Skip to content

Commit d64dd24

Browse files
sazsaz
committed
add more tests
1 parent ad23df8 commit d64dd24

7 files changed

Lines changed: 731 additions & 13 deletions

File tree

‎manifests/server.pp‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,12 @@
4444
# @param ensure
4545
# Ensurable param to ssh server
4646
#
47+
# @param service_ensure
48+
# Whether the service should be running or stopped, defaults to true when ensure is set to present, otherwise false
49+
#
50+
# @param service_enable
51+
# Whether the service should be started at boot. Will be added automatically if ensure is running/removed if ensure is stopped
52+
#
4753
# @param include_dir
4854
# Path to sshd include directory.
4955
#
@@ -127,6 +133,8 @@
127133
Variant[Integer, String[1]] $config_group,
128134
Hash $default_options,
129135
String $ensure = present,
136+
Stdlib::Ensure::Service $service_ensure = $ensure ? { 'present' => 'running', 'absent' => 'stopped' },
137+
Boolean $service_enable = ($service_ensure == 'running'),
130138
Optional[Stdlib::Absolutepath] $include_dir = undef,
131139
Stdlib::Filemode $include_dir_mode = '0700',
132140
Boolean $include_dir_purge = true,

‎manifests/server/service.pp‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,16 @@
11
# @summary
2-
# This class managed ssh server service
2+
# This class manages the ssh server service
33
#
44
# @api private
55
#
6-
# @param ensure
7-
# Ensurable service param
8-
#
9-
# @param enable
10-
# Define if service is enable
11-
#
12-
class ssh::server::service (
13-
Stdlib::Ensure::Service $ensure = 'running',
14-
Boolean $enable = true,
15-
) {
6+
class ssh::server::service {
167
assert_private()
178

189
service { $ssh::server::service_name:
19-
ensure => $ssh::server::service::ensure,
10+
ensure => $ssh::server::service_ensure,
2011
hasstatus => true,
2112
hasrestart => true,
22-
enable => $ssh::server::service::enable,
13+
enable => $ssh::server::service_enable,
2314
require => Class['ssh::server::config'],
2415
}
2516
}

‎spec/classes/client_spec.rb‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,89 @@
140140
it { is_expected.to compile.with_all_deps }
141141
it { is_expected.not_to contain_ssh__client__config_file('custom') }
142142
end
143+
144+
context 'with use_augeas enabled' do
145+
let :pre_condition do
146+
'define ssh_config ($ensure = present, $key = undef, $value = undef, $target = undef, $host = undef) {}'
147+
end
148+
149+
let :params do
150+
{
151+
use_augeas: true,
152+
options: {
153+
'ForwardAgent' => 'no',
154+
'StrictHostKeyChecking' => 'ask',
155+
},
156+
options_absent: ['GSSAPIAuthentication'],
157+
}
158+
end
159+
160+
it { is_expected.to compile.with_all_deps }
161+
it { is_expected.not_to contain_concat('/etc/ssh/ssh_config') }
162+
163+
it {
164+
is_expected.to contain_ssh_config('ForwardAgent').with(
165+
ensure: 'present',
166+
key: 'ForwardAgent',
167+
value: 'no',
168+
target: '/etc/ssh/ssh_config',
169+
)
170+
}
171+
172+
it {
173+
is_expected.to contain_ssh_config('StrictHostKeyChecking').with(
174+
ensure: 'present',
175+
key: 'StrictHostKeyChecking',
176+
value: 'ask',
177+
)
178+
}
179+
180+
it {
181+
is_expected.to contain_ssh_config('GSSAPIAuthentication').with(
182+
ensure: 'absent',
183+
key: 'GSSAPIAuthentication',
184+
)
185+
}
186+
end
187+
188+
context 'with use_augeas and host block options' do
189+
let :pre_condition do
190+
'define ssh_config ($ensure = present, $key = undef, $value = undef, $target = undef, $host = undef) {}'
191+
end
192+
193+
let :params do
194+
{
195+
use_augeas: true,
196+
options: {
197+
'Host *.example.com' => {
198+
'ForwardAgent' => 'yes',
199+
'BatchMode' => 'yes',
200+
},
201+
},
202+
options_absent: [],
203+
}
204+
end
205+
206+
it { is_expected.to compile.with_all_deps }
207+
208+
it {
209+
is_expected.to contain_ssh_config('ForwardAgent *.example.com').with(
210+
ensure: 'present',
211+
host: '*.example.com',
212+
key: 'ForwardAgent',
213+
value: 'yes',
214+
)
215+
}
216+
217+
it {
218+
is_expected.to contain_ssh_config('BatchMode *.example.com').with(
219+
ensure: 'present',
220+
host: '*.example.com',
221+
key: 'BatchMode',
222+
value: 'yes',
223+
)
224+
}
225+
end
143226
end
144227
end
145228
end

‎spec/classes/server_spec.rb‎

Lines changed: 228 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,234 @@
193193
expect(exported_resources).not_to contain_sshkey('foo.example.com_ed25519')
194194
end
195195
end
196+
197+
context 'with use_augeas enabled' do
198+
let :pre_condition do
199+
<<~PP
200+
define sshd_config ($ensure = present, $key = undef, $value = undef, $target = undef, $condition = undef) {}
201+
define sshd_config_subsystem ($command = undef) {}
202+
PP
203+
end
204+
205+
let :params do
206+
{
207+
use_augeas: true,
208+
options: {
209+
'X11Forwarding' => 'no',
210+
'PermitRootLogin' => 'no',
211+
},
212+
options_absent: ['GSSAPIAuthentication'],
213+
}
214+
end
215+
216+
it { is_expected.to compile.with_all_deps }
217+
it { is_expected.not_to contain_concat('/etc/ssh/sshd_config') }
218+
219+
it {
220+
is_expected.to contain_sshd_config('X11Forwarding').with(
221+
ensure: 'present',
222+
key: 'X11Forwarding',
223+
value: 'no',
224+
target: '/etc/ssh/sshd_config',
225+
)
226+
}
227+
228+
it {
229+
is_expected.to contain_sshd_config('PermitRootLogin').with(
230+
ensure: 'present',
231+
key: 'PermitRootLogin',
232+
value: 'no',
233+
)
234+
}
235+
236+
it {
237+
is_expected.to contain_sshd_config('GSSAPIAuthentication').with(
238+
ensure: 'absent',
239+
key: 'GSSAPIAuthentication',
240+
)
241+
}
242+
end
243+
244+
context 'with use_augeas and match block options' do
245+
let :pre_condition do
246+
<<~PP
247+
define sshd_config ($ensure = present, $key = undef, $value = undef, $target = undef, $condition = undef) {}
248+
define sshd_config_subsystem ($command = undef) {}
249+
PP
250+
end
251+
252+
let :params do
253+
{
254+
use_augeas: true,
255+
options: {
256+
'Match User www-data' => {
257+
'ChrootDirectory' => '%h',
258+
'ForceCommand' => 'internal-sftp',
259+
},
260+
},
261+
options_absent: [],
262+
}
263+
end
264+
265+
it { is_expected.to compile.with_all_deps }
266+
267+
it {
268+
is_expected.to contain_sshd_config('ChrootDirectory User www-data').with(
269+
ensure: 'present',
270+
condition: 'User www-data',
271+
key: 'ChrootDirectory',
272+
value: '%h',
273+
)
274+
}
275+
276+
it {
277+
is_expected.to contain_sshd_config('ForceCommand User www-data').with(
278+
ensure: 'present',
279+
condition: 'User www-data',
280+
key: 'ForceCommand',
281+
value: 'internal-sftp',
282+
)
283+
}
284+
end
285+
286+
context 'with use_issue_net enabled' do
287+
let :params do
288+
{
289+
use_issue_net: true,
290+
}
291+
end
292+
293+
it { is_expected.to compile.with_all_deps }
294+
295+
it {
296+
is_expected.to contain_file('/etc/issue.net').with(
297+
ensure: 'file',
298+
owner: 0,
299+
group: 0,
300+
)
301+
}
302+
303+
it { is_expected.to contain_file('/etc/issue.net').that_notifies("Service[#{svc_name}]") }
304+
305+
it {
306+
is_expected.to contain_concat__fragment('banner file').with(
307+
target: '/etc/ssh/sshd_config',
308+
content: "Banner /etc/issue.net\n",
309+
order: '01',
310+
)
311+
}
312+
end
313+
314+
context 'with include_dir set' do
315+
let :params do
316+
{
317+
include_dir: '/etc/ssh/sshd_config.d',
318+
}
319+
end
320+
321+
it { is_expected.to compile.with_all_deps }
322+
323+
it {
324+
is_expected.to contain_file('/etc/ssh/sshd_config.d').with(
325+
ensure: 'directory',
326+
owner: 0,
327+
group: 0,
328+
mode: '0700',
329+
purge: true,
330+
recurse: true,
331+
)
332+
}
333+
end
334+
335+
context 'with include_dir and include_dir_purge false' do
336+
let :params do
337+
{
338+
include_dir: '/etc/ssh/sshd_config.d',
339+
include_dir_purge: false,
340+
}
341+
end
342+
343+
it { is_expected.to compile.with_all_deps }
344+
345+
it {
346+
is_expected.to contain_file('/etc/ssh/sshd_config.d').with(
347+
ensure: 'directory',
348+
purge: false,
349+
recurse: false,
350+
)
351+
}
352+
end
353+
354+
context 'with include_dir and custom mode' do
355+
let :params do
356+
{
357+
include_dir: '/etc/ssh/sshd_config.d',
358+
include_dir_mode: '0755',
359+
}
360+
end
361+
362+
it {
363+
is_expected.to contain_file('/etc/ssh/sshd_config.d').with(
364+
mode: '0755',
365+
)
366+
}
367+
end
368+
369+
context 'with config_files' do
370+
let :params do
371+
{
372+
include_dir: '/etc/ssh/sshd_config.d',
373+
config_files: {
374+
'hardening' => {
375+
'options' => {
376+
'PermitRootLogin' => 'no',
377+
},
378+
},
379+
'logging' => {
380+
'options' => {
381+
'LogLevel' => 'VERBOSE',
382+
},
383+
},
384+
},
385+
}
386+
end
387+
388+
it { is_expected.to compile.with_all_deps }
389+
it { is_expected.to contain_ssh__server__config_file('hardening') }
390+
it { is_expected.to contain_ssh__server__config_file('logging') }
391+
392+
it {
393+
is_expected.to contain_concat('/etc/ssh/sshd_config.d/hardening.conf').with(
394+
ensure: 'present',
395+
owner: 0,
396+
group: 0,
397+
)
398+
}
399+
400+
it {
401+
is_expected.to contain_concat('/etc/ssh/sshd_config.d/logging.conf').with(
402+
ensure: 'present',
403+
owner: 0,
404+
group: 0,
405+
)
406+
}
407+
end
408+
409+
# Skip OSes where hiera sets include_dir by default (e.g. RedHat 9)
410+
context 'without include_dir but with config_files', unless: os_facts.dig(:os, 'family') == 'RedHat' && os_facts.dig(:os, 'release', 'major') == '9' do
411+
let :params do
412+
{
413+
config_files: {
414+
'hardening' => {
415+
'options' => {},
416+
},
417+
},
418+
}
419+
end
420+
421+
it { is_expected.to compile.with_all_deps }
422+
it { is_expected.not_to contain_ssh__server__config_file('hardening') }
423+
end
196424
end
197425
end
198426
end

0 commit comments

Comments
 (0)