Files
@ a718023f9e76
Branch filter:
Location: majic-ansible-roles/roles/ldap_server/molecule/default/tests/test_mandatory.py - annotation
a718023f9e76
5.4 KiB
text/x-python
MAR-181: Drop support for Debian 9 Stretch from the backup_client role:
- Provide more details on use of pexpect+sftp backed for
Duplicity (backend has to be used on Debian 10 Buster as well, not
just Debian 9 Stretch).
- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
- Provide more details on use of pexpect+sftp backed for
Duplicity (backend has to be used on Debian 10 Buster as well, not
just Debian 9 Stretch).
- Switch to using IPs from VirtualBox default allowed host-only
network subnets.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 | c082a26b62ff c082a26b62ff 75bfe558bba9 2e3af1a245a5 064760bdc9d5 064760bdc9d5 c082a26b62ff 064760bdc9d5 d62b3adec462 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 65ad7f138939 ec4e3e91c4d3 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 d752715bb533 064760bdc9d5 064760bdc9d5 75bfe558bba9 064760bdc9d5 75bfe558bba9 75bfe558bba9 064760bdc9d5 064760bdc9d5 5a36f75bc297 064760bdc9d5 bc7eef6554a9 064760bdc9d5 5a36f75bc297 064760bdc9d5 bc7eef6554a9 064760bdc9d5 064760bdc9d5 75bfe558bba9 75bfe558bba9 75bfe558bba9 75bfe558bba9 2e3af1a245a5 75bfe558bba9 2e3af1a245a5 75bfe558bba9 75bfe558bba9 75bfe558bba9 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 8d272d91d3d2 2e3af1a245a5 75bfe558bba9 75bfe558bba9 75bfe558bba9 75bfe558bba9 75bfe558bba9 2e3af1a245a5 75bfe558bba9 2e3af1a245a5 75bfe558bba9 75bfe558bba9 2e3af1a245a5 75bfe558bba9 75bfe558bba9 2e3af1a245a5 75bfe558bba9 75bfe558bba9 2e3af1a245a5 75bfe558bba9 75bfe558bba9 2e3af1a245a5 75bfe558bba9 8d272d91d3d2 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 ec4e3e91c4d3 064760bdc9d5 064760bdc9d5 064760bdc9d5 | import os
import defusedxml.ElementTree as ElementTree
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-mandatory')
def test_base_entry(host):
"""
Tests if the base entry has been created correctly.
"""
with host.sudo():
base_dn = host.run("ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -b dc=local -s base")
assert base_dn.rc == 0
assert "dc: local" in base_dn.stdout.split("\n")
assert "o: Private" in base_dn.stdout.split("\n")
def test_log_level(host):
"""
Tests if the logging level has been set correctly.
"""
with host.sudo():
log_level = host.run('ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -b cn=config -s base olcLogLevel')
assert log_level.rc == 0
assert 'olcLogLevel: 256' in log_level.stdout
def test_certificate_validity_check_configuration(host):
"""
Tests if certificate validity check configuration file has been deployed
correctly.
"""
inventory_hostname = host.ansible.get_variables()['inventory_hostname']
config = host.file('/etc/check_certificate/%s_ldap.conf' % inventory_hostname)
assert config.is_file
assert config.user == 'root'
assert config.group == 'root'
assert config.mode == 0o644
assert config.content_string == "/etc/ssl/certs/%s_ldap.pem" % inventory_hostname
def test_tls_connectivity(host):
"""
Tests if it is possible to connect to the LDAP server using
STARTTLS/TLS.
"""
starttls = host.run('ldapwhoami -Z -x -H ldap://parameters-mandatory/')
assert starttls.rc == 0
assert starttls.stdout == 'anonymous\n'
tls = host.run('ldapwhoami -x -H ldaps://parameters-mandatory/')
assert tls.rc == 0
assert tls.stdout == 'anonymous\n'
def test_tls_version_and_ciphers(host):
"""
Tests if the correct TLS version and ciphers have been enabled.
"""
expected_tls_versions = ["TLSv1.2"]
# @TODO: Under Debian Stretch, the DHE ciphers are not usable due
# to a bug present in OpenLDAP 2.4.44. See
# https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/1656979
# for details.
expected_tls_ciphers = {
"stretch": [
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
],
"buster": [
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
]
}
distribution_release = host.ansible("setup")["ansible_facts"]["ansible_distribution_release"]
# Run the nmap scanner against the LDAP server, and fetch the
# results.
nmap = host.run("nmap -sV --script ssl-enum-ciphers -p 636 localhost -oX /tmp/report.xml")
assert nmap.rc == 0
report_content = host.file('/tmp/report.xml').content_string
report_root = ElementTree.fromstring(report_content)
tls_versions = []
tls_ciphers = set()
for child in report_root.findall("./host/ports/port/script/table"):
tls_versions.append(child.attrib['key'])
for child in report_root.findall(".//table[@key='ciphers']/table/elem[@key='name']"):
tls_ciphers.add(child.text)
tls_versions.sort()
tls_ciphers = sorted(list(tls_ciphers))
assert tls_versions == expected_tls_versions
assert tls_ciphers == expected_tls_ciphers[distribution_release]
def test_ssf_configuration(host):
"""
Tests if the SSF olcSecurity configuration has been set-up correctly.
"""
with host.sudo():
ssf = host.run('ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -b cn=config olcSecurity')
assert ssf.rc == 0
assert "olcSecurity: ssf=128" in ssf.stdout
def test_permissions(host):
"""
Tests if LDAP directory permissions have been set-up correctly.
"""
with host.sudo():
permissions = host.run("ldapsearch -o ldif-wrap=no -H ldapi:/// -Q -LLL -Y EXTERNAL -b 'olcDatabase={1}mdb,cn=config' -s base olcAccess olcAccess")
expected_permissions = """olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by dn="cn=admin,dc=local" manage by * break
olcAccess: {1}to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none
olcAccess: {2}to dn.base="" by * read
olcAccess: {3}to * by self write by dn="cn=admin,dc=local" write by users read by * none"""
assert permissions.rc == 0
assert expected_permissions in permissions.stdout
def test_services_login_entries(host):
"""
Tests if the service/consumer login entries have been set correctly.
"""
with host.sudo():
entries = host.run("ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -s one -b ou=services,dc=local '(objectClass=simpleSecurityObject)'")
assert entries.rc == 0
assert entries.stdout == ""
def test_group_entries(host):
"""
Tests that no group entries have been created out-of-the-box.
"""
with host.sudo():
entries = host.run("ldapsearch -H ldapi:/// -Q -LLL -Y EXTERNAL -s one -b ou=groups,dc=local '(objectClass=groupOfUniqueNames)'")
assert entries.rc == 0
assert entries.stdout == ""
|