maple/prplos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: ssh-server: add tests for pubkey auth and session features

Browse Source 
Extend ssh-server QA with new test cases for pubkey authentication thus
covering `SSH.AuthorizedKey.` feature using ed25519 key algorithm,
furtherore add check for `SSH.Server.{i}.Session.{i}.` active SSH session
list feature.

Closes: PCF-1026
Signed-off-by: Petr Štetiar <ynezz@true.cz>
This commit is contained in:
Petr Štetiar 2023-12-06 21:08:56 +01:00 committed by Petr Štetiar
parent 173e53607f
commit d5f86b7768
No known key found for this signature in database
GPG Key ID: 58EE120F30CC02D3
2 changed files with 46 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
.gitlab/certs/ssh-server/ed25519-ci Normal file
View File

@ -0,0 +1,7 @@
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACB4rrFVHgXUdgmPL3AWOTIygbPM3yKMmeJH6yX0jNdz0gAAAJANCYR/DQmE
fwAAAAtzc2gtZWQyNTUxOQAAACB4rrFVHgXUdgmPL3AWOTIygbPM3yKMmeJH6yX0jNdz0g
AAAEDBhKVAsDjVzE+rZ4Ns4L2mFnUosUKT2MiaWZE3talzJHiusVUeBdR2CY8vcBY5MjKB
s8zfIoyZ4kfrJfSM13PSAAAAC3luZXp6QGFwdTRkAQI=
-----END OPENSSH PRIVATE KEY-----

41
.gitlab/tests/cram/generic/acceleration-plan-components/055-ssh-server.t
View File

@ -8,6 +8,7 @@ Add testing SSH server instance on LAN interface and port 1922:
> ubus-cli SSH.Server.+{Alias='ci-testing',Enable=1,Port=1922,AllowPasswordLogin='False',AllowRootLogin='False',AllowRootPasswordLogin='False'}
> ubus-cli SSH.Server.ci-testing.Interface=Device.IP.Interface.3.
> ubus-cli SSH.Server.ci-testing.IPv4AllowedSourcePrefix="192.168.1.0/24"
> ubus-cli SSH.AuthorizedKey.+{Alias='ci-testing',User='Users.User.1.'}
> " > /tmp/cram
$ script --command "ssh -t root@$TARGET_LAN_IP '$(cat /tmp/cram)'" > /dev/null; sleep 5
@ -39,11 +40,47 @@ Check datamodel:
Check that root is able to login with no password:
$ ssh -o BatchMode=yes -o StrictHostKeyChecking=no -p 1922 root@$TARGET_LAN_IP 'exit 0'
$ ssh -o BatchMode=yes -o "UserKnownHostsFile=/dev/null" -o StrictHostKeyChecking=no -p 1922 root@$TARGET_LAN_IP 'exit 0' 2> /dev/null
Disable password login:
$ R "ubus -S call SSH.Server.3 _set '{\"parameters\":{\"AllowRootPasswordLogin\":False}}'" ; sleep 2
{"SSH.Server.3.":{"AllowRootPasswordLogin":false}}
{}
{"amxd-error-code":0}
Add public key:
$ R "ubus -S call SSH.AuthorizedKey.1 _set '{\"parameters\":{\"Key\":\"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHiusVUeBdR2CY8vcBY5MjKBs8zfIoyZ4kfrJfSM13PS\"}}'" ; sleep 2
{"SSH.AuthorizedKey.1.":{"Key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHiusVUeBdR2CY8vcBY5MjKBs8zfIoyZ4kfrJfSM13PS"}}
{}
{"amxd-error-code":0}
Start two client connections using public key authentication:
$ ssh -i ${CI_PROJECT_DIR}/.gitlab/certs/ssh-server/ed25519-ci -o "UserKnownHostsFile=/dev/null" -o BatchMode=yes -o StrictHostKeyChecking=no -p 1922 root@$TARGET_LAN_IP 'sleep 5' > /dev/null 2>&1 &
$ sleep 1
$ ssh -i ${CI_PROJECT_DIR}/.gitlab/certs/ssh-server/ed25519-ci -o "UserKnownHostsFile=/dev/null" -o BatchMode=yes -o StrictHostKeyChecking=no -p 1922 root@$TARGET_LAN_IP 'sleep 5' > /dev/null 2>&1 &
$ sleep 1
Check the Session datamodel:
$ R "ubus call SSH.Server.3.Session _get | jsonfilter -e @[*].IPAddress -e @[*].User -e @[*].Alias" | sort
192.168.1.2
192.168.1.2
cpe-Session-1
cpe-Session-2
root
root
Wait a bit and check that the Session datamodel is empty:
$ sleep 4 ; R "ubus call SSH.Server.3.Session _get | jsonfilter -e @[*].IPAddress -e @[*].User -e @[*].Alias" | sort
Remove the testing SSH server:
$ script --command "ssh -t root@$TARGET_LAN_IP 'ubus-cli SSH.Server.ci-testing-'" > /dev/null; sleep 5
$ script --command "ssh -t root@$TARGET_LAN_IP 'ubus-cli SSH.Server.ci-testing-'" > /dev/null 2>&1 ; sleep 3
Check that the testing SSH server is not running: