···

       
35
       
 
       
        ];

     

       
36
       
 
       
      };

     

       
37
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
38
       
 
       
    client =

     

       
39
       
 
       
      { config, pkgs, ... }: { };

     

       
40
       
 
       


     
···

       
50
       
 
       
    subtest "manual-authkey", sub {

     

       
51
       
 
       
      $server->succeed("mkdir -m 700 /root/.ssh");

     

       
52
       
 
       
      $server->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys");

     

       
0
       
 
       

     

       
0
       
 
       

     

       
53
       
 
       


     

       
54
       
 
       
      $client->succeed("mkdir -m 700 /root/.ssh");

     

       
55
       
 
       
      $client->copyFileFromHost("key", "/root/.ssh/id_ed25519");

     
···

       
58
       
 
       
      $client->waitForUnit("network.target");

     

       
59
       
 
       
      $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2");

     

       
60
       
 
       
      $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024");

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
61
       
 
       
    };

     

       
62
       
 
       


     

       
63
       
 
       
    subtest "configured-authkey", sub {

     
···

       
66
       
 
       
      $client->succeed("ssh -o UserKnownHostsFile=/dev/null" .

     

       
67
       
 
       
                       " -o StrictHostKeyChecking=no -i privkey.snakeoil" .

     

       
68
       
 
       
                       " server true");

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
69
       
 
       
    };

     

       
70
       
 
       
  '';

     

       
71
       
 
       
})

     

···

       
35
       
 
       
        ];

     

       
36
       
 
       
      };

     

       
37
       
 
       


     

       
38
       
+
       
    server_lazy =

     

       
39
       
+
       
      { config, pkgs, ... }:

     

       
40
       
+
       


     

       
41
       
+
       
      {

     

       
42
       
+
       
        services.openssh = { enable = true; startWhenNeeded = true; };

     

       
43
       
+
       
        security.pam.services.sshd.limits =

     

       
44
       
+
       
          [ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ];

     

       
45
       
+
       
        users.extraUsers.root.openssh.authorizedKeys.keys = [

     

       
46
       
+
       
          snakeOilPublicKey

     

       
47
       
+
       
        ];

     

       
48
       
+
       
      };

     

       
49
       
+
       


     

       
50
       
 
       
    client =

     

       
51
       
 
       
      { config, pkgs, ... }: { };

     

       
52
       
 
       


     
···

       
62
       
 
       
    subtest "manual-authkey", sub {

     

       
63
       
 
       
      $server->succeed("mkdir -m 700 /root/.ssh");

     

       
64
       
 
       
      $server->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys");

     

       
65
       
+
       
      $server_lazy->succeed("mkdir -m 700 /root/.ssh");

     

       
66
       
+
       
      $server_lazy->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys");

     

       
67
       
 
       


     

       
68
       
 
       
      $client->succeed("mkdir -m 700 /root/.ssh");

     

       
69
       
 
       
      $client->copyFileFromHost("key", "/root/.ssh/id_ed25519");

     
···

       
72
       
 
       
      $client->waitForUnit("network.target");

     

       
73
       
 
       
      $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2");

     

       
74
       
 
       
      $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024");

     

       
75
       
+
       


     

       
76
       
+
       
      $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'echo hello world' >&2");

     

       
77
       
+
       
      $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'ulimit -l' | grep 1024");

     

       
78
       
+
       


     

       
79
       
 
       
    };

     

       
80
       
 
       


     

       
81
       
 
       
    subtest "configured-authkey", sub {

     
···

       
84
       
 
       
      $client->succeed("ssh -o UserKnownHostsFile=/dev/null" .

     

       
85
       
 
       
                       " -o StrictHostKeyChecking=no -i privkey.snakeoil" .

     

       
86
       
 
       
                       " server true");

     

       
87
       
+
       


     

       
88
       
+
       
      $client->succeed("ssh -o UserKnownHostsFile=/dev/null" .

     

       
89
       
+
       
                       " -o StrictHostKeyChecking=no -i privkey.snakeoil" .

     

       
90
       
+
       
                       " server_lazy true");

     

       
91
       
+
       


     

       
92
       
 
       
    };

     

       
93
       
 
       
  '';

     

       
94
       
 
       
})