loginuid/d' /etc/pam.d/sshd
+
 - name: centos7-ansible-latest
   driver:
     image: rndmh3ro/docker-centos7-ansible:latest
     platform: centos
-    run_command: /sbin/init
     provision_command:
-      - sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
+      - sed -i '/nologin/d' /etc/pam.d/sshd
       - systemctl enable sshd.service
+
 - name: centos8-ansible-latest
   driver:
     image: rndmh3ro/docker-centos8-ansible:latest
     platform: centos
-    cap_add:
-      - SYS_ADMIN
-    volume:
-      - /sys/fs/cgroup:/sys/fs/cgroup
-    run_command: /sbin/init
     provision_command:
       - sed -i '/nologin/d' /etc/pam.d/sshd
       - systemctl enable sshd.service
   provisioner:
     ansible_binary_path: "/usr/local/bin"
+
 - name: oracle6-ansible-latest
   driver:
     image: rndmh3ro/docker-oracle6-ansible:latest
     platform: centos
+    provision_command:
+      - sed -i '/loginuid/d' /etc/pam.d/sshd
+
 - name: oracle7-ansible-latest
   driver:
     image: rndmh3ro/docker-oracle7-ansible:latest
-    run_command: /sbin/init
     platform: centos
     provision_command:
-      - sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
+      - sed -i '/nologin/d' /etc/pam.d/sshd
       - systemctl enable sshd.service
+
 - name: ubuntu1604-ansible-latest
   driver:
     image: rndmh3ro/docker-ubuntu1604-ansible:latest
     platform: ubuntu
-    run_command: /sbin/init
     provision_command:
       - systemctl enable ssh.service
+
 - name: ubuntu1804-ansible-latest
   driver:
     image: rndmh3ro/docker-ubuntu1804-ansible:latest
     platform: ubuntu
-    run_command: /sbin/init
     provision_command:
       - systemctl enable ssh.service
+
 - name: debian9-ansible-latest
   driver:
     image: rndmh3ro/docker-debian9-ansible:latest
     platform: debian
-    run_command: /sbin/init
     provision_command:
       - apt install -y systemd-sysv
       - systemctl enable ssh.service
+
 - name: debian10-ansible-latest
   driver:
     image: rndmh3ro/docker-debian10-ansible
     platform: debian
-    run_command: /sbin/init
     provision_command:
       - apt install -y systemd-sysv
       - systemctl enable ssh.service
+
 - name: amazon-ansible-latest
   driver:
     image: rndmh3ro/docker-amazon-ansible:latest
     platform: centos
-    run_command: /sbin/init
     provision_command:
-      - sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
+      - sed -i '/nologin/d' /etc/pam.d/sshd
       - systemctl enable sshd.service
+
 - name: fedora-ansible-latest
   driver:
     image: rndmh3ro/docker-fedora-ansible:latest
     platform: centos
-    run_command: /sbin/init
     provision_command:
       - dnf install -y python
-      - sed -i 's/UsePAM yes/UsePAM no/g' /etc/ssh/sshd_config
+      - sed -i '/nologin/d' /etc/pam.d/sshd
+      - systemctl enable sshd.service
+
+- name: arch-ansible-latest
+  driver:
+    image: rndmh3ro/docker-arch-ansible:latest
+    platform: arch
+    run_command: /usr/lib/systemd/systemd
+    provision_command:
+      - sed -i '/nologin/d' /etc/pam.d/sshd
       - systemctl enable sshd.service
 
 verifier:

.travis.yml

@@ -2,74 +2,31 @@
 services: docker
 
 env:
-  - distro: centos6
-    version: latest
-    init: /sbin/init
-    volume: ":"
-
-  - distro: centos7
-    init: /usr/lib/systemd/systemd
-    run_opts: "--privileged"
-    version: latest
-    volume: "/sys/fs/cgroup:/sys/fs/cgroup:ro"
-
-  - distro: centos8
-    init: /usr/lib/systemd/systemd
-    run_opts: "--privileged"
-    version: latest
-    volume: "/sys/fs/cgroup:/sys/fs/cgroup:ro"
-
-  - distro: oracle6
-    version: latest
-    init: /sbin/init
-    volume: ":"
-
-#  - distro: oracle7
-#    init: /usr/lib/systemd/systemd
-#    run_opts: "--privileged"
-#    version: latest
-
-  - distro: ubuntu1604
-    version: latest
-    init: /lib/systemd/systemd
-    run_opts: "--privileged"
-    volume: "/sys/fs/cgroup:/sys/fs/cgroup:ro"
-
-  - distro: ubuntu1804
-    version: latest
-    init: /lib/systemd/systemd
-    run_opts: "--privileged"
-    volume: "/sys/fs/cgroup:/sys/fs/cgroup:ro"
-
-  - distro: debian9
-    version: latest
-    init: /lib/systemd/systemd
-    run_opts: "--privileged"
-    volume: "/sys/fs/cgroup:/sys/fs/cgroup:ro"
-
-  - distro: debian10
-    version: latest
-    init: /lib/systemd/systemd
-    run_opts: "--privileged"
-    volume: "/sys/fs/cgroup:/sys/fs/cgroup:ro"
-
-  - distro: amazon
-    init: /lib/systemd/systemd
-    version: latest
-    run_opts: "--privileged"
-    volume: "/sys/fs/cgroup:/sys/fs/cgroup:ro"
-
-  - distro: fedora
-    init: /lib/systemd/systemd
-    version: latest
-    run_opts: "--privileged"
-    volume: "/sys/fs/cgroup:/sys/fs/cgroup:ro"
-
-  - distro: arch
-    init: /lib/systemd/systemd
-    version: latest
-    run_opts: "--privileged"
-    volume: "/sys/fs/cgroup:/sys/fs/cgroup:ro"
+  global:
+    - version=latest
+    - init=/sbin/init
+    - run_opts="--cap-add SYS_ADMIN"
+    - volume="/sys/fs/cgroup:/sys/fs/cgroup:ro"
+  jobs:
+    - distro=centos6
+      volume=":"
+      run_opts=""
+    - distro=centos7
+    - distro=centos8
+    - distro=oracle6
+      volume=":"
+      run_opts=""
+#    - distro=oracle7
+    - distro=ubuntu1604
+    - distro=ubuntu1804
+    - distro=debian9
+      init=/lib/systemd/systemd
+    - distro=debian10
+    - distro=amazon
+    - distro=fedora
+    - distro=arch
+      init=/usr/lib/systemd/systemd
+      run_opts="--privileged"
 
 before_install:
   # Pull container
@@ -88,10 +45,7 @@ script:
   - 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-ssh-hardening/tests/default.yml --diff'
 
   # Verify role
-  # remove the UseLogin-check, see here for reasons: https://github.com/dev-sec/ansible-ssh-hardening/pull/141
-  - 'inspec exec https://github.com/dev-sec/ssh-baseline/ -t docker://$(cat ${container_id}) --controls=sshd-01 sshd-02 sshd-03 sshd-04 sshd-05 sshd-06 sshd-07 sshd-08 sshd-09 sshd-10 sshd-11 sshd-12 sshd-13 sshd-14 sshd-15 sshd-16 sshd-17 sshd-18 sshd-19 sshd-20 sshd-21 sshd-22 sshd-23 sshd-24 sshd-25 sshd-26 sshd-27 sshd-28 sshd-29 sshd-30 sshd-31 sshd-32 sshd-33 sshd-34 sshd-35 sshd-36 sshd-37 sshd-38 sshd-39 sshd-40 sshd-41 sshd-42 sshd-43 sshd-44 sshd-45 sshd-46 sshd-47 sshd-48 sshd-49 --no-distinct-exit'
-  # remove UseRoaming and RhostsRSAAuthentication because these options are deprecated - ssh-14, ssh-15, ssh-21
-  - 'inspec exec https://github.com/dev-sec/ssh-baseline/ -t docker://$(cat ${container_id}) --controls=ssh-01 ssh-02 ssh-03 ssh-04 ssh-05 ssh-06 ssh-07 ssh-08 ssh-09 ssh-10 ssh-11 ssh-12 ssh-13 ssh-14 ssh-15 ssh-16 ssh-17 ssh-18 ssh-19 ssh-20 --no-distinct-exit'
+  - 'inspec exec https://github.com/dev-sec/ssh-baseline/ -t docker://$(cat ${container_id}) --no-distinct-exit'
 
 notifications:
   webhooks: https://galaxy.ansible.com/api/v1/notifications/