139 lines
7.1 KiB
PowerShell
139 lines
7.1 KiB
PowerShell
Import-Module $PSScriptRoot\CommonUtils.psm1 -Force
|
|
Describe "Tests for host keys file permission" -Tags "CI" {
|
|
BeforeAll {
|
|
if($OpenSSHTestInfo -eq $null)
|
|
{
|
|
Throw "`$OpenSSHTestInfo is null. Please run Setup-OpenSSHTestEnvironment to setup test environment."
|
|
}
|
|
|
|
$testDir = "$($OpenSSHTestInfo["TestDataPath"])\hostkey_fileperm"
|
|
if( -not (Test-path $testDir -PathType Container))
|
|
{
|
|
$null = New-Item $testDir -ItemType directory -Force -ErrorAction SilentlyContinue
|
|
}
|
|
|
|
$fileName = "test.txt"
|
|
$filePath = Join-Path $testDir $fileName
|
|
$logName = "log.txt"
|
|
$logPath = Join-Path $testDir $logName
|
|
$port = 47003
|
|
$ssouser = $OpenSSHTestInfo["SSOUser"]
|
|
$script:logNum = 0
|
|
|
|
# for the first time, delete the existing log files.
|
|
if ($OpenSSHTestInfo['DebugMode'])
|
|
{
|
|
Clear-Content "$($OpenSSHTestInfo['OpenSSHBinPath'])\logs\ssh-agent.log" -Force -ErrorAction ignore
|
|
}
|
|
|
|
Remove-Item -Path $filePath -Force -ErrorAction ignore
|
|
}
|
|
|
|
AfterEach {
|
|
if( $OpenSSHTestInfo["DebugMode"])
|
|
{
|
|
Copy-Item "$($OpenSSHTestInfo['OpenSSHBinPath'])\logs\ssh-agent.log" "$($OpenSSHTestInfo['OpenSSHBinPath'])\logs\failedagent$script:logNum.log" -Force -ErrorAction ignore
|
|
Copy-Item $logPath "$($script:logNum)$($logPath)" -Force -ErrorAction ignore
|
|
Clear-Content $logPath -Force -ErrorAction ignore
|
|
$script:logNum++
|
|
|
|
# clear the ssh-agent so that next testcase will get fresh logs.
|
|
Clear-Content "$($OpenSSHTestInfo['OpenSSHBinPath'])\logs\ssh-agent.log" -Force -ErrorAction ignore
|
|
}
|
|
Remove-Item -Path $filePath -Force -ErrorAction ignore
|
|
}
|
|
|
|
Context "Host key files permission" {
|
|
BeforeAll {
|
|
$hostKeyFilePath = "$($OpenSSHTestInfo['OpenSSHBinPath'])\hostkeyFilePermTest_ed25519_key"
|
|
if(Test-path $hostKeyFilePath -PathType Leaf){
|
|
Set-SecureFileACL -filepath $hostKeyFilePath
|
|
}
|
|
if(Test-path "$hostKeyFilePath.pub" -PathType Leaf){
|
|
Set-SecureFileACL -filepath "$hostKeyFilePath.pub"
|
|
}
|
|
Remove-Item -path "$hostKeyFilePath*" -Force -ErrorAction Ignore
|
|
ssh-keygen.exe -t ed25519 -f $hostKeyFilePath -P `"`"
|
|
|
|
Remove-Item $filePath -Force -ErrorAction Ignore
|
|
Get-Process -Name sshd | Where-Object {$_.SI -ne 0} | Stop-process
|
|
}
|
|
|
|
AfterEach {
|
|
Remove-Item -Path $filePath -Force -ErrorAction ignore
|
|
}
|
|
|
|
It 'Host keys -- positive (Secured private key and sshd can access to public key file)' {
|
|
#setup to have current user as owner and grant it full control
|
|
Set-SecureFileACL -filepath $hostKeyFilePath
|
|
#grant sshd Read permission to public key
|
|
Add-PermissionToFileACL -FilePath "$hostKeyFilePath.pub" -User "NT Service\sshd" -Perm "Read"
|
|
|
|
#Run
|
|
Start-Process -FilePath sshd.exe -WorkingDirectory $($OpenSSHTestInfo['OpenSSHBinPath']) -ArgumentList @("-d", "-p $port", "-h $hostKeyFilePath", "-E $filePath") -NoNewWindow
|
|
Get-Process -Name sshd | % { if($_.SI -ne 0) { Start-sleep 1; Stop-Process $_; Start-sleep 1 } }
|
|
|
|
|
|
#validate file content does not contain unprotected.
|
|
$matches = Get-Content $filePath | Select-String -pattern "UNPROTECTED PRIVATE KEY FILE!"
|
|
$matches.Count | Should Be 0
|
|
}
|
|
|
|
It 'Host keys -- negative (other account can access private key file)' {
|
|
#setup to have current user as owner and grant it full control
|
|
Set-SecureFileACL -filepath $hostKeyFilePath
|
|
#add ssouser to access the private key
|
|
$objUser = New-Object System.Security.Principal.NTAccount($ssouser)
|
|
Add-PermissionToFileACL -FilePath $hostKeyFilePath -User $objUser -Perm "Read"
|
|
|
|
#grant sshd Read permission to the public key
|
|
Add-PermissionToFileACL -FilePath "$hostKeyFilePath.pub" -User "NT Service\sshd" -Perm "Read"
|
|
|
|
#Run
|
|
Start-Process -FilePath sshd.exe -WorkingDirectory $($OpenSSHTestInfo['OpenSSHBinPath']) -ArgumentList @("-d", "-p $port", "-h $hostKeyFilePath", "-E $filePath") -NoNewWindow
|
|
Get-Process -Name sshd | % { if($_.SI -ne 0) { Start-sleep 1; Stop-Process $_; Start-sleep 1 } }
|
|
|
|
#validate file content does not contain unprotected.
|
|
$matches = Get-Content $filePath | Select-String -pattern "key_load_private: bad permissions"
|
|
$matches.Count | Should Be 1
|
|
}
|
|
|
|
It 'Host keys -- negative (the private key has wrong owner)' {
|
|
#setup to have ssouser as owner and grant it full control
|
|
$objUser = New-Object System.Security.Principal.NTAccount($ssouser)
|
|
Set-SecureFileACL -filepath $hostKeyFilePath -owner $objUser
|
|
$currentUser = New-Object System.Security.Principal.NTAccount($($env:USERDOMAIN), $($env:USERNAME))
|
|
Add-PermissionToFileACL -FilePath $hostKeyFilePath -User $currentUser -Perm "FullControl"
|
|
|
|
#grant sshd Read permission to the public key
|
|
Add-PermissionToFileACL -FilePath "$hostKeyFilePath.pub" -User "NT Service\sshd" -Perm "Read"
|
|
|
|
#Run
|
|
Start-Process -FilePath sshd.exe -WorkingDirectory $($OpenSSHTestInfo['OpenSSHBinPath']) -ArgumentList @("-d", "-p $port", "-h $hostKeyFilePath", "-E $filePath") -NoNewWindow
|
|
Get-Process -Name sshd | % { if($_.SI -ne 0) { Start-sleep 1; Stop-Process $_; Start-sleep 1 } }
|
|
|
|
#validate file content does not contain unprotected.
|
|
$matches = Get-Content $filePath | Select-String -pattern "key_load_private: bad permissions"
|
|
$matches.Count | Should Be 1
|
|
}
|
|
It 'Host keys -- negative (the running process does not have read access to pub key)' {
|
|
#setup to have ssouser as owner and grant it full control
|
|
Set-SecureFileACL -filepath $hostKeyFilePath
|
|
|
|
$objUser = New-Object System.Security.Principal.NTAccount($ssouser)
|
|
Set-SecureFileACL -filepath "$hostKeyFilePath.pub" -owner $objUser
|
|
|
|
#grant current user Read permission to public key
|
|
Add-PermissionToFileACL -FilePath "$hostKeyFilePath.pub" -User $objUser -Perm "Read"
|
|
|
|
#Run
|
|
Start-Process -FilePath sshd.exe -WorkingDirectory $($OpenSSHTestInfo['OpenSSHBinPath']) -ArgumentList @("-d", "-p $port", "-h $hostKeyFilePath", "-E $filePath") -NoNewWindow
|
|
Get-Process -Name sshd | % { if($_.SI -ne 0) { Start-sleep 1; Stop-Process $_; Start-sleep 1 } }
|
|
|
|
#validate file content does not contain unprotected.
|
|
$matches = Get-Content $filePath | Select-String -pattern "key_load_public: Permission denied"
|
|
$matches.Count | Should Be 1
|
|
}
|
|
}
|
|
}
|