287 lines
8.9 KiB
Bash
Executable file
287 lines
8.9 KiB
Bash
Executable file
#!/usr/bin/env bats
|
|
|
|
load test_helper
|
|
|
|
setup() {
|
|
. /usr/lib/bkctld/includes
|
|
|
|
rm -f /root/bkctld.key*
|
|
ssh-keygen -t rsa -N "" -f /root/bkctld.key -q
|
|
|
|
grep -qE "^BACKUP_DISK=" /etc/default/bkctld || echo "BACKUP_DISK=/dev/vdb" >> /etc/default/bkctld
|
|
|
|
JAILNAME=$(tr -cd '[:alnum:]' < /dev/urandom | fold -w15 | head -n1)
|
|
JAILPATH="/backup/jails/${JAILNAME}"
|
|
INCSPATH="/backup/incs/${JAILNAME}"
|
|
PORT=$(awk -v min=2222 -v max=2999 'BEGIN{srand(); print int(min+rand()*(max-min+1))}')
|
|
INC_NAME=$(date +"%Y-%m-%d-%H")
|
|
|
|
inode=$(stat --format=%i /backup)
|
|
|
|
/usr/lib/bkctld/bkctld-init "${JAILNAME}"
|
|
}
|
|
|
|
teardown() {
|
|
/usr/lib/bkctld/bkctld-remove "${JAILNAME}" && rm -rf "${INCSPATH}"
|
|
}
|
|
|
|
@test "init-filesystem" {
|
|
inode=$(stat --format=%i /backup)
|
|
if [ "${inode}" -eq 256 ]; then
|
|
# On a btrfs filesystem, the jail should be a btrfs volume
|
|
run stat --format=%i "${JAILPATH}"
|
|
[ "${output}" -eq 256 ]
|
|
else
|
|
# On an ext4 filesystem, the jail should be a regular directory
|
|
run test -d "${JAILPATH}"
|
|
[ "${status}" -eq 0 ]
|
|
fi
|
|
}
|
|
|
|
@test "init-incs-policy" {
|
|
# An incs_policy file should exist
|
|
run test -e "${CONFDIR}/${JAILNAME}.d/incs_policy"
|
|
[ "${status}" -eq 0 ]
|
|
}
|
|
|
|
@test "start" {
|
|
/usr/lib/bkctld/bkctld-start "${JAILNAME}"
|
|
pid=$(cat "${JAILPATH}/${SSHD_PID}")
|
|
# A started jail should have an SSH pid file
|
|
run ps --pid "${pid}"
|
|
assert_success
|
|
}
|
|
|
|
@test "stop" {
|
|
/usr/lib/bkctld/bkctld-start "${JAILNAME}"
|
|
pid=$(cat "${JAILPATH}/${SSHD_PID}")
|
|
/usr/lib/bkctld/bkctld-stop "${JAILNAME}"
|
|
# A stopped jail should not have an SSH pid file
|
|
run ps --pid "${pid}"
|
|
assert_failure
|
|
}
|
|
|
|
@test "reload" {
|
|
/usr/lib/bkctld/bkctld-start "${JAILNAME}"
|
|
/usr/lib/bkctld/bkctld-reload "${JAILNAME}"
|
|
# A reloaded jail should mention the restart in the authlog
|
|
run grep "Received SIGHUP; restarting." "${JAILPATH}/var/log/authlog"
|
|
assert_success
|
|
}
|
|
|
|
@test "restart" {
|
|
/usr/lib/bkctld/bkctld-start "${JAILNAME}"
|
|
pid_before=$(cat "${JAILPATH}/${SSHD_PID}")
|
|
|
|
/usr/lib/bkctld/bkctld-restart "${JAILNAME}"
|
|
pid_after=$(cat "${JAILPATH}/${SSHD_PID}")
|
|
|
|
# A restarted jail should have a different pid
|
|
refute_equal "${pid_before}" "${pid_after}"
|
|
}
|
|
|
|
@test "status" {
|
|
run /usr/lib/bkctld/bkctld-status "${JAILNAME}"
|
|
assert_success
|
|
}
|
|
|
|
@test "is-on" {
|
|
/usr/lib/bkctld/bkctld-start "${JAILNAME}"
|
|
# A started jail should report to be ON
|
|
run /usr/lib/bkctld/bkctld-is-on "${JAILNAME}"
|
|
assert_success
|
|
|
|
/usr/lib/bkctld/bkctld-stop "${JAILNAME}"
|
|
# A stopped jail should not report to be ON
|
|
run /usr/lib/bkctld/bkctld-is-on "${JAILNAME}"
|
|
assert_failure
|
|
}
|
|
|
|
@test "key-absent" {
|
|
run cat "${JAILPATH}/root/.ssh/authorized_keys"
|
|
assert_equal "$output" ""
|
|
}
|
|
|
|
@test "key-present" {
|
|
keyfile=/root/bkctld.key.pub
|
|
/usr/lib/bkctld/bkctld-key "${JAILNAME}" "${keyfile}"
|
|
# The key should be present in the SSH authorized_keys file
|
|
run cat "${JAILPATH}/root/.ssh/authorized_keys"
|
|
assert_equal "$output" "$(cat ${keyfile})"
|
|
}
|
|
|
|
@test "port" {
|
|
/usr/lib/bkctld/bkctld-start "${JAILNAME}"
|
|
/usr/lib/bkctld/bkctld-port "${JAILNAME}" "${PORT}"
|
|
# A jail should be accessible on the specified SSH port
|
|
run nc -vz 127.0.0.1 "${PORT}"
|
|
assert_success
|
|
}
|
|
|
|
@test "ip-none" {
|
|
# A jail has no IP restriction by default in SSH config
|
|
run grep "root@0.0.0.0/0" "${JAILPATH}/etc/ssh/sshd_config"
|
|
assert_success
|
|
}
|
|
|
|
@test "ip-single" {
|
|
# When an IP is added for a jail
|
|
/usr/lib/bkctld/bkctld-ip "${JAILNAME}" "10.0.0.1"
|
|
# An IP restriction should be present in SSH config
|
|
run grep "root@10.0.0.1" "${JAILPATH}/etc/ssh/sshd_config"
|
|
assert_success
|
|
}
|
|
|
|
@test "ip-multiple" {
|
|
# When multiple IP are added for a jail
|
|
/usr/lib/bkctld/bkctld-ip "${JAILNAME}" "10.0.0.1"
|
|
/usr/lib/bkctld/bkctld-ip "${JAILNAME}" "10.0.0.2"
|
|
# The corresponding IP restrictions should be present in SSH config
|
|
run grep -E -o "root@10.0.0.[0-9]+" "${JAILPATH}/etc/ssh/sshd_config"
|
|
|
|
assert_line "root@10.0.0.1"
|
|
assert_line "root@10.0.0.2"
|
|
}
|
|
|
|
@test "ip-remove" {
|
|
# Add an IP
|
|
/usr/lib/bkctld/bkctld-ip "${JAILNAME}" "10.0.0.1"
|
|
# Remove IP
|
|
/usr/lib/bkctld/bkctld-ip "${JAILNAME}" "0.0.0.0/0"
|
|
# All IP restrictions should be removed from SSH config
|
|
run grep "root@0.0.0.0/0" "${JAILPATH}/etc/ssh/sshd_config"
|
|
assert_success
|
|
}
|
|
|
|
@test "inc" {
|
|
/usr/lib/bkctld/bkctld-start "${JAILNAME}"
|
|
/usr/lib/bkctld/bkctld-inc
|
|
|
|
if [ "${inode}" -eq 256 ]; then
|
|
# On a btrfs filesystem, the inc should be a btrfs volume
|
|
run stat --format=%i "${INCSPATH}/${INC_NAME}"
|
|
assert_success 256
|
|
else
|
|
# On an ext4 filesystem, the inc should be a regular directory
|
|
run test -d "${INCSPATH}/${INC_NAME}"
|
|
assert_success
|
|
fi
|
|
}
|
|
|
|
@test "ssh" {
|
|
/usr/lib/bkctld/bkctld-start "${JAILNAME}"
|
|
/usr/lib/bkctld/bkctld-port "${JAILNAME}" "${PORT}"
|
|
/usr/lib/bkctld/bkctld-key "${JAILNAME}" /root/bkctld.key.pub
|
|
|
|
ssh_options="-p ${PORT} -i /root/bkctld.key -oStrictHostKeyChecking=no"
|
|
|
|
# A started jail should be accessible via SSH
|
|
run ssh ${ssh_options} root@127.0.0.1 ls
|
|
assert_success
|
|
|
|
/usr/lib/bkctld/bkctld-stop "${JAILNAME}"
|
|
# A stopped jail should not be accessible via SSH
|
|
run ssh ${ssh_options} root@127.0.0.1 ls
|
|
assert_failure
|
|
}
|
|
|
|
@test "rsync" {
|
|
/usr/lib/bkctld/bkctld-start "${JAILNAME}"
|
|
/usr/lib/bkctld/bkctld-port "${JAILNAME}" "${PORT}"
|
|
/usr/lib/bkctld/bkctld-key "${JAILNAME}" /root/bkctld.key.pub
|
|
|
|
ssh_options="-p ${PORT} -i /root/bkctld.key -oStrictHostKeyChecking=no"
|
|
# A started jail should be accessible via Rsync
|
|
run rsync -a -e "ssh ${ssh_options}" /tmp/ root@127.0.0.1:/var/backup/
|
|
assert_success
|
|
|
|
/usr/lib/bkctld/bkctld-stop "${JAILNAME}"
|
|
# A stopped jail should not be accessible via Rsync
|
|
run rsync -a -e "${ssh_options}" /tmp/ root@127.0.0.1:/var/backup/
|
|
assert_failure
|
|
}
|
|
|
|
@test "check-default-ok" {
|
|
touch "${JAILPATH}/var/log/lastlog"
|
|
# With default values (2 days critical, 1 day warning),
|
|
# a freshly connected jail should be "ok"
|
|
run /usr/lib/bkctld/bkctld-check
|
|
assert_equal "$status" "0"
|
|
}
|
|
|
|
@test "check-default-warning" {
|
|
lastlog_date=$(date -d -2days --iso-8601=seconds)
|
|
touch --date="${lastlog_date}" "${JAILPATH}/var/log/lastlog"
|
|
# With default values (2 days critical, 1 day warning),
|
|
# a 2 days old jail should be "warning"
|
|
run /usr/lib/bkctld/bkctld-check
|
|
assert_equal "$status" "1"
|
|
}
|
|
|
|
@test "check-default-critical" {
|
|
lastlog_date=$(date -d -3days --iso-8601=seconds)
|
|
touch --date="${lastlog_date}" "${JAILPATH}/var/log/lastlog"
|
|
# With default values (2 days critical, 1 day warning),
|
|
# a 3 days old jail should be "critical"
|
|
run /usr/lib/bkctld/bkctld-check
|
|
assert_equal "$status" "2"
|
|
}
|
|
|
|
@test "check-custom-ok" {
|
|
lastlog_date=$(date -d -3days --iso-8601=seconds)
|
|
touch --date="${lastlog_date}" "${JAILPATH}/var/log/lastlog"
|
|
|
|
echo "CRITICAL=120" >> "/etc/evobackup/${JAILNAME}.d/check_policy"
|
|
echo "WARNING=96" >> "/etc/evobackup/${JAILNAME}.d/check_policy"
|
|
# With custom values (5 days critical, 4 days warning),
|
|
# a 3 days old jail should be "ok"
|
|
run /usr/lib/bkctld/bkctld-check
|
|
assert_equal "$status" "0"
|
|
}
|
|
|
|
@test "check-custom-warning" {
|
|
lastlog_date=$(date -d -3days --iso-8601=seconds)
|
|
touch --date="${lastlog_date}" "${JAILPATH}/var/log/lastlog"
|
|
|
|
echo "CRITICAL=96" >> "/etc/evobackup/${JAILNAME}.d/check_policy"
|
|
echo "WARNING=48" >> "/etc/evobackup/${JAILNAME}.d/check_policy"
|
|
# With custom values (4 days critical, 3 days warning),
|
|
# a 3 days old jail should be "warning"
|
|
run /usr/lib/bkctld/bkctld-check
|
|
assert_equal "$status" "1"
|
|
}
|
|
|
|
@test "check-custom-critical" {
|
|
lastlog_date=$(date -d -10days --iso-8601=seconds)
|
|
touch --date="${lastlog_date}" "${JAILPATH}/var/log/lastlog"
|
|
|
|
echo "CRITICAL=96" >> "/etc/evobackup/${JAILNAME}.d/check_policy"
|
|
echo "WARNING=48" >> "/etc/evobackup/${JAILNAME}.d/check_policy"
|
|
# With custom values (4 days critical, 3 days warning),
|
|
# a 10 days old jail should be "critical"
|
|
run /usr/lib/bkctld/bkctld-check
|
|
assert_equal "$status" "2"
|
|
}
|
|
|
|
@test "check-disabled-warning" {
|
|
lastlog_date=$(date -d -2days --iso-8601=seconds)
|
|
touch --date="${lastlog_date}" "${JAILPATH}/var/log/lastlog"
|
|
|
|
echo "WARNING=0" >> "/etc/evobackup/${JAILNAME}.d/check_policy"
|
|
# With custom values (warning disabled, default critical),
|
|
# a 2 days old jail should still be "ok"
|
|
run /usr/lib/bkctld/bkctld-check
|
|
assert_equal "$status" "0"
|
|
}
|
|
|
|
@test "check-disabled-critical" {
|
|
lastlog_date=$(date -d -3days --iso-8601=seconds)
|
|
touch --date="${lastlog_date}" "${JAILPATH}/var/log/lastlog"
|
|
|
|
echo "CRITICAL=0" >> "/etc/evobackup/${JAILNAME}.d/check_policy"
|
|
# With custom values (critical disabled, default warning),
|
|
# a 3 days old jail should only be "warning"
|
|
run /usr/lib/bkctld/bkctld-check
|
|
assert [ "$status" = "1" ]
|
|
}
|