mirror of
https://github.com/willshersystems/ansible-sshd
synced 2024-11-22 19:10:18 +01:00
tests: Verify we can generate hostkeys and prevent its creation if needed
This commit is contained in:
parent
94553a887e
commit
33dcb0d9d4
2 changed files with 91 additions and 0 deletions
58
tests/tests_hostkeys.yml
Normal file
58
tests/tests_hostkeys.yml
Normal file
|
@ -0,0 +1,58 @@
|
||||||
|
---
|
||||||
|
- hosts: all
|
||||||
|
tasks:
|
||||||
|
- name: Remove host key before the test
|
||||||
|
file:
|
||||||
|
path: /tmp/ssh_host_ed25519_key
|
||||||
|
state: absent
|
||||||
|
|
||||||
|
- name: Configure sshd with alternative host keys
|
||||||
|
include_role:
|
||||||
|
name: ansible-sshd
|
||||||
|
vars:
|
||||||
|
# very BAD example
|
||||||
|
sshd_hostkey_owner: "nobody"
|
||||||
|
sshd_hostkey_group: "nobody"
|
||||||
|
sshd_hostkey_mode: "0664"
|
||||||
|
sshd:
|
||||||
|
HostKey:
|
||||||
|
- /tmp/ssh_host_ed25519_key
|
||||||
|
|
||||||
|
- name: Verify the options are correctly set
|
||||||
|
vars:
|
||||||
|
main_sshd_config: >-
|
||||||
|
{{
|
||||||
|
"/etc/ssh/sshd_config.d/00-ansible_system_role.conf"
|
||||||
|
if ansible_facts['distribution'] == 'Fedora'
|
||||||
|
else "/etc/ssh/sshd_config"
|
||||||
|
}}
|
||||||
|
block:
|
||||||
|
- meta: flush_handlers
|
||||||
|
|
||||||
|
- name: Print current configuration file
|
||||||
|
slurp:
|
||||||
|
src: "{{ main_sshd_config }}"
|
||||||
|
register: config
|
||||||
|
|
||||||
|
- stat:
|
||||||
|
path: /tmp/ssh_host_ed25519_key
|
||||||
|
register: privkey
|
||||||
|
|
||||||
|
- stat:
|
||||||
|
path: /tmp/ssh_host_ed25519_key.pub
|
||||||
|
register: pubkey
|
||||||
|
|
||||||
|
- name: Check the options are in configuration file
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- "'HostKey /tmp/ssh_host_ed25519_key' in config.content | b64decode"
|
||||||
|
|
||||||
|
- name: Check the generated host key has requested properties
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- privkey.stat.exists
|
||||||
|
- privkey.stat.gr_name == 'nobody'
|
||||||
|
- privkey.stat.pw_name == 'nobody'
|
||||||
|
- privkey.stat.mode == '0664'
|
||||||
|
- pubkey.stat.exists
|
||||||
|
tags: tests::verify
|
33
tests/tests_hostkeys_missing.yml
Normal file
33
tests/tests_hostkeys_missing.yml
Normal file
|
@ -0,0 +1,33 @@
|
||||||
|
---
|
||||||
|
- hosts: all
|
||||||
|
tasks:
|
||||||
|
- name: Configure sshd with missing host keys and prevent their creation
|
||||||
|
block:
|
||||||
|
- name: Configure missing hostkey
|
||||||
|
include_role:
|
||||||
|
name: ansible-sshd
|
||||||
|
vars:
|
||||||
|
sshd_verify_hostkeys: []
|
||||||
|
sshd:
|
||||||
|
HostKey:
|
||||||
|
- /tmp/missing_ssh_host_rsa_key
|
||||||
|
register: role_result
|
||||||
|
|
||||||
|
- name: unreachable task
|
||||||
|
fail:
|
||||||
|
msg: UNREACH
|
||||||
|
|
||||||
|
rescue:
|
||||||
|
- name: Check that we failed in the role
|
||||||
|
assert:
|
||||||
|
that:
|
||||||
|
- ansible_failed_result.msg != 'UNREACH'
|
||||||
|
- not role_result.changed
|
||||||
|
msg: "Role has not failed when it should have"
|
||||||
|
|
||||||
|
- name: Make sure service is still running
|
||||||
|
service:
|
||||||
|
name: sshd
|
||||||
|
state: started
|
||||||
|
register: result
|
||||||
|
failed_when: result.changed
|
Loading…
Reference in a new issue