blob: 38ae79ba9c1c916c2590fbe560903cb92e17d9c8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
{
pkgs,
lib,
config,
...
}:
# This tests that systemd-ssh-proxy and systemd-ssh-generator work correctly with:
# - a local unix socket on the same system
# - a unix socket inside a container
let
inherit (import ./ssh-keys.nix pkgs)
snakeOilEd25519PrivateKey
snakeOilEd25519PublicKey
;
in
{
name = "systemd-ssh-proxy";
meta.maintainers = with pkgs.lib.maintainers; [ marie ];
nodes = {
virthost = {
environment.systemPackages = [ pkgs.jq ];
services.openssh = {
enable = true;
settings.PermitRootLogin = "prohibit-password";
};
users.users = {
root.openssh.authorizedKeys.keys = [ snakeOilEd25519PublicKey ];
nixos = {
isNormalUser = true;
};
};
containers.guest = {
autoStart = true;
config = {
users.users.root.openssh.authorizedKeys.keys = [ snakeOilEd25519PublicKey ];
services.openssh = {
enable = true;
settings.PermitRootLogin = "prohibit-password";
};
system.stateVersion = lib.trivial.release;
};
};
};
};
testScript = ''
virthost.succeed("mkdir -p ~/.ssh")
virthost.succeed("cp '${snakeOilEd25519PrivateKey}' ~/.ssh/id_ed25519")
virthost.succeed("chmod 600 ~/.ssh/id_ed25519")
with subtest("Check the environment generator"):
print(virthost.succeed("jq '.' /etc/systemd/generator-environment.json"))
print(virthost.succeed("/etc/systemd/system-environment-generators/env-generator"))
with subtest("ssh into a container with AF_UNIX"):
virthost.wait_for_unit("container@guest.service")
virthost.wait_until_succeeds("ssh -i ~/.ssh/id_ed25519 unix/run/systemd/nspawn/unix-export/guest/ssh echo meow | grep meow")
with subtest("elevate permissions using local ssh socket"):
virthost.wait_for_unit("sshd-unix-local.socket")
virthost.succeed("sudo --user=nixos mkdir -p /home/nixos/.ssh")
virthost.succeed("cp ~/.ssh/id_ed25519 /home/nixos/.ssh/id_ed25519")
virthost.succeed("chmod 600 /home/nixos/.ssh/id_ed25519")
virthost.succeed("chown nixos /home/nixos/.ssh/id_ed25519")
virthost.succeed("sudo --user=nixos ssh -o StrictHostKeyChecking=no -o IdentitiesOnly=yes -i /home/nixos/.ssh/id_ed25519 root@.host whoami | grep root")
'';
}
|
