|
| 1 | +package mos_test |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + "os" |
| 6 | + "os/exec" |
| 7 | + "path/filepath" |
| 8 | + |
| 9 | + . "github.com/onsi/ginkgo/v2" |
| 10 | + . "github.com/onsi/gomega" |
| 11 | + . "github.com/spectrocloud/peg/matcher" |
| 12 | +) |
| 13 | + |
| 14 | +// The DevSec SSH baseline is the reference spec we harden against. |
| 15 | +// See: https://github.com/dev-sec/ssh-baseline |
| 16 | +// |
| 17 | +// This test does not translate the baseline into Ginkgo assertions. |
| 18 | +// It runs the upstream InSpec profile against a booted Kairos VM via |
| 19 | +// cinc-auditor (a FOSS drop-in for chef/inspec, since InSpec >= 5 is |
| 20 | +// no longer under an OSS licence). The runner must have cinc-auditor |
| 21 | +// installed; the CI job in .github/workflows/reusable-qemu-test.yaml |
| 22 | +// takes care of that when the test label is "ssh-hardening". |
| 23 | +// |
| 24 | +// This test is expected to FAIL on master until the ssh_hardening |
| 25 | +// profile lands in kairos-init. That is the point: the pipeline is |
| 26 | +// the spec, in TDD order. |
| 27 | +var _ = Describe("ssh hardening", Label("ssh-hardening"), func() { |
| 28 | + var vm VM |
| 29 | + |
| 30 | + BeforeEach(func() { |
| 31 | + _, vm = startVM() |
| 32 | + vm.EventuallyConnects(1200) |
| 33 | + }) |
| 34 | + |
| 35 | + AfterEach(func() { |
| 36 | + if CurrentSpecReport().Failed() { |
| 37 | + serial, _ := os.ReadFile(filepath.Join(vm.StateDir, "serial.log")) |
| 38 | + _ = os.MkdirAll("logs", 0o755) |
| 39 | + _ = os.WriteFile(filepath.Join("logs", "serial.log"), serial, 0o644) |
| 40 | + } |
| 41 | + Expect(vm.Destroy(nil)).ToNot(HaveOccurred()) |
| 42 | + }) |
| 43 | + |
| 44 | + It("passes the DevSec ssh-baseline profile", func() { |
| 45 | + sshPort := os.Getenv("SSH_PORT") |
| 46 | + Expect(sshPort).ToNot(BeEmpty(), "SSH_PORT must be set by the CI job so cinc-auditor can reach the VM") |
| 47 | + |
| 48 | + reportDir := "logs" |
| 49 | + Expect(os.MkdirAll(reportDir, 0o755)).To(Succeed()) |
| 50 | + reportPath := filepath.Join(reportDir, "ssh-baseline.json") |
| 51 | + |
| 52 | + cmd := exec.Command("cinc-auditor", "exec", |
| 53 | + "https://github.com/dev-sec/ssh-baseline", |
| 54 | + "--target", fmt.Sprintf("ssh://%s@127.0.0.1:%s", user(), sshPort), |
| 55 | + "--password", pass(), |
| 56 | + "--reporter", "cli", "json:"+reportPath, |
| 57 | + "--chef-license", "accept-silent", |
| 58 | + ) |
| 59 | + cmd.Env = append(os.Environ(), "TERM=dumb") |
| 60 | + out, err := cmd.CombinedOutput() |
| 61 | + GinkgoWriter.Printf("cinc-auditor output:\n%s\n", string(out)) |
| 62 | + |
| 63 | + Expect(err).ToNot(HaveOccurred(), |
| 64 | + "ssh-baseline profile reported failures; see %s for the JSON report", reportPath) |
| 65 | + }) |
| 66 | +}) |
0 commit comments