1.13 Ensure hardware MFA is enabled for the "root" account (Scored)
422259
def audit_1_13(self):
        """"""
        for row in self.credential_report:
            if row["user"] == "<root_account>":
                self.assertTrue(json.loads(row["mfa_active"]))
900987
private void configureSpringAuth() throws InstallationFailedException {
		String PATTERN = "${security.auth.filters}";
		String PATTERN_APIA = "${security.auth.filters.apia}";
		String PATTERN_REST = "${security.auth.filters.rest}";

		boolean fesl_authn_enabled = _opts.getBooleanValue(
InstallOptions.FESL_AUTHN_ENABLED, true);
		boolean apia_auth_required = _opts.getBooleanValue(
				InstallOptions.APIA_AUTH_REQUIRED, false);
		boolean upstream_auth_enabled = _opts.getBooleanValue(
				InstallOptions.UPSTREAM_AUTH_ENABLED, false);

		StringBuilder filters = new StringBuilder();
		StringBuilder filters_apia = new StringBuilder();
		StringBuilder filters_rest = new StringBuilder();

		boolean needsbugFix = false;

		if (fesl_authn_enabled) {
			filters.append("AuthFilterJAAS");
			filters_apia.append("AuthFilterJAAS");
			filters_rest.append("AuthFilterJAAS");
		} else if (upstream_auth_enabled) {
			// use upstream auth filter and nothing else
			String upstreamAuthFilter = "UpstreamAuthFilter";
			filters.append(upstreamAuthFilter);
			filters_apia.append(upstreamAuthFilter);
			filters_rest.append(upstreamAuthFilter);
		}
		else {
			filters.append("SetupFilter,XmlUserfileFilter,EnforceAuthnFilter,FinalizeFilter");
			if (apia_auth_required) {
				filters_apia
						.append("SetupFilter,XmlUserfileFilter,EnforceAuthnFilter,FinalizeFilter");
				filters_rest
						.append("SetupFilter,XmlUserfileFilter,EnforceAuthnFilter,FinalizeFilter");
			} else {
				filters_apia.append("");
				filters_rest
						.append("SetupFilter,XmlUserfileFilter,RestApiAuthnFilter,FinalizeFilter");
			}

			needsbugFix = true;
		}

		if (_opts.getBooleanValue(InstallOptions.FESL_AUTHZ_ENABLED, false)) {
			filters.append(",PEPFilter");
			filters_apia.append(",PEPFilter");
			filters_rest.append(",PEPFilter");
			copyFESLConfigs();
		}

		FileInputStream springConfig = null;
		PrintWriter writer = null;
		try {
			File xmlFile = new File(_installDir,
					"server/config/spring/web/security.xml");
			springConfig = new FileInputStream(xmlFile);
			String content = IOUtils.toString(springConfig)
					.replace(PATTERN, filters)
					.replace(PATTERN_APIA, filters_apia)
					.replace(PATTERN_REST, filters_rest);

			if (!needsbugFix) {
				/* Delete classic authN bugfix when not applicable */
				content = content.replaceFirst("(?s)<!-- BUG.+?/BUG -->", "");
			}

			springConfig.close();

			writer = new PrintWriter(new OutputStreamWriter(
					new FileOutputStream(xmlFile), "UTF-8"));
			writer.print(content);
			writer.close();
		} catch (Exception e) {
			IOUtils.closeQuietly(springConfig);
			IOUtils.closeQuietly(writer);
			throw new InstallationFailedException(e.getMessage(), e);
		}
	}
1228230
def configure_root_access(options = {})
      public_key = ENV['VS_SSH_PUBLIC_KEY'].to_s.strip
      # was there a key found?
      if public_key.nil? || public_key.empty?
        puts "No public SSH key found in metadata"
        return
      end
      update_authorized_keys(public_key)
    end
886161
def _ensure_update_ha_compliant(self, router, current_router,
                                    r_hd_binding_db):
        
        if r_hd_binding_db.role == ROUTER_ROLE_HA_REDUNDANCY:
            return {ha.ENABLED: False}
        auto_enable_ha = r_hd_binding_db.router_type.ha_enabled_by_default
        requested_ha_details = router.pop(ha.DETAILS, {})
        # If ha_details are given then ha is assumed to be enabled even if
        # it is not explicitly specified or if auto_enable_ha says so.
        # Note that None is used to indicate that request did not include any
        # ha information was provided!
        requested_ha_enabled = router.pop(
            ha.ENABLED, True if requested_ha_details or auto_enable_ha is True
            else None)
        res = {}
        ha_currently_enabled = current_router.get(ha.ENABLED, False)
        # Note: must check for 'is True' as None implies attribute not given
        if requested_ha_enabled is True or ha_currently_enabled is True:
            if not cfg.CONF.ha.ha_support_enabled:
                raise ha.HADisabled()
            curr_ha_details = current_router.get(ha.DETAILS, {})
            if ha.TYPE in requested_ha_details:
                requested_ha_type = requested_ha_details[ha.TYPE]
                if (ha.TYPE in curr_ha_details and
                        requested_ha_type != curr_ha_details[ha.TYPE]):
                    raise ha.HATypeCannotBeChanged()
                elif requested_ha_type in cfg.CONF.ha.disabled_ha_mechanisms:
                    raise ha.HADisabledHAType(ha_type=requested_ha_type)
        if requested_ha_enabled:
            res[ha.ENABLED] = requested_ha_enabled
            if requested_ha_details:
                res[ha.DETAILS] = requested_ha_details
        elif requested_ha_enabled is False:
            res[ha.ENABLED] = False
        return res
47368
def postActivate_(self):
        
        if (self.requiredGPU_MB(self.required_mb)):
            self.analyzer = YoloV3Analyzer(verbose = self.verbose)
        else:
            self.warning_message = "WARNING: not enough GPU memory!"
            self.analyzer = None
394482
def complete_profile(f, credentials, session_token_written, mfa_serial_written):
    
    session_token = credentials['SessionToken'] if 'SessionToken' in credentials else None
    mfa_serial = credentials['SerialNumber'] if 'SerialNumber' in credentials else None
    if session_token and not session_token_written:
        f.write('aws_session_token = %s\n' % session_token)
    if mfa_serial and not mfa_serial_written:
        f.write('aws_mfa_serial = %s\n' % mfa_serial)
719693
def enable_root_user(self):
        
        uri = "/instances/%s/root" % self.id
        resp, body = self.manager.api.method_post(uri)
        return body["user"]["password"]
585461
def supported_by_platform?
      right_platform = RightScale::Platform.linux?
      # avoid calling user_exists? on unsupported platform(s)
      right_platform && LoginUserManager.user_exists?('rightscale') && FeatureConfigManager.feature_enabled?('managed_login_enable')
    end
558562
def validate(self):
        
        if not self.principals:
            raise InvalidApplicationPolicyError(error_message='principals not provided')

        if not self.actions:
            raise InvalidApplicationPolicyError(error_message='actions not provided')

        if any(not self._PRINCIPAL_PATTERN.match(p) for p in self.principals):
            raise InvalidApplicationPolicyError(
                error_message='principal should be 12-digit AWS account ID or "*"')

        unsupported_actions = sorted(set(self.actions) - set(self.SUPPORTED_ACTIONS))
        if unsupported_actions:
            raise InvalidApplicationPolicyError(
                error_message='{} not supported'.format(', '.join(unsupported_actions)))

        return True
106531
def cli(self, eauth):
        '''
        
        '''
        ret = {}
        if not eauth:
            print('External authentication system has not been specified')
            return ret
        fstr = '{0}.auth'.format(eauth)
        if fstr not in self.auth:
            print(('The specified external authentication system "{0}" is '
                   'not available').format(eauth))
            print("Available eauth types: {0}".format(", ".join(self.auth.file_mapping.keys())))
            return ret

        args = salt.utils.args.arg_lookup(self.auth[fstr])
        for arg in args['args']:
            if arg in self.opts:
                ret[arg] = self.opts[arg]
            elif arg.startswith('pass'):
                ret[arg] = getpass.getpass('{0}: '.format(arg))
            else:
                ret[arg] = input('{0}: '.format(arg))
        for kwarg, default in list(args['kwargs'].items()):
            if kwarg in self.opts:
                ret['kwarg'] = self.opts[kwarg]
            else:
                ret[kwarg] = input('{0} [{1}]: '.format(kwarg, default))

        # Use current user if empty
        if 'username' in ret and not ret['username']:
            ret['username'] = salt.utils.user.get_user()

        return ret
1245163
def insert_authentication_data(self, key):
        '''
        
        '''
        correct_authentication_data = self.calculate_authentication_data(key)
        self.authentication_data = correct_authentication_data
220518
def set_uefi_secure_boot(secure_boot_enable)
      new_action = { 'SecureBootEnable' => secure_boot_enable }
      response = rest_patch('/redfish/v1/Systems/1/SecureBoot/', body: new_action)
      response_handler(response)
      true
    end
570124
def on(device):
    '''
    
    '''
    cmd = 'quotaon {0}'.format(device)
    __salt__['cmd.run'](cmd, python_shell=False)
    return True
550274
public void authorize() {
    if (this.isSecurityEnabled) {
      try {
        login(this.keytabPrincipal, this.keytabPath);
      } catch (final IOException e) {
        log.error(e);
        throw new AzkabanException(String.format(
            "Error: Unable to authorize to Hadoop. Principal: %s Keytab: %s", this.keytabPrincipal,
            this.keytabPath));
      }
    }
  }
429955
def unlock(ctx, pin):
    

    controller = ctx.obj['controller']
    if not controller.is_fips:
        ctx.fail('This is not a YubiKey FIPS, and therefore'
                 ' does not support a U2F PIN.')

    if pin is None:
        pin = _prompt_current_pin('Enter your PIN')

    _fail_if_not_valid_pin(ctx, pin, True)
    try:
        controller.verify_pin(pin)
    except ApduError as e:
        if e.code == SW.VERIFY_FAIL_NO_RETRY:
            ctx.fail('Wrong PIN.')
        if e.code == SW.AUTH_METHOD_BLOCKED:
            ctx.fail('PIN is blocked.')
        if e.code == SW.COMMAND_NOT_ALLOWED:
            ctx.fail('PIN is not set.')

        logger.error('PIN verification failed', exc_info=e)
        ctx.fail('PIN verification failed.')
591052
def authenticate(self, driver):
        """"""
        #                      0                      1                    2                    3
        events = [driver.username_re, driver.password_re, self.device.prompt_re, driver.rommon_re,
                  #       4             5                   6                       7                8
                  driver.unable_to_connect_re, driver.authentication_error_re, pexpect.TIMEOUT, pexpect.EOF]

        transitions = [
            (driver.username_re, [0], 1, partial(a_send_username, self.username), 10),
            (driver.username_re, [1], 1, None, 10),
            (driver.password_re, [0, 1], 2, partial(a_send_password, self._acquire_password()),
             _C['first_prompt_timeout']),
            (driver.username_re, [2], -1, a_authentication_error, 0),
            (driver.password_re, [2], -1, a_authentication_error, 0),
            (driver.authentication_error_re, [1, 2], -1, a_authentication_error, 0),
            (self.device.prompt_re, [0, 1, 2], -1, None, 0),
            (driver.rommon_re, [0], -1, partial(a_send, "\r\n"), 0),
            (pexpect.TIMEOUT, [0], 1, partial(a_send, "\r\n"), 10),
            (pexpect.TIMEOUT, [2], -1, None, 0),
            (pexpect.TIMEOUT, [3, 7], -1, ConnectionTimeoutError("Connection Timeout", self.hostname), 0),
            (driver.unable_to_connect_re, [0, 1, 2], -1, a_unable_to_connect, 0),
        ]
        self.log("EXPECTED_PROMPT={}".format(pattern_to_str(self.device.prompt_re)))
        fsm = FSM("CONSOLE-SERVER-AUTH", self.device, events, transitions, timeout=_C['connect_timeout'],
                  init_pattern=self.last_pattern)
        return fsm.run()
1110846
def SetBuddyStatusPendingAuthorization(self, Text=u''):
        
        self._Property('BUDDYSTATUS', '%d %s' % (budPendingAuthorization, tounicode(Text)), Cache=False)