From 6e97142b84551e1d5d3fc60f10ac7dea02a42e3f Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Thu, 29 Feb 2024 11:37:29 +0100 Subject: [PATCH 1/4] test: shell & cleanup cleanup --- test/units/testsuite-46.sh | 35 ++++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/test/units/testsuite-46.sh b/test/units/testsuite-46.sh index d097ccdac8..6102a430a9 100755 --- a/test/units/testsuite-46.sh +++ b/test/units/testsuite-46.sh @@ -446,14 +446,15 @@ for opt in json multiplexer output synthesize with-dropin with-nss with-varlink; done # FIXME: sshd seems to crash inside asan currently, skip the actual ssh test hence -if command -v ssh &> /dev/null && command -v sshd &> /dev/null && ! [[ -v ASAN_OPTIONS ]]; then - +if command -v ssh &>/dev/null && command -v sshd &>/dev/null && ! [[ -v ASAN_OPTIONS ]]; then at_exit() { - systemctl stop mysshserver.socket - rm -f /tmp/homed.id_rsa /run/systemd/system/mysshserver.socket /run/systemd/system/mysshserver@.service + set +e + + systemctl is-active -q mysshserver.socket && systemctl stop mysshserver.socket + rm -f /tmp/homed.id_rsa /run/systemd/system/mysshserver{@.service,.socket} systemctl daemon-reload - homectl remove homedsshtest ||: - mv /etc/pam.d/sshd.save46 /etc/pam.d/sshd + homectl remove homedsshtest + mv /etc/pam.d/sshd.bak /etc/pam.d/sshd } trap at_exit EXIT @@ -469,6 +470,7 @@ if command -v ssh &> /dev/null && command -v sshd &> /dev/null && ! [[ -v ASAN_O --ssh-authorized-keys=@/tmp/homed.id_rsa.pub \ --stop-delay=0 \ homedsshtest + homectl inspect homedsshtest mkdir -p /etc/ssh test -f /etc/ssh/ssh_host_rsa_key || ssh-keygen -t rsa -C '' -N '' -f /etc/ssh/ssh_host_rsa_key @@ -476,9 +478,8 @@ if command -v ssh &> /dev/null && command -v sshd &> /dev/null && ! [[ -v ASAN_O # ssh wants this dir around, but distros cannot agree on a common name for it, let's just create all that are aware of distros use mkdir -p /usr/share/empty.sshd /var/empty /var/empty/sshd - mv /etc/pam.d/sshd /etc/pam.d/sshd.save46 - - cat > /etc/pam.d/sshd </etc/pam.d/sshd <> /etc/ssh/sshd_config </etc/ssh/sshd_config < /run/systemd/system/mysshserver.socket </run/systemd/system/mysshserver.socket < /run/systemd/system/mysshserver@.service </run/systemd/system/mysshserver@.service < /tmp/homedsshtest.out + ssh -t -t -4 -p 4711 -i /tmp/homed.id_rsa \ + -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \ + homedsshtest@localhost echo zzz | tail -n 1 | tr -d '\r' > /tmp/homedsshtest.out cat /tmp/homedsshtest.out test "$(cat /tmp/homedsshtest.out)" = "zzz" rm /tmp/homedsshtest.out - ssh -t -t -4 -p 4711 -i /tmp/homed.id_rsa -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" homedsshtest@localhost env + ssh -t -t -4 -p 4711 -i /tmp/homed.id_rsa \ + -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \ + homedsshtest@localhost env wait_for_state homedsshtest inactive - homectl remove homedsshtest fi systemd-analyze log-level info From 905c9d2c929a1a1b7137b066b1880b7b94b05be0 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Thu, 29 Feb 2024 11:43:57 +0100 Subject: [PATCH 2/4] test: use ECDSA keys for ssh-related tests This should make the test faster, especially on machines without acceleration. --- test/units/testsuite-46.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/test/units/testsuite-46.sh b/test/units/testsuite-46.sh index 6102a430a9..7952ea2202 100755 --- a/test/units/testsuite-46.sh +++ b/test/units/testsuite-46.sh @@ -451,7 +451,7 @@ if command -v ssh &>/dev/null && command -v sshd &>/dev/null && ! [[ -v ASAN_OPT set +e systemctl is-active -q mysshserver.socket && systemctl stop mysshserver.socket - rm -f /tmp/homed.id_rsa /run/systemd/system/mysshserver{@.service,.socket} + rm -f /tmp/homed.id_ecdsa /run/systemd/system/mysshserver{@.service,.socket} systemctl daemon-reload homectl remove homedsshtest mv /etc/pam.d/sshd.bak /etc/pam.d/sshd @@ -460,20 +460,20 @@ if command -v ssh &>/dev/null && command -v sshd &>/dev/null && ! [[ -v ASAN_OPT trap at_exit EXIT # Test that SSH logins work with delayed unlocking - ssh-keygen -N '' -C '' -t rsa -f /tmp/homed.id_rsa + ssh-keygen -N '' -C '' -t ecdsa -f /tmp/homed.id_ecdsa NEWPASSWORD=hunter4711 homectl create \ --disk-size=min \ --luks-discard=yes \ --luks-pbkdf-type=pbkdf2 \ --luks-pbkdf-time-cost=1ms \ --enforce-password-policy=no \ - --ssh-authorized-keys=@/tmp/homed.id_rsa.pub \ + --ssh-authorized-keys=@/tmp/homed.id_ecdsa.pub \ --stop-delay=0 \ homedsshtest homectl inspect homedsshtest mkdir -p /etc/ssh - test -f /etc/ssh/ssh_host_rsa_key || ssh-keygen -t rsa -C '' -N '' -f /etc/ssh/ssh_host_rsa_key + test -f /etc/ssh/ssh_host_ecdsa_key || ssh-keygen -t ecdsa -C '' -N '' -f /etc/ssh/ssh_host_ecdsa_key # ssh wants this dir around, but distros cannot agree on a common name for it, let's just create all that are aware of distros use mkdir -p /usr/share/empty.sshd /var/empty /var/empty/sshd @@ -519,14 +519,14 @@ EOF userdbctl user -j homedsshtest - ssh -t -t -4 -p 4711 -i /tmp/homed.id_rsa \ + ssh -t -t -4 -p 4711 -i /tmp/homed.id_ecdsa \ -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \ homedsshtest@localhost echo zzz | tail -n 1 | tr -d '\r' > /tmp/homedsshtest.out cat /tmp/homedsshtest.out test "$(cat /tmp/homedsshtest.out)" = "zzz" rm /tmp/homedsshtest.out - ssh -t -t -4 -p 4711 -i /tmp/homed.id_rsa \ + ssh -t -t -4 -p 4711 -i /tmp/homed.id_ecdsa \ -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \ homedsshtest@localhost env From 38cbb9ab8a406972f39cae590e71c30f22cf9c62 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Thu, 29 Feb 2024 11:57:04 +0100 Subject: [PATCH 3/4] test: avoid SIGPIPE from ssh | tail -n 1 Addresses: https://github.com/systemd/systemd/issues/31518#issuecomment-1968295678 --- test/units/testsuite-46.sh | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/test/units/testsuite-46.sh b/test/units/testsuite-46.sh index 7952ea2202..83e96d8474 100755 --- a/test/units/testsuite-46.sh +++ b/test/units/testsuite-46.sh @@ -521,9 +521,8 @@ EOF ssh -t -t -4 -p 4711 -i /tmp/homed.id_ecdsa \ -o "SetEnv PASSWORD=hunter4711" -o "StrictHostKeyChecking no" \ - homedsshtest@localhost echo zzz | tail -n 1 | tr -d '\r' > /tmp/homedsshtest.out - cat /tmp/homedsshtest.out - test "$(cat /tmp/homedsshtest.out)" = "zzz" + homedsshtest@localhost echo zzz | tr -d '\r' | tee /tmp/homedsshtest.out + grep -E "^zzz$" /tmp/homedsshtest.out rm /tmp/homedsshtest.out ssh -t -t -4 -p 4711 -i /tmp/homed.id_ecdsa \ From 8fddb50fd4de43993c4906baf19dae89ff8a021b Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Thu, 29 Feb 2024 13:06:28 +0100 Subject: [PATCH 4/4] test: create sshd's runtime directory (Debian variant) sshd.service on Debian uses RuntimeDirectory=sshd, without which sshd complains: [ 4065.834904] sshd[711]: Missing privilege separation directory: /run/sshd [ 4065.835785] systemd[1]: mysshserver@0-127.0.0.1:4711-127.0.0.1:58232.service: Deactivated successfully. [ 4065.836433] testsuite-46.sh[708]: kex_exchange_identification: read: Connection reset by peer [ 4065.836433] testsuite-46.sh[708]: Connection reset by 127.0.0.1 port 4711 Resolves: #31518 --- test/units/testsuite-46.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/test/units/testsuite-46.sh b/test/units/testsuite-46.sh index 83e96d8474..4b6ae80cb2 100755 --- a/test/units/testsuite-46.sh +++ b/test/units/testsuite-46.sh @@ -475,8 +475,9 @@ if command -v ssh &>/dev/null && command -v sshd &>/dev/null && ! [[ -v ASAN_OPT mkdir -p /etc/ssh test -f /etc/ssh/ssh_host_ecdsa_key || ssh-keygen -t ecdsa -C '' -N '' -f /etc/ssh/ssh_host_ecdsa_key - # ssh wants this dir around, but distros cannot agree on a common name for it, let's just create all that are aware of distros use - mkdir -p /usr/share/empty.sshd /var/empty /var/empty/sshd + # ssh wants this dir around, but distros cannot agree on a common name for it, let's just create all that + # are aware of distros use + mkdir -p /usr/share/empty.sshd /var/empty /var/empty/sshd /run/sshd mv /etc/pam.d/sshd /etc/pam.d/sshd.bak cat >/etc/pam.d/sshd <