bingshuo/guanghu-ice-heart
Watch
1
0
Fork
You've already forked guanghu-ice-heart
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

security(jd): add persona-only SSH closure actions

Browse source
This commit is contained in:
冰朔 2026-07-27 14:33:03 +08:00
commit 7c3c8e9238
7 changed files with 80 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
server-tools/lake-lamp-authz/owner-access-broker.test.js
View file

@ -4,11 +4,20 @@ const assert = require("node:assert/strict");
const test = require("node:test");
const {
execute,
INSPECT_OWNER_SSH_LOGIN,
DISABLE_OWNER_PASSWORD_LOGIN,
RESTORE_OWNER_PASSWORD_LOGIN,
RESTORE_CODE_CHANNEL_OWNER_LOGIN,
} = require("./owner-access-broker");
test("owner-access executor keeps SSH and code-channel recovery distinct", async () => {
assert.match(INSPECT_OWNER_SSH_LOGIN, /sshd -T/);
assert.doesNotMatch(INSPECT_OWNER_SSH_LOGIN, /write_text|systemctl reload/);
assert.match(DISABLE_OWNER_PASSWORD_LOGIN, /PasswordAuthentication", "no"/);
assert.match(DISABLE_OWNER_PASSWORD_LOGIN, /KbdInteractiveAuthentication", "no"/);
assert.match(DISABLE_OWNER_PASSWORD_LOGIN, /PermitRootLogin", "prohibit-password"/);
assert.match(DISABLE_OWNER_PASSWORD_LOGIN, /sshd -t/);
assert.match(DISABLE_OWNER_PASSWORD_LOGIN, /systemctl reload ssh/);
assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /PasswordAuthentication yes/);
assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /sshd -t/);
assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /systemctl reload ssh/);
@ -22,5 +31,6 @@ test("owner-access executor keeps SSH and code-channel recovery distinct", async
assert.match(require("node:fs").readFileSync(require.resolve("./owner-access-broker"), "utf8"), /150000/);
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "unknown" }), { ok: false, error: "action_not_registered" });
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "restore-owner-password-login", cmd: "id" }), { ok: false, error: "arbitrary_command_forbidden" });
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "disable-owner-password-login", args: ["--force"] }), { ok: false, error: "arbitrary_command_forbidden" });
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "restore-code-channel-owner-login", shell: "id" }), { ok: false, error: "arbitrary_command_forbidden" });
});