Files
@ 8d272d91d3d2
Branch filter:
Location: majic-ansible-roles/roles/mail_forwarder/molecule/default/tests/test_default.py - annotation
8d272d91d3d2
3.6 KiB
text/x-python
MAR-165: Deploy Diffie-Helman parameters for LDAP server in the ldap_server role:
- Not relevant for Debian Strech because of a bug in the OpenLDAP
version it ships with.
- This should allow use of DHE ciphers with LDAP server.
- Generated DH parameters only help pick one of the parameters from
RFC-7919 (based on the size of generated ones).
- Make the cipher test lists distro-specific due to differences
between supported algorithms in respective GnuTLS versions.
- Not relevant for Debian Strech because of a bug in the OpenLDAP
version it ships with.
- This should allow use of DHE ciphers with LDAP server.
- Generated DH parameters only help pick one of the parameters from
RFC-7919 (based on the size of generated ones).
- Make the cipher test lists distro-specific due to differences
between supported algorithms in respective GnuTLS versions.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 | 13982172ed2e 13982172ed2e 36e1c9460cd6 36e1c9460cd6 f774e938a4ed 36e1c9460cd6 d62b3adec462 f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed fb5e4e372902 fb5e4e372902 fb5e4e372902 f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed be01ee86b9dd f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed 1733003af19f f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed fb5e4e372902 f774e938a4ed f774e938a4ed 36e1c9460cd6 36e1c9460cd6 fb5e4e372902 f774e938a4ed f774e938a4ed f774e938a4ed 36e1c9460cd6 fb5e4e372902 fb5e4e372902 f774e938a4ed f774e938a4ed f774e938a4ed f774e938a4ed ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 af834be42e8e ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 af834be42e8e ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 90bda8fea4aa 90bda8fea4aa ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 ed73868fa196 | import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-*')
def test_installed_packages(host):
"""
Tests if the necessary packages have been installed.
"""
assert host.package('postfix').is_installed
assert host.package('procmail').is_installed
assert host.package('swaks').is_installed
def test_removed_packages(host):
"""
Tests if certain packages have been removed from the system.
"""
assert not host.package('exim4').is_installed
def test_smtp_relay_truststore_file(host):
"""
Tests if SMTP relay truststore has correct permissions and content.
"""
truststore = host.file('/etc/ssl/certs/smtp_relay_truststore.pem')
assert truststore.is_file
assert truststore.user == 'root'
assert truststore.group == 'root'
assert truststore.mode == 0o644
assert truststore.content_string == open("tests/data/x509/ca/level1.cert.pem", "r").read().rstrip()
def test_smtp_mailname(host):
"""
Tests if SMTP mailname configuration file has correct permissions.
"""
mailname = host.file('/etc/mailname')
assert mailname.is_file
assert mailname.user == 'root'
assert mailname.group == 'root'
assert mailname.mode == 0o644
def test_postfix_main_cf_file(host):
"""
Tests Postfix main configuration file permissions.
"""
config = host.file('/etc/postfix/main.cf')
assert config.is_file
assert config.user == 'root'
assert config.group == 'root'
assert config.mode == 0o644
def test_services(host):
"""
Tests if all the necessary services are enabled and running.
"""
service = host.service('postfix')
assert service.is_running
assert service.is_enabled
def test_firewall_configuration_file(host):
"""
Tests if firewall configuration file has correct permissions.
"""
with host.sudo():
config = host.file('/etc/ferm/conf.d/20-mail.conf')
assert config.is_file
assert config.user == 'root'
assert config.group == 'root'
assert config.mode == 0o640
def test_smtp_server_dh_parameter_file(host):
"""
Tests if the Diffie-Hellman parameter file has been generated
correctly.
"""
hostname = host.run('hostname').stdout.strip()
dhparam_file_path = '/etc/ssl/private/%s_smtp.dh.pem' % hostname
with host.sudo():
dhparam_file = host.file(dhparam_file_path)
assert dhparam_file.is_file
assert dhparam_file.user == 'root'
assert dhparam_file.group == 'root'
assert dhparam_file.mode == 0o640
dhparam_info = host.run("openssl dhparam -noout -text -in %s", dhparam_file_path)
assert "DH Parameters: (2048 bit)" in dhparam_info.stdout
def test_smtp_server_uses_correct_dh_parameters(host):
"""
Tests if the SMTP server uses the generated Diffie-Hellman parameter.
"""
hostname = host.run('hostname').stdout.strip()
with host.sudo():
expected_dhparam = host.file('/etc/ssl/private/%s_smtp.dh.pem' % hostname).content_string.rstrip()
connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=smtp --port 25 "
"--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose localhost")
output = connection.stdout
begin_marker = "-----BEGIN DH PARAMETERS-----"
end_marker = "-----END DH PARAMETERS-----"
used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)]
assert used_dhparam == expected_dhparam
|