blob: bd6255b8044d98d5e07eb5bbee2a49264b2eedfa (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
import ./make-test-python.nix (
{pkgs, ...}: let
sshKeys = import (pkgs.path + "/nixos/tests/ssh-keys.nix") pkgs;
sshUsername = "any-user";
serverName = "server";
clientName = "client";
sshAuditPort = 2222;
in {
name = "ssh";
nodes = {
"${serverName}" = {
networking.firewall.allowedTCPPorts = [
sshAuditPort
];
services.openssh.enable = true;
users.users."${sshUsername}" = {
isNormalUser = true;
openssh.authorizedKeys.keys = [
sshKeys.snakeOilPublicKey
];
};
};
"${clientName}" = {
programs.ssh = {
ciphers = [
"aes128-ctr"
"aes128-gcm@openssh.com"
"aes192-ctr"
"aes256-ctr"
"aes256-gcm@openssh.com"
"chacha20-poly1305@openssh.com"
];
extraConfig = ''
IdentitiesOnly yes
'';
hostKeyAlgorithms = [
"rsa-sha2-256"
"rsa-sha2-256-cert-v01@openssh.com"
"rsa-sha2-512"
"rsa-sha2-512-cert-v01@openssh.com"
"sk-ssh-ed25519-cert-v01@openssh.com"
"sk-ssh-ed25519@openssh.com"
"ssh-ed25519"
"ssh-ed25519-cert-v01@openssh.com"
];
kexAlgorithms = [
"curve25519-sha256"
"curve25519-sha256@libssh.org"
"diffie-hellman-group-exchange-sha256"
"diffie-hellman-group16-sha512"
"diffie-hellman-group18-sha512"
"sntrup761x25519-sha512@openssh.com"
];
macs = [
"hmac-sha2-256-etm@openssh.com"
"hmac-sha2-512-etm@openssh.com"
"umac-128-etm@openssh.com"
];
};
};
};
testScript = ''
start_all()
${serverName}.wait_for_open_port(22)
# Should pass SSH server audit
${serverName}.succeed("${pkgs.ssh-audit}/bin/ssh-audit 127.0.0.1")
# Wait for client to be able to connect to the server
${clientName}.wait_for_unit("network-online.target")
# Set up trusted private key
${clientName}.succeed("cat ${sshKeys.snakeOilPrivateKey} > privkey.snakeoil")
${clientName}.succeed("chmod 600 privkey.snakeoil")
# Fail fast and disable interactivity
ssh_options = "-o BatchMode=yes -o ConnectTimeout=1 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
# Should deny root user
${clientName}.fail(f"ssh {ssh_options} root@${serverName} true")
# Should deny non-root user password login
${clientName}.fail(f"ssh {ssh_options} -o PasswordAuthentication=yes ${sshUsername}@${serverName} true")
# Should allow non-root user certificate login
${clientName}.succeed(f"ssh {ssh_options} -i privkey.snakeoil ${sshUsername}@${serverName} true")
# Should pass SSH client audit
service_name = "ssh-audit.service"
${serverName}.succeed(f"systemd-run --unit={service_name} ${pkgs.ssh-audit}/bin/ssh-audit --client-audit --port=${toString sshAuditPort}")
${clientName}.sleep(5) # We can't use wait_for_open_port because ssh-audit exits as soon as anything talks to it
${clientName}.execute(
f"ssh {ssh_options} -i privkey.snakeoil -p ${toString sshAuditPort} ${sshUsername}@${serverName} true",
check_return=False,
timeout=10
)
${serverName}.succeed(f"exit $(systemctl show --property=ExecMainStatus --value {service_name})")
'';
}
)
|