d4c64b85fa
PRD fixes: - Remove duplicate 'Installation Behavior' section - Fix malformed terminology table (missing pipe separator) Documentation alignment with FR-006: - README.md: Change SSH/firewall to client-only, no inbound access - TEST-COVERAGE.md: Remove 'Firewall allows SSH inbound' - VERIFICATION-REPORT.md: Fix password config docs to match preseed.cfg - COMPLIANCE.md: Change 'SSH Hardening' to 'SSH Client-Only' Test enhancements: - Expand unit tests for encryption, firewall, security hardening - Add comprehensive coverage for FR-001 through FR-009 requirements All changes ensure documentation and tests align with PRD.md FR-006 which requires SSH client-only with no server or inbound access. 💘 Generated with Crush Assisted-by: GLM-4.7 via Crush <crush@charm.land>
121 lines
3.5 KiB
Bash
121 lines
3.5 KiB
Bash
#!/usr/bin/env bats
|
|
# Unit tests for security-hardening.sh
|
|
# Reference: PRD.md FR-001, FR-006, FR-007
|
|
|
|
@test "security-hardening.sh exists and is executable" {
|
|
[ -f "/workspace/src/security-hardening.sh" ]
|
|
[ -x "/workspace/src/security-hardening.sh" ]
|
|
}
|
|
|
|
@test "WiFi blacklist function exists" {
|
|
grep -q "create_wifi_blacklist()" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "WiFi blacklist includes cfg80211" {
|
|
grep -q "blacklist cfg80211" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "WiFi blacklist includes mac80211" {
|
|
grep -q "blacklist mac80211" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Bluetooth blacklist function exists" {
|
|
grep -q "create_bluetooth_blacklist()" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Bluetooth blacklist includes btusb" {
|
|
grep -q "blacklist btusb" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "SSH client configuration function exists" {
|
|
grep -q "configure_ssh_client()" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "SSH client disables password authentication" {
|
|
grep -q "PasswordAuthentication no" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "SSH client enables pubkey authentication" {
|
|
grep -q "PubkeyAuthentication yes" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Password policy function exists" {
|
|
grep -q "configure_password_policy()" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Password policy requires 14 character minimum" {
|
|
grep -q "minlen = 14" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Password policy requires digits" {
|
|
grep -q "dcredit = -1" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Password policy requires uppercase" {
|
|
grep -q "ucredit = -1" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Password policy requires lowercase" {
|
|
grep -q "lcredit = -1" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Password policy requires special characters" {
|
|
grep -q "ocredit = -1" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Password policy enforces complexity (enforcing=1)" {
|
|
grep -q "enforcing = 1" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "FIM configuration function exists" {
|
|
grep -q "configure_fim()" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "FIM monitors /etc" {
|
|
grep -q "/etc SECURITY" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "FIM monitors /boot" {
|
|
grep -q "/boot SECURITY" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "FIM uses SHA256/SHA512" {
|
|
grep -q "sha256\|sha512" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "System limits function exists" {
|
|
grep -q "configure_system_limits()" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "System limits disable core dumps" {
|
|
grep -q "hard core 0" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Audit rules function exists" {
|
|
grep -q "configure_audit_rules()" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Audit rules watch /etc/passwd" {
|
|
grep -q "/etc/passwd.*-k identity" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Audit rules watch /etc/shadow" {
|
|
grep -q "/etc/shadow.*-k identity" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Audit rules watch /etc/sudoers" {
|
|
grep -q "/etc/sudoers.*-k privilege_escalation" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Audit rules watch WireGuard config" {
|
|
grep -q "/etc/wireguard" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "Audit rules monitor module loading" {
|
|
grep -q "init_module\|delete_module" /workspace/src/security-hardening.sh
|
|
}
|
|
|
|
@test "apply_security_hardening function exists" {
|
|
grep -q "apply_security_hardening()" /workspace/src/security-hardening.sh
|
|
}
|