mirror of
https://github.com/PowerShell/openssh-portable.git
synced 2025-07-28 16:24:39 +02:00
add pester test for event viewer scenarios (#788)
* add pester test for event viewer scenarios * revert ci changes * Update regress/pesterTests/EventLogging.Tests.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update regress/pesterTests/EventLogging.Tests.ps1 Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update EventLogging.Tests.ps1 * add comments --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
Tess Gauthier
GitHub
parent
c1a8d54998
commit
139a1b413d
185
regress/pesterTests/EventLogging.Tests.ps1
Normal file
185
regress/pesterTests/EventLogging.Tests.ps1
Normal file
@ -0,0 +1,185 @@
|
||||
If ($PSVersiontable.PSVersion.Major -le 2) {$PSScriptRoot = Split-Path -Parent $MyInvocation.MyCommand.Path}
|
||||
Import-Module $PSScriptRoot\CommonUtils.psm1 -Force
|
||||
Import-Module OpenSSHUtils -Force
|
||||
$tC = 1
|
||||
$tI = 0
|
||||
$suite = "EventLogging"
|
||||
Describe "Tests for admin and non-admin event logs" -Tags "CI" {
|
||||
BeforeAll {
|
||||
if($OpenSSHTestInfo -eq $null)
|
||||
{
|
||||
Throw "`$OpenSSHTestInfo is null. Please run Set-OpenSSHTestEnvironment to set test environments."
|
||||
}
|
||||
|
||||
$testDir = "$($OpenSSHTestInfo["TestDataPath"])\$suite"
|
||||
if( -not (Test-path $testDir -PathType Container))
|
||||
{
|
||||
$null = New-Item $testDir -ItemType directory -Force -ErrorAction SilentlyContinue
|
||||
}
|
||||
|
||||
$server = $OpenSSHTestInfo["Target"]
|
||||
$nonadminusername = $OpenSSHTestInfo['NonAdminUser']
|
||||
$adminusername = $OpenSSHTestInfo['AdminUser']
|
||||
$opensshbinpath = $OpenSSHTestInfo['OpenSSHBinPath']
|
||||
$password = $OpenSSHTestInfo['TestAccountPW']
|
||||
$port = 47003
|
||||
$sshdDelay = $OpenSSHTestInfo["DelayTime"]
|
||||
|
||||
# Register OpenSSH events in Event Viewer
|
||||
$etwman = Join-Path $opensshbinpath "openssh-events.man"
|
||||
if (-not (Test-Path $etwman -PathType Leaf)) {
|
||||
throw "openssh events manifest is not present in OpenSSH binary path"
|
||||
}
|
||||
wevtutil im "$etwman" | Out-Null
|
||||
}
|
||||
|
||||
AfterEach { $tI++ }
|
||||
|
||||
AfterAll {
|
||||
# Unregister etw provider
|
||||
wevtutil um "$etwman"
|
||||
}
|
||||
|
||||
Context "Tests Logs for SSH connections" {
|
||||
BeforeAll {
|
||||
Add-PasswordSetting -Pass $password
|
||||
$tI=1
|
||||
}
|
||||
|
||||
BeforeEach {
|
||||
# disable the OpenSSH log channels
|
||||
wevtutil sl "OpenSSH/Debug" /e:false /q:true | Out-Null
|
||||
wevtutil sl "OpenSSH/Operational" /e:false /q:true | Out-Null
|
||||
# clear any existing logs
|
||||
wevtutil cl "OpenSSH/Debug" | Out-Null
|
||||
wevtutil cl "OpenSSH/Operational" | Out-Null
|
||||
# enable the OpenSSH log channels
|
||||
wevtutil sl "OpenSSH/Debug" /e:true /q:true | Out-Null
|
||||
wevtutil sl "OpenSSH/Operational" /e:true /q:true | Out-Null
|
||||
}
|
||||
|
||||
AfterAll {
|
||||
Remove-PasswordSetting
|
||||
$tC++
|
||||
}
|
||||
|
||||
It "$tC.$tI-Nonadmin SSH Connection" {
|
||||
$o = ssh -l $nonadminusername test_target echo 1234
|
||||
$o | Should Be 1234
|
||||
Start-Sleep $sshdDelay
|
||||
# query the OpenSSH log channels to make sure events were captured
|
||||
$eventLogDebug = wevtutil qe "OpenSSH/Debug" /c:5 /f:text
|
||||
$eventLogDebug | Should Not Be $null
|
||||
$eventLogOperational = wevtutil qe "OpenSSH/Operational" /c:5 /f:text
|
||||
$eventLogOperational | Should Not Be $null
|
||||
}
|
||||
|
||||
It "$tC.$tI-Admin SSH Connection" {
|
||||
$o = ssh -l $adminusername test_target echo 1234
|
||||
$o | Should Be 1234
|
||||
Start-Sleep $sshdDelay
|
||||
# query the OpenSSH log channels to make sure events were captured
|
||||
$eventLogDebug = wevtutil qe "OpenSSH/Debug" /c:5 /f:text
|
||||
$eventLogDebug | Should Not Be $null
|
||||
$eventLogOperational = wevtutil qe "OpenSSH/Operational" /c:5 /f:text
|
||||
$eventLogOperational | Should Not Be $null
|
||||
}
|
||||
}
|
||||
|
||||
Context "Tests Logs for SFTP connections" {
|
||||
|
||||
BeforeAll {
|
||||
|
||||
function Setup-KeyBasedAuth
|
||||
{
|
||||
param([string] $Username, [string] $KeyFilePath, [string] $UserProfile)
|
||||
|
||||
$userSSHProfilePath = Join-Path $UserProfile .ssh
|
||||
|
||||
if (-not (Test-Path $userSSHProfilePath -PathType Container)) {
|
||||
New-Item $userSSHProfilePath -ItemType directory -Force -ErrorAction Stop | Out-Null
|
||||
}
|
||||
|
||||
$authorizedkeyPath = Join-Path $userSSHProfilePath authorized_keys
|
||||
|
||||
if($OpenSSHTestInfo["NoLibreSSL"])
|
||||
{
|
||||
ssh-keygen.exe -t ed25519 -f $KeyFilePath -Z -P "" aes128-ctr
|
||||
}
|
||||
else
|
||||
{
|
||||
ssh-keygen.exe -t ed25519 -f $KeyFilePath -P ""
|
||||
}
|
||||
Copy-Item "$KeyFilePath.pub" $authorizedkeyPath -Force -ErrorAction SilentlyContinue
|
||||
Repair-AuthorizedKeyPermission -Filepath $authorizedkeyPath -confirm:$false
|
||||
}
|
||||
|
||||
$AdminUserProfile = $OpenSSHTestInfo['AdminUserProfile']
|
||||
$NonAdminUserProfile = $OpenSSHTestInfo['NonAdminUserProfile']
|
||||
|
||||
$KeyFileName = $nonadminusername + "_sshtest_EventLog_ed25519"
|
||||
$NonadminKeyFilePath = Join-Path $testDir $keyFileName
|
||||
Remove-Item -path "$NonadminKeyFilePath*" -Force -ErrorAction SilentlyContinue
|
||||
Setup-KeyBasedAuth -Username $nonadminusername -KeyFilePath $NonadminKeyFilePath -UserProfile $NonAdminUserProfile
|
||||
|
||||
$KeyFileName = $adminusername + "_sshtest_EventLog_ed25519"
|
||||
$AdminKeyFilePath = Join-Path $testDir $keyFileName
|
||||
Remove-Item -path "$AdminKeyFilePath*" -Force -ErrorAction SilentlyContinue
|
||||
Setup-KeyBasedAuth -Username $adminusername -KeyFilePath $AdminKeyFilePath -UserProfile $AdminUserProfile
|
||||
|
||||
#create batch file
|
||||
$commands =
|
||||
"ls
|
||||
exit"
|
||||
$batchFilePath = Join-Path $testDir "$tC.$tI.commands.txt"
|
||||
Set-Content $batchFilePath -Encoding UTF8 -value $commands
|
||||
|
||||
$tI = 1
|
||||
}
|
||||
|
||||
BeforeEach {
|
||||
# disable the OpenSSH log channels
|
||||
wevtutil sl "OpenSSH/Debug" /e:false /q:true | Out-Null
|
||||
wevtutil sl "OpenSSH/Operational" /e:false /q:true | Out-Null
|
||||
# clear any existing logs
|
||||
wevtutil cl "OpenSSH/Debug" | Out-Null
|
||||
wevtutil cl "OpenSSH/Operational" | Out-Null
|
||||
# enable the OpenSSH log channels
|
||||
wevtutil sl "OpenSSH/Debug" /e:true /q:true | Out-Null
|
||||
wevtutil sl "OpenSSH/Operational" /e:true /q:true | Out-Null
|
||||
}
|
||||
|
||||
AfterAll {
|
||||
Remove-Item -path "$NonadminKeyFilePath*" -Force -ErrorAction SilentlyContinue
|
||||
Remove-Item -path "$AdminKeyFilePath*" -Force -ErrorAction SilentlyContinue
|
||||
|
||||
$authorized_key = Join-Path '.ssh' authorized_keys
|
||||
$AdminAuthKeysPath = Join-Path $AdminUserProfile $authorized_key
|
||||
$NonAdminAuthKeysPath = Join-Path $NonAdminUserProfile $authorized_key
|
||||
Remove-Item -path "$AdminAuthKeysPath*" -Force -ErrorAction SilentlyContinue
|
||||
Remove-Item -path "$NonAdminAuthKeysPath*" -Force -ErrorAction SilentlyContinue
|
||||
|
||||
$tC++
|
||||
}
|
||||
|
||||
It "$tC.$tI-Nonadmin SFTP Connection" {
|
||||
sftp -i $NonadminKeyFilePath -b $batchFilePath -o User=$nonadminusername test_target
|
||||
Start-Sleep $sshdDelay
|
||||
# query the OpenSSH log channels to make sure events were captured
|
||||
$eventLogDebug = wevtutil qe "OpenSSH/Debug" /c:5 /f:text
|
||||
$eventLogDebug | Should Not Be $null
|
||||
$eventLogOperational = wevtutil qe "OpenSSH/Operational" /c:5 /f:text
|
||||
$eventLogOperational | Should Not Be $null
|
||||
}
|
||||
|
||||
It "$tC.$tI-Admin SFTP Connection" {
|
||||
sftp -i $AdminKeyFilePath -b $batchFilePath -o User=$adminusername test_target
|
||||
Start-Sleep $sshdDelay
|
||||
# query the OpenSSH log channels to make sure events were captured
|
||||
$eventLogDebug = wevtutil qe "OpenSSH/Debug" /c:5 /f:text
|
||||
$eventLogDebug | Should Not Be $null
|
||||
$eventLogOperational = wevtutil qe "OpenSSH/Operational" /c:5 /f:text
|
||||
$eventLogOperational | Should Not Be $null
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user