Increase test coverage for sshd_config_{owner,group,mode} variables with both invocations

.travis.yml

@@ -51,13 +51,20 @@ script:
     && (echo 'Uncommon configuration test: pass' && exit 0)
     || (echo 'Uncommon configuration test: fail' && exit 1)
 
-  # Test 5: Make sure we can modify other files, for example for inclusion
+  # Test 5a: Make sure we can modify other files, for example for inclusion
   # in the main sshd_config or second sshd service
   - >
     ANSIBLE_FORCE_COLOR=1 ansible-playbook -i tests/inventory tests/tests_alternative_file.yml --connection=local --become -v
     && (echo 'Alternative configuration file test: pass' && exit 0)
     || (echo 'Alternative configuration file test: fail' && exit 1)
 
+  # Test 5b: Make sure we can modify other files, for example for inclusion
+  # in the main sshd_config or second sshd service using the old invocation
+  - >
+    ANSIBLE_FORCE_COLOR=1 ansible-playbook -i tests/inventory tests/tests_alternative_file_role.yml --connection=local --become -v
+    && (echo 'Alternative configuration file role test: pass' && exit 0)
+    || (echo 'Alternative configuration file role test: fail' && exit 1)
+
   # Test 6: Test match blocks generators
   - >
     ANSIBLE_FORCE_COLOR=1 ansible-playbook -i tests/inventory tests/tests_match.yml --connection=local --become -v

tests/tests_alternative_file.yml

@@ -10,12 +10,27 @@
     - name: "Backup configuration files"
       include_tasks: tasks/backup.yml
 
+    - name: Ensure group 'nobody' exists
+      group:
+        name: nobody
+
+    - name: Ensure the user 'nobody' exists
+      user:
+        name: nobody
+        group: nobody
+        comment: nobody
+        create_home: no
+        shell: /sbin/nologin
+
     - name: Configure alternative sshd_config file
       include_role:
         name: ansible-sshd
       vars:
         # just anything -- will not get processed by sshd
         sshd_config_file: /etc/ssh/sshd_config_custom
+        sshd_config_owner: "nobody"
+        sshd_config_group: "nobody"
+        sshd_config_mode: "660"
         sshd_skip_defaults: true
         sshd:
           AcceptEnv: LANG
@@ -60,6 +75,11 @@
             src: /etc/ssh/sshd_config_custom
           register: config
 
+        - name: Get stat of the configuration file
+          stat:
+            path: /etc/ssh/sshd_config_custom
+          register: config_stat
+
         - name: Print second configuration file
           slurp:
             src: /etc/ssh/sshd_config_custom_second
@@ -98,6 +118,14 @@
               - "'PasswordAuthentication no' in config3.content | b64decode"
               - "'MaxStartups 100' not in config3.content | b64decode"
               - "'Compression no' not in config3.content | b64decode"
+
+        - name: Check the generated config has requested properties
+          assert:
+            that:
+              - config_stat.stat.exists
+              - config_stat.stat.gr_name == 'nobody'
+              - config_stat.stat.pw_name == 'nobody'
+              - config_stat.stat.mode == '0660'
       tags: tests::verify
 
     - name: "Restore configuration files"

tests/tests_alternative_file_role.yml

@@ -0,0 +1,145 @@
+---
+- hosts: all
+  vars:
+    __sshd_test_backup_files:
+      - /etc/ssh/sshd_config
+      - /etc/ssh/sshd_config.d/00-ansible_system_role.conf
+      - /etc/ssh/sshd_config_custom
+      - /etc/ssh/sshd_config_custom_second
+  tasks:
+    - name: "Backup configuration files"
+      include_tasks: tasks/backup.yml
+
+    - name: Ensure group 'nobody' exists
+      group:
+        name: nobody
+
+    - name: Ensure the user 'nobody' exists
+      user:
+        name: nobody
+        group: nobody
+        comment: nobody
+        create_home: no
+        shell: /sbin/nologin
+
+# Configure alternative sshd_config file
+- hosts: all
+  roles:
+    - ansible-sshd
+  vars:
+    # just anything -- will not get processed by sshd
+    sshd_config_file: /etc/ssh/sshd_config_custom
+    sshd_config_owner: "nobody"
+    sshd_config_group: "nobody"
+    sshd_config_mode: "660"
+    sshd_skip_defaults: true
+    sshd:
+      AcceptEnv: LANG
+      Banner: /etc/issue
+      Ciphers: aes256-ctr
+    sshd_Compression: no
+
+# Configure second alternative sshd_config file
+- hosts: all
+  roles:
+    - ansible-sshd
+  vars:
+    # just anything -- will not get processed by sshd
+    sshd_config_file: /etc/ssh/sshd_config_custom_second
+    sshd_skip_defaults: true
+    sshd:
+      Banner: /etc/issue2
+      Ciphers: aes128-ctr
+    sshd_MaxStartups: 100
+
+# Now configure the main sshd_config file
+- hosts: all
+  roles:
+    - ansible-sshd
+  vars:
+    sshd:
+      Banner: /etc/issue
+      Ciphers: aes192-ctr
+      HostKey:
+        - /tmp/ssh_host_ecdsa_key
+    sshd_PasswordAuthentication: no
+
+- hosts: all
+  vars:
+    __sshd_test_backup_files:
+      - /etc/ssh/sshd_config
+      - /etc/ssh/sshd_config.d/00-ansible_system_role.conf
+      - /etc/ssh/sshd_config_custom
+      - /etc/ssh/sshd_config_custom_second
+  tasks:
+    - name: Verify the options are correctly set
+      vars:
+        main_sshd_config: >-
+          {{
+            "/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
+            if ansible_facts['distribution'] == 'Fedora'
+            else "/etc/ssh/sshd_config"
+          }}
+      block:
+        - meta: flush_handlers
+
+        - name: Print current configuration file
+          slurp:
+            src: /etc/ssh/sshd_config_custom
+          register: config
+
+        - name: Get stat of the configuration file
+          stat:
+            path: /etc/ssh/sshd_config_custom
+          register: config_stat
+
+        - name: Print second configuration file
+          slurp:
+            src: /etc/ssh/sshd_config_custom_second
+          register: config2
+
+        - name: Print the main configuration file
+          slurp:
+            src: "{{ main_sshd_config }}"
+          register: config3
+
+        - name: Check content of first configuration file
+          assert:
+            that:
+              - "'AcceptEnv LANG' in config.content | b64decode"
+              - "'Banner /etc/issue' in config.content | b64decode"
+              - "'Ciphers aes256-ctr' in config.content | b64decode"
+              - "'HostKey' not in config.content | b64decode"
+              - "'Compression no' in config.content | b64decode"
+              - "'MaxStartups 100' not in config.content | b64decode"
+
+        - name: Check content of second configuration file
+          assert:
+            that:
+              - "'Banner /etc/issue2' in config2.content | b64decode"
+              - "'Ciphers aes128-ctr' in config2.content | b64decode"
+              - "'HostKey' not in config2.content | b64decode"
+              - "'MaxStartups 100' in config2.content | b64decode"
+              - "'Compression no' not in config2.content | b64decode"
+
+        - name: Check content of the main configuration file
+          assert:
+            that:
+              - "'Banner /etc/issue' in config3.content | b64decode"
+              - "'Ciphers aes192-ctr' in config3.content | b64decode"
+              - "'HostKey /tmp/ssh_host_ecdsa_key' in config3.content | b64decode"
+              - "'PasswordAuthentication no' in config3.content | b64decode"
+              - "'MaxStartups 100' not in config3.content | b64decode"
+              - "'Compression no' not in config3.content | b64decode"
+
+        - name: Check the generated config has requested properties
+          assert:
+            that:
+              - config_stat.stat.exists
+              - config_stat.stat.gr_name == 'nobody'
+              - config_stat.stat.pw_name == 'nobody'
+              - config_stat.stat.mode == '0660'
+      tags: tests::verify
+
+    - name: "Restore configuration files"
+      include_tasks: tasks/restore.yml