2019-11-04 23:33:17 +00:00
|
|
|
import ./make-test-python.nix ({ pkgs, ... }:
|
2014-06-27 06:34:59 +00:00
|
|
|
|
2018-02-28 21:55:00 +00:00
|
|
|
let inherit (import ./ssh-keys.nix pkgs)
|
|
|
|
snakeOilPrivateKey snakeOilPublicKey;
|
2014-06-27 06:34:59 +00:00
|
|
|
in {
|
2014-06-28 14:04:49 +00:00
|
|
|
name = "openssh";
|
2021-01-10 19:08:30 +00:00
|
|
|
meta = with pkgs.lib.maintainers; {
|
2019-02-22 15:14:13 +00:00
|
|
|
maintainers = [ aszlig eelco ];
|
2015-07-12 10:09:40 +00:00
|
|
|
};
|
2010-03-18 13:07:56 +00:00
|
|
|
|
|
|
|
nodes = {
|
2011-09-14 18:20:50 +00:00
|
|
|
|
|
|
|
server =
|
2018-07-20 20:56:59 +00:00
|
|
|
{ ... }:
|
2011-09-14 18:20:50 +00:00
|
|
|
|
2010-03-18 13:07:56 +00:00
|
|
|
{
|
|
|
|
services.openssh.enable = true;
|
2013-10-17 13:37:08 +00:00
|
|
|
security.pam.services.sshd.limits =
|
|
|
|
[ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ];
|
2018-06-29 23:55:42 +00:00
|
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
2014-06-27 06:34:59 +00:00
|
|
|
snakeOilPublicKey
|
|
|
|
];
|
2010-05-27 10:05:17 +00:00
|
|
|
};
|
2011-09-14 18:20:50 +00:00
|
|
|
|
2016-12-29 14:49:43 +00:00
|
|
|
server_lazy =
|
2018-07-20 20:56:59 +00:00
|
|
|
{ ... }:
|
2016-12-29 14:49:43 +00:00
|
|
|
|
|
|
|
{
|
|
|
|
services.openssh = { enable = true; startWhenNeeded = true; };
|
|
|
|
security.pam.services.sshd.limits =
|
|
|
|
[ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ];
|
2018-06-29 23:55:42 +00:00
|
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
2016-12-29 14:49:43 +00:00
|
|
|
snakeOilPublicKey
|
|
|
|
];
|
|
|
|
};
|
|
|
|
|
2019-02-24 23:48:01 +00:00
|
|
|
server_localhost_only =
|
|
|
|
{ ... }:
|
|
|
|
|
|
|
|
{
|
|
|
|
services.openssh = {
|
|
|
|
enable = true; listenAddresses = [ { addr = "127.0.0.1"; port = 22; } ];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
server_localhost_only_lazy =
|
|
|
|
{ ... }:
|
|
|
|
|
|
|
|
{
|
|
|
|
services.openssh = {
|
|
|
|
enable = true; startWhenNeeded = true; listenAddresses = [ { addr = "127.0.0.1"; port = 22; } ];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2011-09-14 18:20:50 +00:00
|
|
|
client =
|
2018-07-20 20:56:59 +00:00
|
|
|
{ ... }: { };
|
2011-09-14 18:20:50 +00:00
|
|
|
|
2010-03-18 13:07:56 +00:00
|
|
|
};
|
2011-09-14 18:20:50 +00:00
|
|
|
|
2011-01-12 17:36:15 +00:00
|
|
|
testScript = ''
|
2019-11-04 23:33:17 +00:00
|
|
|
start_all()
|
|
|
|
|
|
|
|
server.wait_for_unit("sshd")
|
|
|
|
|
|
|
|
with subtest("manual-authkey"):
|
|
|
|
client.succeed("mkdir -m 700 /root/.ssh")
|
|
|
|
client.succeed(
|
|
|
|
'${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519 -N ""'
|
|
|
|
)
|
|
|
|
public_key = client.succeed(
|
|
|
|
"${pkgs.openssh}/bin/ssh-keygen -y -f /root/.ssh/id_ed25519"
|
|
|
|
)
|
|
|
|
public_key = public_key.strip()
|
|
|
|
client.succeed("chmod 600 /root/.ssh/id_ed25519")
|
|
|
|
|
|
|
|
server.succeed("mkdir -m 700 /root/.ssh")
|
|
|
|
server.succeed("echo '{}' > /root/.ssh/authorized_keys".format(public_key))
|
|
|
|
server_lazy.succeed("mkdir -m 700 /root/.ssh")
|
|
|
|
server_lazy.succeed("echo '{}' > /root/.ssh/authorized_keys".format(public_key))
|
|
|
|
|
|
|
|
client.wait_for_unit("network.target")
|
|
|
|
client.succeed(
|
|
|
|
"ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2"
|
|
|
|
)
|
|
|
|
client.succeed(
|
|
|
|
"ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024"
|
|
|
|
)
|
|
|
|
|
|
|
|
client.succeed(
|
|
|
|
"ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'echo hello world' >&2"
|
|
|
|
)
|
|
|
|
client.succeed(
|
|
|
|
"ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'ulimit -l' | grep 1024"
|
|
|
|
)
|
|
|
|
|
|
|
|
with subtest("configured-authkey"):
|
|
|
|
client.succeed(
|
|
|
|
"cat ${snakeOilPrivateKey} > privkey.snakeoil"
|
|
|
|
)
|
|
|
|
client.succeed("chmod 600 privkey.snakeoil")
|
|
|
|
client.succeed(
|
|
|
|
"ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server true"
|
|
|
|
)
|
|
|
|
client.succeed(
|
|
|
|
"ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server_lazy true"
|
|
|
|
)
|
|
|
|
|
|
|
|
with subtest("localhost-only"):
|
|
|
|
server_localhost_only.succeed("ss -nlt | grep '127.0.0.1:22'")
|
|
|
|
server_localhost_only_lazy.succeed("ss -nlt | grep '127.0.0.1:22'")
|
2010-03-18 13:07:56 +00:00
|
|
|
'';
|
2014-04-14 12:02:44 +00:00
|
|
|
})
|