36 lines
2.4 KiB
JavaScript
36 lines
2.4 KiB
JavaScript
"use strict";
|
|
|
|
const assert = require("node:assert/strict");
|
|
const test = require("node:test");
|
|
const {
|
|
execute,
|
|
INSPECT_OWNER_SSH_LOGIN,
|
|
DISABLE_OWNER_PASSWORD_LOGIN,
|
|
RESTORE_OWNER_PASSWORD_LOGIN,
|
|
RESTORE_CODE_CHANNEL_OWNER_LOGIN,
|
|
} = require("./owner-access-broker");
|
|
|
|
test("owner-access executor keeps SSH and code-channel recovery distinct", async () => {
|
|
assert.match(INSPECT_OWNER_SSH_LOGIN, /sshd -T/);
|
|
assert.doesNotMatch(INSPECT_OWNER_SSH_LOGIN, /write_text|systemctl reload/);
|
|
assert.match(DISABLE_OWNER_PASSWORD_LOGIN, /PasswordAuthentication", "no"/);
|
|
assert.match(DISABLE_OWNER_PASSWORD_LOGIN, /KbdInteractiveAuthentication", "no"/);
|
|
assert.match(DISABLE_OWNER_PASSWORD_LOGIN, /PermitRootLogin", "prohibit-password"/);
|
|
assert.match(DISABLE_OWNER_PASSWORD_LOGIN, /sshd -t/);
|
|
assert.match(DISABLE_OWNER_PASSWORD_LOGIN, /systemctl reload ssh/);
|
|
assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /PasswordAuthentication yes/);
|
|
assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /sshd -t/);
|
|
assert.match(RESTORE_OWNER_PASSWORD_LOGIN, /systemctl reload ssh/);
|
|
assert.doesNotMatch(RESTORE_OWNER_PASSWORD_LOGIN, /PermitRootLogin yes/);
|
|
assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /legacy owner credential unavailable/);
|
|
assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /pragma wal_checkpoint\(truncate\)/);
|
|
assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /channel\.backup\(snapshot\)/);
|
|
assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /prohibit_login=0/);
|
|
assert.match(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /hlcc-jd-candidate\.service/);
|
|
assert.doesNotMatch(RESTORE_CODE_CHANNEL_OWNER_LOGIN, /PasswordAuthentication/);
|
|
assert.match(require("node:fs").readFileSync(require.resolve("./owner-access-broker"), "utf8"), /150000/);
|
|
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "unknown" }), { ok: false, error: "action_not_registered" });
|
|
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "restore-owner-password-login", cmd: "id" }), { ok: false, error: "arbitrary_command_forbidden" });
|
|
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "disable-owner-password-login", args: ["--force"] }), { ok: false, error: "arbitrary_command_forbidden" });
|
|
assert.deepEqual(await execute({ target: "JD-FD-PRIMARY", action: "restore-code-channel-owner-login", shell: "id" }), { ok: false, error: "arbitrary_command_forbidden" });
|
|
});
|