26 lines
1.8 KiB
Bash
26 lines
1.8 KiB
Bash
is_debian && mkdir -p /run/sshd
|
|
T=$(sshd -T 2>/dev/null)
|
|
K=/home/kim/.ssh/lab_ed25519
|
|
SSHOPT=(-o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR)
|
|
key_login() { runuser -u kim -- timeout 15 ssh "${SSHOPT[@]}" -i $K [email protected] 'echo le-shell-ok' </dev/null | grep -q le-shell-ok; }
|
|
# The methods sshd offers kim once keys are left out.
|
|
no_pw() { timeout 15 ssh "${SSHOPT[@]}" -o PubkeyAuthentication=no -o GSSAPIAuthentication=no [email protected] true 2>&1 </dev/null | grep 'Permission denied' | grep -vqE 'password|keyboard-interactive'; }
|
|
|
|
task 1 "kim's ed25519 key installed and used"
|
|
need "$K is an ed25519 key without a passphrase" 'ssh-keygen -y -P "" -f '$K' | grep -q "^ssh-ed25519 "'
|
|
need "its public half is in kim's authorized_keys" 'grep -qF "$(cut -d" " -f2 '$K'.pub)" /home/kim/.ssh/authorized_keys'
|
|
need "~/.ssh is 700 and authorized_keys 600, both kim's" '[ "$(stat -c %a:%U /home/kim/.ssh)" = 700:kim ] && [ "$(stat -c %a:%U /home/kim/.ssh/authorized_keys)" = 600:kim ]'
|
|
need "kim logs in to 10.99.0.1 with the key" key_login
|
|
|
|
task 2 "sshd: no password, keyboard-interactive or root logins"
|
|
need "sshd -T shows passwordauthentication no" 'grep -qx "passwordauthentication no" <<<"$T"'
|
|
need "sshd -T shows kbdinteractiveauthentication no" 'grep -qx "kbdinteractiveauthentication no" <<<"$T"'
|
|
need "sshd -T shows permitrootlogin no" 'grep -qx "permitrootlogin no" <<<"$T"'
|
|
|
|
task 3 "Password logins refused, the key still works"
|
|
need "sshd offers kim no password login" no_pw
|
|
need "kim still logs in with the key" key_login
|
|
|
|
task 4 "Port 19090 on the peer forwarded to 9090 on this VM's localhost"
|
|
need "curl http://localhost:19090/ on the peer returns the page" 'in_peer curl -s --max-time 5 http://localhost:19090/ | grep -q "Lab console"'
|