mirror of
https://github.com/willshersystems/ansible-sshd
synced 2024-11-28 13:50:17 +01:00
d10f2ada11
* robustness: quote test backup/restore file names
This avoids issues if file names are not safepaths.
* security: use quote with command, shell and validate with variable
Skip quotation only if variable is checked.
Add test suit to excercise some quote use cases.
* robustness: fail if systemd.unit could have something in need of quote
Ensure systemd.unit contents is robust. This disables possibility to
have something that needs to be quoted there. But as ansible lacks
proper way to quote systemd unit files (see man systemd.syntax, rules
are not shell rules), it is better to fail such configs. If you are
trying to do that, you are doing it wrong anyway or have malicious
intent.
Also ensure similar issue with sysctl.conf.
Issue can be seen with `tests_hostkeys_unsafe_path.yml`, when adding
following to role params:
sshd_install_service: true
sshd_config_file: "{{ ansible_facts.env.TMPDIR }}/sshd.d/foo.conf"
sshd_binary: "{{ ansible_facts.env.TMPDIR }}/sshd"
__sshd_runtime_directory: "{{ ansible_facts.env.TMPDIR }}/run"
* tests: Quote also the source filename
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
* tests: Add more negative test cases
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
* tests: Skip the test with unsafe TMPDIR as it does not work on CentOS8
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
* Move the variable checks to separate file ...
... and explain better why this is problematic
Drops also the check for internal variables as the user should not
bother with these.
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
---------
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Co-authored-by: Markus Linnala <Markus.Linnala@knowit.fi>
93 lines
2.9 KiB
YAML
93 lines
2.9 KiB
YAML
---
|
|
- name: Test quote with unsafe input
|
|
hosts: all
|
|
vars:
|
|
__sshd_test_backup_files:
|
|
- /etc/ssh/sshd_config
|
|
- /etc/ssh/sshd_config.d/00-ansible_system_role.conf
|
|
|
|
tasks:
|
|
- name: "Backup configuration files"
|
|
ansible.builtin.include_tasks: tasks/backup.yml
|
|
|
|
- name: Configure sshd with bad sysconfig configuration
|
|
block:
|
|
- name: Include the role
|
|
ansible.builtin.include_role:
|
|
name: ansible-sshd
|
|
vars:
|
|
sshd_skip_defaults: true
|
|
sshd_verify_hostkeys: []
|
|
sshd_sysconfig_use_strong_rng: "maybe yes"
|
|
register: role_result
|
|
|
|
- name: Unreachable task -- the role should have failed!
|
|
ansible.builtin.fail:
|
|
msg: UNREACH
|
|
|
|
rescue:
|
|
- name: Check that we failed in the role
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_failed_result.msg != 'UNREACH'
|
|
- not role_result.changed
|
|
msg: "Role has not failed when it should have with invalid inputs"
|
|
|
|
- name: Configure sshd with bad path to sshd binary
|
|
block:
|
|
- name: Include the role
|
|
ansible.builtin.include_role:
|
|
name: ansible-sshd
|
|
vars:
|
|
sshd_skip_defaults: true
|
|
sshd_verify_hostkeys: []
|
|
sshd_binary: "/usr/sbin/sshd binary"
|
|
register: role_result
|
|
|
|
- name: Unreachable task -- the role should have failed!
|
|
ansible.builtin.fail:
|
|
msg: UNREACH
|
|
|
|
rescue:
|
|
- name: Check that we failed in the role
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_failed_result.msg != 'UNREACH'
|
|
- not role_result.changed
|
|
msg: "Role has not failed when it should have with invalid inputs"
|
|
|
|
- name: Configure sshd with bad path sshd config
|
|
block:
|
|
- name: Include the role
|
|
ansible.builtin.include_role:
|
|
name: ansible-sshd
|
|
vars:
|
|
sshd_skip_defaults: true
|
|
sshd_verify_hostkeys: []
|
|
sshd_config_file: /etc/ssh/sshd.config.d/my fancy config
|
|
register: role_result
|
|
|
|
- name: Unreachable task -- the role should have failed!
|
|
ansible.builtin.fail:
|
|
msg: UNREACH
|
|
|
|
rescue:
|
|
- name: Check that we failed in the role
|
|
ansible.builtin.assert:
|
|
that:
|
|
- ansible_failed_result.msg != 'UNREACH'
|
|
- not role_result.changed
|
|
msg: "Role has not failed when it should have with invalid inputs"
|
|
|
|
- name: Make sure service is still running
|
|
ansible.builtin.service:
|
|
name: sshd
|
|
state: started
|
|
register: result
|
|
failed_when: result.changed
|
|
tags: tests::verify
|
|
when:
|
|
- not (ansible_facts['os_family'] == 'RedHat' and ansible_facts['distribution_major_version'] == '6')
|
|
|
|
- name: "Restore configuration files"
|
|
ansible.builtin.include_tasks: tasks/restore.yml
|