!jtzdZrQSXtEpeGtzAn:nixos.org

Testing with Nix

95 Members
24 Servers

You have reached the beginning of time (for this room).

SenderMessageTime
16 Oct 2023
@artturin:matrix.orgArtturin Maybe a new arg to wait_for_unit 06:11:39
@artturin:matrix.orgArtturinfailState successState06:12:13
@vengmark2:matrix.orgl0b0

Weird. I just tried this:

    service_name = "ssh-audit.service"
    ${serverName}.succeed(f"systemd-run --unit={service_name} ${pkgs.ssh-audit}/bin/ssh-audit --client-audit --port=${toString sshAuditPort}")
    ${serverName}.wait_for_unit(service_name)
    ${clientName}.execute(
        f"ssh {ssh_options} -i privkey.snakeoil -p ${toString sshAuditPort} ${sshUsername}@server true",
        check_return=False,
        timeout=10
    )
    ${serverName}.succeed(f"exit $(systemctl show --property=ExecMainStatus --value {service_name})")

Couldn't get it to fail when the configuration was bad.

06:15:40
@artturin:matrix.orgArtturin

Btw it's possible to add env vars to the systemd-run env

dbus-update-activation-environment --systemd PATH this would add the PATH

06:17:55
@artturin:matrix.orgArtturin *

Btw it's possible to add env vars to the systemd-run env

dbus-update-activation-environment --systemd PATH this would add the PATH, the sway module has dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP

06:18:27
@artturin:matrix.orgArtturin
In reply to @vengmark2:matrix.org

Weird. I just tried this:

    service_name = "ssh-audit.service"
    ${serverName}.succeed(f"systemd-run --unit={service_name} ${pkgs.ssh-audit}/bin/ssh-audit --client-audit --port=${toString sshAuditPort}")
    ${serverName}.wait_for_unit(service_name)
    ${clientName}.execute(
        f"ssh {ssh_options} -i privkey.snakeoil -p ${toString sshAuditPort} ${sshUsername}@server true",
        check_return=False,
        timeout=10
    )
    ${serverName}.succeed(f"exit $(systemctl show --property=ExecMainStatus --value {service_name})")

Couldn't get it to fail when the configuration was bad.

All the outputted thing should be in the output 		06:20:24
@artturin:matrix.orgArtturindid it print the expected output but just didn't fail06:20:34
@vengmark2:matrix.orgl0b0 OIC, ${serverName}.wait_for_unit(service_name) doesn't wait long enough, so the next line just never talks to ssh-audit. 06:22:36
@vengmark2:matrix.orgl0b0 I think I might still need the sleep(5) then. 06:23:00
@artturin:matrix.orgArtturinhm yeah it just waits for active06:23:19
@vengmark2:matrix.orgl0b0 Because there's just no way to check that the port is open without shutting down ssh-audit. 06:23:28
@vengmark2:matrix.orgl0b0 Yay, it worked! This is something I've been hoping to be able to do for years. Thank you, Artturin ! 07:05:48
@artturin:matrix.orgArtturin l0b0: That tests looks like it could be added to nixpkgs 07:45:32
@artturin:matrix.orgArtturinand added to the package07:46:15
@artturin:matrix.orgArtturin * and added to the package's passthru.tests07:46:22
@artturin:matrix.orgArtturinhmm well there's your ssh-server.nix and ssh-client.nix07:47:28
@artturin:matrix.orgArtturinwell if you can think of a way im sure it would be useful07:47:48
@artturin:matrix.orgArtturinNot exactly sure what it's testing07:48:10
@vengmark2:matrix.orgl0b0 It's checking that my configuration conforms to best practices as recommended by ssh-audit. I'm no SSH/security expert, but at least some of the recommendations make sense. 07:49:19
@vengmark2:matrix.orgl0b0It might be useful as a demo for what could be considered a secure configuration (at least by some segment of users) "right now", rather than just using the OpenSSH defaults like NixOS does.07:50:41

Show newer messages

Back to Room ListRoom Version: 9