pyrox.dev
1import ./make-test.nix ({ pkgs, ... }:
2
3let
4 snakeOilPrivateKey = pkgs.writeText "privkey.snakeoil" ''
5 -----BEGIN EC PRIVATE KEY-----
6 MHcCAQEEIHQf/khLvYrQ8IOika5yqtWvI0oquHlpRLTZiJy5dRJmoAoGCCqGSM49
7 AwEHoUQDQgAEKF0DYGbBwbj06tA3fd/+yP44cvmwmHBWXZCKbS+RQlAKvLXMWkpN
8 r1lwMyJZoSGgBHoUahoYjTh9/sJL7XLJtA==
9 -----END EC PRIVATE KEY-----
10 '';
11
12 snakeOilPublicKey = pkgs.lib.concatStrings [
13 "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHA"
14 "yNTYAAABBBChdA2BmwcG49OrQN33f/sj+OHL5sJhwVl2Qim0vkUJQCry1zFpKTa"
15 "9ZcDMiWaEhoAR6FGoaGI04ff7CS+1yybQ= sakeoil"
16 ];
17
18in {
19 name = "openssh";
20 meta = with pkgs.stdenv.lib.maintainers; {
21 maintainers = [ aszlig eelco chaoflow ];
22 };
23
24 nodes = {
25
26 server =
27 { config, pkgs, ... }:
28
29 {
30 services.openssh.enable = true;
31 security.pam.services.sshd.limits =
32 [ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ];
33 users.extraUsers.root.openssh.authorizedKeys.keys = [
34 snakeOilPublicKey
35 ];
36 };
37
38 server_lazy =
39 { config, pkgs, ... }:
40
41 {
42 services.openssh = { enable = true; startWhenNeeded = true; };
43 security.pam.services.sshd.limits =
44 [ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ];
45 users.extraUsers.root.openssh.authorizedKeys.keys = [
46 snakeOilPublicKey
47 ];
48 };
49
50 client =
51 { config, pkgs, ... }: { };
52
53 };
54
55 testScript = ''
56 startAll;
57
58 my $key=`${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f key -N ""`;
59
60 $server->waitForUnit("sshd");
61
62 subtest "manual-authkey", sub {
63 $server->succeed("mkdir -m 700 /root/.ssh");
64 $server->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys");
65 $server_lazy->succeed("mkdir -m 700 /root/.ssh");
66 $server_lazy->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys");
67
68 $client->succeed("mkdir -m 700 /root/.ssh");
69 $client->copyFileFromHost("key", "/root/.ssh/id_ed25519");
70 $client->succeed("chmod 600 /root/.ssh/id_ed25519");
71
72 $client->waitForUnit("network.target");
73 $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2");
74 $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024");
75
76 $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'echo hello world' >&2");
77 $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'ulimit -l' | grep 1024");
78
79 };
80
81 subtest "configured-authkey", sub {
82 $client->succeed("cat ${snakeOilPrivateKey} > privkey.snakeoil");
83 $client->succeed("chmod 600 privkey.snakeoil");
84 $client->succeed("ssh -o UserKnownHostsFile=/dev/null" .
85 " -o StrictHostKeyChecking=no -i privkey.snakeoil" .
86 " server true");
87
88 $client->succeed("ssh -o UserKnownHostsFile=/dev/null" .
89 " -o StrictHostKeyChecking=no -i privkey.snakeoil" .
90 " server_lazy true");
91
92 };
93 '';
94})