Extend Molecule smoke to staged MFA, msmtp, and Lynis install.

Cover the remaining reaudit test gap without live SMTP, TOTP enrolment,
or a full lynis audit run, which stay operator-owned.

Author: HecFranco

ansible/README.md

@@ -93,7 +93,7 @@ pip install 'molecule' 'molecule-plugins[docker]'
 molecule test
 ```
 
-Default scenario converges **bootstrap → admin → sysctl → passwords → ssh_hardening → firewall_stack** on Debian 13 Docker (privileged) and verifies UFW active + Fail2Ban jail. Still not a full `02-harden.yml` substitute (no mail/MFA/Lynis).
+Default scenario converges **bootstrap → admin → sysctl → passwords → ssh → MFA (wired/`nullok`) → firewall_stack → msmtp → Lynis install** on Debian 13 Docker (privileged). It verifies UFW, Fail2Ban, PAM TOTP staging, msmtp `0600`, and Debian Lynis without a third-party repo. It is still not a substitute for a full `02-harden.yml` run (no live SMTP, no TOTP enrolment, no `lynis audit system`).
 
 ## Directory map
 

ansible/molecule/default/converge.yml

@@ -1,5 +1,5 @@
 ---
-- name: Converge — packages, identity, SSH, firewall
+- name: Converge — identity, SSH, staged MFA, firewall, mail, Lynis
   hosts: all
   become: true
   gather_facts: true
@@ -16,7 +16,8 @@
     harden_ssh_port: 2222
     harden_ssh_use_dns: "no"
     harden_ssh_mfa_enable: false
-    harden_enable_mfa_role: false
+    harden_ssh_mfa_nullok: true
+    harden_enable_mfa_role: true
     harden_fail2ban_require_ignoreip: false
     harden_fail2ban_ignoreip: "127.0.0.1"
     harden_strict_ops: false
@@ -26,6 +27,9 @@
     harden_enable_chkrootkit: false
     harden_enable_aide: false
     harden_enable_logwatch: false
+    harden_lynis_force_run: false
+    harden_enable_lynis_mail_report: false
+    harden_allow_third_party_lynis_repo: false
     harden_mail_to: molecule@example.com
     harden_mail_from: molecule@example.com
     harden_smtp_host: localhost
@@ -36,7 +40,12 @@
       - ca-certificates
       - curl
       - fail2ban
+      - libpam-google-authenticator
       - libpam-pwquality
+      - lynis
+      - mailutils
+      - msmtp
+      - msmtp-mta
       - openssh-server
       - psad
       - rsyslog
@@ -53,4 +62,7 @@
     - role: host_sysctl
     - role: password_policy
     - role: ssh_hardening
+    - role: ssh_mfa
     - role: firewall_stack
+    - role: outbound_mail
+    - role: security_audit

ansible/molecule/default/molecule.yml

@@ -1,5 +1,5 @@
 ---
-# Minimal Molecule skeleton for Debian converge smoke tests.
+# Debian 13 Docker smoke: identity, SSH, staged MFA, UFW/IDS, msmtp, Lynis install.
 # Requires: pip install molecule molecule-plugins[docker] ansible-core
 # Run from ansible/: molecule test
 dependency:

ansible/molecule/default/verify.yml

@@ -29,10 +29,11 @@
         src: /etc/ssh/sshd_config.d/10-nowo-hardening.conf
       register: sshd_conf
 
-    - name: MFA must stay off in smoke converge
+    - name: MFA wired but not enforced (nullok staging)
       ansible.builtin.assert:
         that:
           - "'AuthenticationMethods' not in (sshd_conf.content | b64decode)"
+          - "'KbdInteractiveAuthentication no' in (sshd_conf.content | b64decode)"
 
     - name: Assert sysctl drop-in exists
       ansible.builtin.stat:
@@ -92,3 +93,32 @@
     - name: Sysctl includes kptr_restrict
       ansible.builtin.command: grep -F 'kernel.kptr_restrict = 2' /etc/sysctl.d/60-nowo-hardening.conf
       changed_when: false
+
+    - name: PAM TOTP line is staged with nullok
+      ansible.builtin.command: grep -F 'pam_google_authenticator.so nullok' /etc/pam.d/sshd
+      changed_when: false
+
+    - name: msmtp config is root-only
+      ansible.builtin.stat:
+        path: /etc/msmtprc
+      register: msmtprc
+
+    - name: Require msmtp 0600
+      ansible.builtin.assert:
+        that:
+          - msmtprc.stat.exists
+          - msmtprc.stat.mode == '0600'
+
+    - name: Lynis is installed from Debian (no third-party repo)
+      ansible.builtin.command: dpkg -s lynis
+      changed_when: false
+
+    - name: Cisofy third-party list must stay absent
+      ansible.builtin.stat:
+        path: /etc/apt/sources.list.d/cisofy-lynis.list
+      register: cisofy_list
+
+    - name: Require no Cisofy source
+      ansible.builtin.assert:
+        that:
+          - not cisofy_list.stat.exists

docs/CONTROL-COVERAGE.md

@@ -85,6 +85,7 @@ flowchart TB
 ## Residual risks
 
 - Focused auditd rules are not a full enterprise syscall pack.
-- CrowdSec and Docker firewalling need human design.
+- CrowdSec and Docker firewalling need human design (documented, not automated).
+- Molecule CI covers staging MFA, msmtp file perms, and Lynis package install — not live SMTP, TOTP enrolment, or a full Lynis audit run.
 - Physical/console threats remain operator-owned.
 - Application security is out of scope.