'Test we detect when PAM ssh service doesn\'t deny auth by default.'

def testPamSecureDefaults(self):

    good_contents = '\n                                auth    required    pam_deny.so    foobar\n                                password    sufficient    /lib64/security/pam_warn.so\n                                session    requisite    /lib/security/pam_deny.so\n                                '
    bad_contents = (good_contents + '\n                                auth    required    pam_permit.so\n                                password    done    pam_foobar.so    test    args\n                                ')
    pam_good = {'/etc/pam.d/other': good_contents}
    pam_bad = {'/etc/pam.d/other': bad_contents}
    sym = "Found:    PAM    'other'(the    default)    config    should    only    be    used    for    denying/logging    access."
    found = ["In    service    'other':    auth    required    pam_permit.so", "In    service    'other':    password    done    pam_foobar.so    test    args"]
    results = self.RunChecks(self.GenFileData('PamConfig', pam_bad, parser=self.parser))
    self.assertCheckDetectedAnom('PAM-SECURE-DEFAULTS', results, sym, found)
    results = self.RunChecks(self.GenFileData('PamConfig', pam_good, parser=self.parser))
    self.assertCheckUndetected('PAM-SECURE-DEFAULTS', results)
