|
333 | 333 | describe "allowed user accounts" do |
334 | 334 | describe file("/etc/passwd") do |
335 | 335 | its(:content) { should eql(<<~HERE) } |
336 | | - root:x:0:0:root:/root:/bin/bash |
337 | | - daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin |
338 | | - bin:x:2:2:bin:/bin:/usr/sbin/nologin |
339 | | - sys:x:3:3:sys:/dev:/usr/sbin/nologin |
340 | | - sync:x:4:65534:sync:/bin:/bin/sync |
341 | | - games:x:5:60:games:/usr/games:/usr/sbin/nologin |
342 | | - man:x:6:12:man:/var/cache/man:/usr/sbin/nologin |
343 | | - lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin |
344 | | - mail:x:8:8:mail:/var/mail:/usr/sbin/nologin |
345 | | - news:x:9:9:news:/var/spool/news:/usr/sbin/nologin |
346 | | - uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin |
347 | | - proxy:x:13:13:proxy:/bin:/usr/sbin/nologin |
348 | | - www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin |
349 | | - backup:x:34:34:backup:/var/backups:/usr/sbin/nologin |
350 | | - list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin |
351 | | - irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin |
352 | | - _apt:x:42:65534::/nonexistent:/usr/sbin/nologin |
353 | | - nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin |
354 | | - systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin |
355 | | - systemd-timesync:x:996:996:systemd Time Synchronization:/:/usr/sbin/nologin |
356 | | - dhcpcd:x:100:65534:DHCP Client Daemon,,,:/usr/lib/dhcpcd:/bin/false |
| 336 | + root:x:0:0:root:/root:/bin/bash |
| 337 | + daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin |
| 338 | + bin:x:2:2:bin:/bin:/usr/sbin/nologin |
| 339 | + sys:x:3:3:sys:/dev:/usr/sbin/nologin |
| 340 | + sync:x:4:65534:sync:/bin:/bin/sync |
| 341 | + games:x:5:60:games:/usr/games:/usr/sbin/nologin |
| 342 | + man:x:6:12:man:/var/cache/man:/usr/sbin/nologin |
| 343 | + lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin |
| 344 | + mail:x:8:8:mail:/var/mail:/usr/sbin/nologin |
| 345 | + news:x:9:9:news:/var/spool/news:/usr/sbin/nologin |
| 346 | + uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin |
| 347 | + proxy:x:13:13:proxy:/bin:/usr/sbin/nologin |
| 348 | + www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin |
| 349 | + backup:x:34:34:backup:/var/backups:/usr/sbin/nologin |
| 350 | + list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin |
| 351 | + irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin |
| 352 | + _apt:x:42:65534::/nonexistent:/usr/sbin/nologin |
| 353 | + nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin |
| 354 | + systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin |
| 355 | + systemd-timesync:x:996:996:systemd Time Synchronization:/:/usr/sbin/nologin |
| 356 | + dhcpcd:x:100:65534:DHCP Client Daemon,,,:/usr/lib/dhcpcd:/bin/false |
357 | 357 | messagebus:x:101:101::/nonexistent:/usr/sbin/nologin |
358 | | - syslog:x:102:102::/nonexistent:/usr/sbin/nologin |
359 | | - systemd-resolve:x:991:991:systemd Resolver:/:/usr/sbin/nologin |
360 | | - uuidd:x:103:104::/run/uuidd:/usr/sbin/nologin |
361 | | - _chrony:x:104:106:Chrony daemon,,,:/var/lib/chrony:/usr/sbin/nologin |
362 | | - _runit-log:x:999:990:Created by dh-sysuser for runit:/nonexistent:/usr/sbin/nologin |
363 | | - sshd:x:105:65534::/run/sshd:/usr/sbin/nologin |
| 358 | + syslog:x:102:102::/nonexistent:/usr/sbin/nologin |
| 359 | + systemd-resolve:x:991:991:systemd Resolver:/:/usr/sbin/nologin |
| 360 | + uuidd:x:103:104::/run/uuidd:/usr/sbin/nologin |
| 361 | + _chrony:x:104:106:Chrony daemon,,,:/var/lib/chrony:/usr/sbin/nologin |
| 362 | + _runit-log:x:999:990:Created by dh-sysuser for runit:/nonexistent:/usr/sbin/nologin |
| 363 | + sshd:x:105:65534::/run/sshd:/usr/sbin/nologin |
364 | 364 | tcpdump:x:106:108::/nonexistent:/usr/sbin/nologin |
365 | | - polkitd:x:989:989:User for polkitd:/:/usr/sbin/nologin |
366 | | - vcap:x:1000:1000:BOSH System User:/home/vcap:/bin/bash |
| 365 | + polkitd:x:989:989:User for polkitd:/:/usr/sbin/nologin |
| 366 | + vcap:x:1000:1000:BOSH System User:/home/vcap:/bin/bash |
367 | 367 | HERE |
368 | 368 | end |
369 | 369 |
|
|
407 | 407 |
|
408 | 408 | describe file("/etc/group") do |
409 | 409 | its(:content) { should eql(<<~HERE) } |
410 | | - root:x:0: |
411 | | - daemon:x:1: |
412 | | - bin:x:2: |
413 | | - sys:x:3: |
414 | | - adm:x:4:vcap |
415 | | - tty:x:5:syslog |
| 410 | + root:x:0: |
| 411 | + daemon:x:1: |
| 412 | + bin:x:2: |
| 413 | + sys:x:3: |
| 414 | + adm:x:4:vcap |
| 415 | + tty:x:5:syslog |
416 | 416 | disk:x:6: |
417 | 417 | lp:x:7: |
418 | 418 | mail:x:8: |
|
436 | 436 | list:x:38: |
437 | 437 | irc:x:39: |
438 | 438 | src:x:40: |
439 | | - shadow:x:42: |
440 | | - utmp:x:43: |
441 | | - video:x:44:vcap |
442 | | - sasl:x:45: |
443 | | - plugdev:x:46:vcap |
444 | | - staff:x:50: |
445 | | - games:x:60: |
446 | | - users:x:100: |
447 | | - nogroup:x:65534: |
448 | | - systemd-journal:x:999: |
449 | | - systemd-network:x:998: |
450 | | - crontab:x:997: |
451 | | - systemd-timesync:x:996: |
452 | | - input:x:995: |
453 | | - sgx:x:994: |
454 | | - kvm:x:993: |
455 | | - render:x:992: |
| 439 | + shadow:x:42: |
| 440 | + utmp:x:43: |
| 441 | + video:x:44:vcap |
| 442 | + sasl:x:45: |
| 443 | + plugdev:x:46:vcap |
| 444 | + staff:x:50: |
| 445 | + games:x:60: |
| 446 | + users:x:100: |
| 447 | + nogroup:x:65534: |
| 448 | + systemd-journal:x:999: |
| 449 | + systemd-network:x:998: |
| 450 | + crontab:x:997: |
| 451 | + systemd-timesync:x:996: |
| 452 | + input:x:995: |
| 453 | + sgx:x:994: |
| 454 | + kvm:x:993: |
| 455 | + render:x:992: |
456 | 456 | messagebus:x:101: |
457 | | - syslog:x:102: |
458 | | - systemd-resolve:x:991: |
459 | | - netdev:x:103: |
460 | | - uuidd:x:104: |
461 | | - _ssh:x:105: |
462 | | - _chrony:x:106: |
463 | | - _runit-log:x:990: |
464 | | - rdma:x:107: |
| 457 | + syslog:x:102: |
| 458 | + systemd-resolve:x:991: |
| 459 | + netdev:x:103: |
| 460 | + uuidd:x:104: |
| 461 | + _ssh:x:105: |
| 462 | + _chrony:x:106: |
| 463 | + _runit-log:x:990: |
| 464 | + rdma:x:107: |
465 | 465 | tcpdump:x:108: |
466 | 466 | polkitd:x:989: |
467 | | - admin:x:988:vcap |
468 | | - vcap:x:1000:syslog |
469 | | - bosh_sshers:x:1001:vcap |
470 | | - bosh_sudoers:x:1002: |
| 467 | + admin:x:988:vcap |
| 468 | + vcap:x:1000:syslog |
| 469 | + bosh_sshers:x:1001:vcap |
| 470 | + bosh_sudoers:x:1002: |
471 | 471 | HERE |
472 | 472 | end |
473 | 473 |
|
474 | 474 | describe file("/etc/gshadow") do |
475 | 475 | its(:content) { should eql(<<~HERE) } |
476 | | - root:*:: |
477 | | - daemon:*:: |
478 | | - bin:*:: |
479 | | - sys:*:: |
480 | | - adm:*::vcap |
481 | | - tty:*::syslog |
482 | | - disk:*:: |
483 | | - lp:*:: |
484 | | - mail:*:: |
485 | | - news:*:: |
486 | | - uucp:*:: |
487 | | - man:*:: |
488 | | - proxy:*:: |
489 | | - kmem:*:: |
490 | | - dialout:*::vcap |
491 | | - fax:*:: |
492 | | - voice:*:: |
493 | | - cdrom:*::vcap |
494 | | - floppy:*::vcap |
495 | | - tape:*:: |
496 | | - sudo:*::vcap |
497 | | - audio:*::vcap |
498 | | - dip:*::vcap |
499 | | - www-data:*:: |
500 | | - backup:*:: |
501 | | - operator:*:: |
502 | | - list:*:: |
503 | | - irc:*:: |
504 | | - src:*:: |
505 | | - shadow:*:: |
| 476 | + root:*:: |
| 477 | + daemon:*:: |
| 478 | + bin:*:: |
| 479 | + sys:*:: |
| 480 | + adm:*::vcap |
| 481 | + tty:*::syslog |
| 482 | + disk:*:: |
| 483 | + lp:*:: |
| 484 | + mail:*:: |
| 485 | + news:*:: |
| 486 | + uucp:*:: |
| 487 | + man:*:: |
| 488 | + proxy:*:: |
| 489 | + kmem:*:: |
| 490 | + dialout:*::vcap |
| 491 | + fax:*:: |
| 492 | + voice:*:: |
| 493 | + cdrom:*::vcap |
| 494 | + floppy:*::vcap |
| 495 | + tape:*:: |
| 496 | + sudo:*::vcap |
| 497 | + audio:*::vcap |
| 498 | + dip:*::vcap |
| 499 | + www-data:*:: |
| 500 | + backup:*:: |
| 501 | + operator:*:: |
| 502 | + list:*:: |
| 503 | + irc:*:: |
| 504 | + src:*:: |
| 505 | + shadow:*:: |
506 | 506 | utmp:*:: |
507 | 507 | video:*::vcap |
508 | 508 | sasl:*:: |
|
512 | 512 | users:*:: |
513 | 513 | nogroup:*:: |
514 | 514 | systemd-journal:!*:: |
515 | | - systemd-network:!*:: |
516 | | - crontab:!*:: |
517 | | - systemd-timesync:!*:: |
518 | | - input:!*:: |
519 | | - sgx:!*:: |
520 | | - kvm:!*:: |
521 | | - render:!*:: |
522 | | - messagebus:!:: |
| 515 | + systemd-network:!*:: |
| 516 | + crontab:!*:: |
| 517 | + systemd-timesync:!*:: |
| 518 | + input:!*:: |
| 519 | + sgx:!*:: |
| 520 | + kvm:!*:: |
| 521 | + render:!*:: |
| 522 | + messagebus:!:: |
523 | 523 | syslog:!:: |
524 | 524 | systemd-resolve:!*:: |
525 | | - netdev:!:: |
526 | | - uuidd:!:: |
527 | | - _ssh:!:: |
| 525 | + netdev:!:: |
| 526 | + uuidd:!:: |
| 527 | + _ssh:!:: |
528 | 528 | _chrony:!:: |
529 | 529 | _runit-log:!:: |
530 | 530 | rdma:!:: |
531 | 531 | tcpdump:!:: |
532 | 532 | polkitd:!*:: |
533 | | - admin:!::vcap |
534 | | - vcap:!::syslog |
535 | | - bosh_sshers:!::vcap |
536 | | - bosh_sudoers:!:: |
| 533 | + admin:!::vcap |
| 534 | + vcap:!::syslog |
| 535 | + bosh_sshers:!::vcap |
| 536 | + bosh_sudoers:!:: |
537 | 537 | HERE |
538 | 538 | end |
539 | 539 | end |
|
0 commit comments