'Test we detect when PAM ssh service doesn\'t deny auth by default.'

def testPamSshDefaultDeniesAuth(self):

    good1_contents = 'auth    required    pam_deny.so\n'
    good2_contents = 'auth    [success=ok    new_authtok_reqd=ok    default=die]    pam_unix.so    try_first_pass\n'
    bad_contents = 'auth    required    pam_foobar.so\n'
    pam_good1 = {'/etc/pam.d/ssh': good1_contents}
    pam_good2 = {'/etc/pam.d/ssh': good2_contents}
    pam_bad = {'/etc/pam.d/ssh': bad_contents}
    sym = 'Missing    attribute:    PAM    ssh    service    must    default    to    denying    auth.'
    found = ['Expected    state    was    not    found']
    results = self.RunChecks(self.GenFileData('PamConfig', pam_bad, parser=self.parser))
    self.assertCheckDetectedAnom('PAM-SSH-DEFAULT-DENIES-AUTH', results, sym, found)
    results = self.RunChecks(self.GenFileData('PamConfig', pam_good1, parser=self.parser))
    self.assertCheckUndetected('PAM-SSH-DEFAULT-DENIES-AUTH', results)
    results = self.RunChecks(self.GenFileData('PamConfig', pam_good2, parser=self.parser))
    self.assertCheckUndetected('PAM-SSH-DEFAULT-DENIES-AUTH', results)
