···

       
6
       
 
       
}:

     

       
7
       
 
       
# This tests that systemd-ssh-proxy and systemd-ssh-generator work correctly with:

     

       
8
       
 
       
# - a local unix socket on the same system

     

       
9
       
-
       
# - a vsock socket inside a vm

     

       
10
       
 
       
let

     

       
11
       
 
       
  inherit (import ./ssh-keys.nix pkgs)

     

       
12
       
 
       
    snakeOilEd25519PrivateKey

     

       
13
       
 
       
    snakeOilEd25519PublicKey

     

       
14
       
 
       
    ;

     

       
15
       
-
       
  qemu = config.nodes.virthost.virtualisation.qemu.package;

     

       
16
       
-
       
  iso =

     

       
17
       
-
       
    (import ../lib/eval-config.nix {

     

       
18
       
-
       
      inherit (pkgs.stdenv.hostPlatform) system;

     

       
19
       
-
       
      modules = [

     

       
20
       
-
       
        ../modules/installer/cd-dvd/iso-image.nix

     

       
21
       
-
       
        {

     

       
22
       
-
       
          services.openssh = {

     

       
23
       
-
       
            enable = true;

     

       
24
       
-
       
            settings.PermitRootLogin = "prohibit-password";

     

       
25
       
-
       
          };

     

       
26
       
-
       
          isoImage.isoBaseName = lib.mkForce "nixos";

     

       
27
       
-
       
          isoImage.makeBiosBootable = true;

     

       
28
       
-
       
          system.stateVersion = lib.trivial.release;

     

       
29
       
-
       
        }

     

       
30
       
-
       
      ];

     

       
31
       
-
       
    }).config.system.build.isoImage;

     

       
32
       
 
       
in

     

       
33
       
 
       
{

     

       
34
       
 
       
  name = "systemd-ssh-proxy";

     
···

       
46
       
 
       
          isNormalUser = true;

     

       
47
       
 
       
        };

     

       
48
       
 
       
      };

     

       
49
       
-
       
      systemd.services.test-vm = {

     

       
50
       
-
       
        script = "${lib.getExe qemu} --nographic -smp 1 -m 512 -cdrom ${iso}/iso/nixos.iso -device vhost-vsock-pci,guest-cid=3 -smbios type=11,value=\"io.systemd.credential:ssh.authorized_keys.root=${snakeOilEd25519PublicKey}\"";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
51
       
 
       
      };

     

       
52
       
 
       
    };

     

       
53
       
 
       
  };

     

       
54
       
 
       


     

       
55
       
 
       
  testScript = ''

     

       
56
       
-
       
    virthost.systemctl("start test-vm.service")

     

       
57
       
-
       


     

       
58
       
 
       
    virthost.succeed("mkdir -p ~/.ssh")

     

       
59
       
 
       
    virthost.succeed("cp '${snakeOilEd25519PrivateKey}' ~/.ssh/id_ed25519")

     

       
60
       
 
       
    virthost.succeed("chmod 600 ~/.ssh/id_ed25519")

     

       
61
       
 
       


     

       
62
       
-
       
    with subtest("ssh into a vm with vsock"):

     

       
63
       
-
       
      virthost.wait_until_succeeds("systemctl is-active test-vm.service")

     

       
64
       
-
       
      virthost.wait_until_succeeds("ssh -i ~/.ssh/id_ed25519 vsock/3 echo meow | grep meow")

     

       
65
       
-
       
      virthost.wait_until_succeeds("ssh -i ~/.ssh/id_ed25519 vsock/3 shutdown now")

     

       
66
       
-
       
      virthost.wait_until_succeeds("! systemctl is-active test-vm.service")

     

       
67
       
 
       


     

       
68
       
 
       
    with subtest("elevate permissions using local ssh socket"):

     

       
69
       
 
       
      virthost.wait_for_unit("sshd-unix-local.socket")

     

···

       
6
       
 
       
}:

     

       
7
       
 
       
# This tests that systemd-ssh-proxy and systemd-ssh-generator work correctly with:

     

       
8
       
 
       
# - a local unix socket on the same system

     

       
9
       
+
       
# - a unix socket inside a container

     

       
10
       
 
       
let

     

       
11
       
 
       
  inherit (import ./ssh-keys.nix pkgs)

     

       
12
       
 
       
    snakeOilEd25519PrivateKey

     

       
13
       
 
       
    snakeOilEd25519PublicKey

     

       
14
       
 
       
    ;

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
15
       
 
       
in

     

       
16
       
 
       
{

     

       
17
       
 
       
  name = "systemd-ssh-proxy";

     
···

       
29
       
 
       
          isNormalUser = true;

     

       
30
       
 
       
        };

     

       
31
       
 
       
      };

     

       
32
       
+
       
      containers.guest = {

     

       
33
       
+
       
        autoStart = true;

     

       
34
       
+
       
        config = {

     

       
35
       
+
       
          users.users.root.openssh.authorizedKeys.keys = [ snakeOilEd25519PublicKey ];

     

       
36
       
+
       
          services.openssh = {

     

       
37
       
+
       
            enable = true;

     

       
38
       
+
       
            settings.PermitRootLogin = "prohibit-password";

     

       
39
       
+
       
          };

     

       
40
       
+
       
          system.stateVersion = lib.trivial.release;

     

       
41
       
+
       
        };

     

       
42
       
 
       
      };

     

       
43
       
 
       
    };

     

       
44
       
 
       
  };

     

       
45
       
 
       


     

       
46
       
 
       
  testScript = ''

     

       
0
       
 
       

     

       
0
       
 
       

     

       
47
       
 
       
    virthost.succeed("mkdir -p ~/.ssh")

     

       
48
       
 
       
    virthost.succeed("cp '${snakeOilEd25519PrivateKey}' ~/.ssh/id_ed25519")

     

       
49
       
 
       
    virthost.succeed("chmod 600 ~/.ssh/id_ed25519")

     

       
50
       
 
       


     

       
51
       
+
       
    with subtest("ssh into a container with AF_UNIX"):

     

       
52
       
+
       
      virthost.wait_for_unit("container@guest.service")

     

       
53
       
+
       
      virthost.wait_until_succeeds("ssh -i ~/.ssh/id_ed25519 unix/run/systemd/nspawn/unix-export/guest/ssh echo meow | grep meow")

     

       
0
       
 
       

     

       
0
       
 
       

     

       
54
       
 
       


     

       
55
       
 
       
    with subtest("elevate permissions using local ssh socket"):

     

       
56
       
 
       
      virthost.wait_for_unit("sshd-unix-local.socket")