def testPamSshNoNullPasswords(self):
    good_contents = "password sufficient pam_unix.so\n"
    bad_contents = "password requisite /lib/security/pam_unix.so nullok\n"
    pam_good = {"/etc/pam.d/ssh": good_contents}
    pam_bad = {"/etc/pam.d/ssh": bad_contents}
    # Check the detection case.
    sym = "Found: PAM ssh service allows unix null password accounts to login."
    found = ["In service 'ssh': password requisite /lib/security/pam_unix.so "
             "nullok"]
    results = self.RunChecks(self.GenFileData("PamConfig", pam_bad,
                                              parser=self.parser))
    self.assertCheckDetectedAnom("PAM-SSH-NO-NULL-PASSWORDS", results,
                                 sym, found)
    # Now the pass case.
    results = self.RunChecks(self.GenFileData("PamConfig", pam_good,
                                              parser=self.parser))
    self.assertCheckUndetected("PAM-SSH-NO-NULL-PASSWORDS", results)
Test we find when PAM ssh service allows an unconditional auth permit.
dataset/ETHPy150Open google/grr/grr/checks/pam_test.py/PamConfigTests.testPamSshNoNullPasswords