diff --git a/roles/mail_server/molecule/default/group_vars/parameters-optional.yml b/roles/mail_server/molecule/default/group_vars/parameters-optional.yml index ae316e74ad990e756e4b91acb0457b840cd7f0aa..45e2a4f49ed19fbc0c2210195f5e1b40e9d7801a 100644 --- a/roles/mail_server/molecule/default/group_vars/parameters-optional.yml +++ b/roles/mail_server/molecule/default/group_vars/parameters-optional.yml @@ -15,12 +15,12 @@ mail_user: virtmail mail_user_uid: 5000 mail_user_gid: 5000 imap_max_user_connections_per_ip: 2 -imap_tls_certificate: "{{ lookup('file', 'tests/data/x509/parameters-optional_imap.cert.pem') }}" -imap_tls_key: "{{ lookup('file', 'tests/data/x509/parameters-optional_imap.key.pem') }}" +imap_tls_certificate: "{{ lookup('file', 'tests/data/x509/{{ inventory_hostname }}_imap.cert.pem') }}" +imap_tls_key: "{{ lookup('file', 'tests/data/x509/{{ inventory_hostname }}_imap.key.pem') }}" local_mail_aliases: root: "john.doe@domain1" -smtp_tls_certificate: "{{ lookup('file', 'tests/data/x509/parameters-optional_smtp.cert.pem') }}" -smtp_tls_key: "{{ lookup('file', 'tests/data/x509/parameters-optional_smtp.key.pem') }}" +smtp_tls_certificate: "{{ lookup('file', 'tests/data/x509/{{ inventory_hostname }}_smtp.cert.pem') }}" +smtp_tls_key: "{{ lookup('file', 'tests/data/x509/{{ inventory_hostname }}_smtp.key.pem') }}" imap_folder_separator: "." smtp_rbl: - bl.spamcop.net diff --git a/roles/mail_server/molecule/default/tests/data/x509/parameters-optional_imap.cert.pem b/roles/mail_server/molecule/default/tests/data/x509/parameters-optional-stretch64_imap.cert.pem similarity index 100% rename from roles/mail_server/molecule/default/tests/data/x509/parameters-optional_imap.cert.pem rename to roles/mail_server/molecule/default/tests/data/x509/parameters-optional-stretch64_imap.cert.pem diff --git a/roles/mail_server/molecule/default/tests/data/x509/parameters-optional_imap.key.pem b/roles/mail_server/molecule/default/tests/data/x509/parameters-optional-stretch64_imap.key.pem similarity index 100% rename from roles/mail_server/molecule/default/tests/data/x509/parameters-optional_imap.key.pem rename to roles/mail_server/molecule/default/tests/data/x509/parameters-optional-stretch64_imap.key.pem diff --git a/roles/mail_server/molecule/default/tests/data/x509/parameters-optional_smtp.cert.pem b/roles/mail_server/molecule/default/tests/data/x509/parameters-optional-stretch64_smtp.cert.pem similarity index 100% rename from roles/mail_server/molecule/default/tests/data/x509/parameters-optional_smtp.cert.pem rename to roles/mail_server/molecule/default/tests/data/x509/parameters-optional-stretch64_smtp.cert.pem diff --git a/roles/mail_server/molecule/default/tests/data/x509/parameters-optional_smtp.key.pem b/roles/mail_server/molecule/default/tests/data/x509/parameters-optional-stretch64_smtp.key.pem similarity index 100% rename from roles/mail_server/molecule/default/tests/data/x509/parameters-optional_smtp.key.pem rename to roles/mail_server/molecule/default/tests/data/x509/parameters-optional-stretch64_smtp.key.pem diff --git a/roles/mail_server/molecule/default/tests/test_default.py b/roles/mail_server/molecule/default/tests/test_default.py index 0dd23b8993a35d4d410e4d65038c213d8de5052e..cc8438ed87f7e0d83037f90ce30b90c0191080ec 100644 --- a/roles/mail_server/molecule/default/tests/test_default.py +++ b/roles/mail_server/molecule/default/tests/test_default.py @@ -408,3 +408,42 @@ def test_imap_server_uses_correct_dh_parameters(host): "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' localhost") assert " - Using prime: 2048 bits" in connection.stdout + + +def test_imap_and_smtp_tls_files(host): + """ + Tests if IMAP and SMTP TLS private keys and certificates have been + deployed correctly. + """ + + hostname = host.run('hostname').stdout.strip() + + with host.sudo(): + + tls_file = host.file('/etc/ssl/private/%s_smtp.key' % hostname) + assert tls_file.is_file + assert tls_file.user == 'root' + assert tls_file.group == 'root' + assert tls_file.mode == 0o640 + assert tls_file.content_string == open("tests/data/x509/%s_smtp.key.pem" % hostname, "r").read().rstrip() + + tls_file = host.file('/etc/ssl/certs/%s_smtp.pem' % hostname) + assert tls_file.is_file + assert tls_file.user == 'root' + assert tls_file.group == 'root' + assert tls_file.mode == 0o644 + assert tls_file.content_string == open("tests/data/x509/%s_smtp.cert.pem" % hostname, "r").read().rstrip() + + tls_file = host.file('/etc/ssl/private/%s_imap.key' % hostname) + assert tls_file.is_file + assert tls_file.user == 'root' + assert tls_file.group == 'root' + assert tls_file.mode == 0o640 + assert tls_file.content_string == open("tests/data/x509/%s_imap.key.pem" % hostname, "r").read().rstrip() + + tls_file = host.file('/etc/ssl/certs/%s_imap.pem' % hostname) + assert tls_file.is_file + assert tls_file.user == 'root' + assert tls_file.group == 'root' + assert tls_file.mode == 0o644 + assert tls_file.content_string == open("tests/data/x509/%s_imap.cert.pem" % hostname, "r").read().rstrip() diff --git a/roles/mail_server/molecule/default/tests/test_mandatory.py b/roles/mail_server/molecule/default/tests/test_mandatory.py index 1e532da4601775a12bc79b94d12b5f2c4d395756..0937e7de8afb93f56aa52f7b0f43e096116b5b43 100644 --- a/roles/mail_server/molecule/default/tests/test_mandatory.py +++ b/roles/mail_server/molecule/default/tests/test_mandatory.py @@ -7,44 +7,6 @@ testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-mandatory') -def test_smtp_tls_files(host): - """ - Tests if SMTP TLS private key has been deployed correctly. - """ - - hostname = host.run('hostname').stdout.strip() - - with host.sudo(): - - tls_file = host.file('/etc/ssl/private/%s_smtp.key' % hostname) - assert tls_file.is_file - assert tls_file.user == 'root' - assert tls_file.group == 'root' - assert tls_file.mode == 0o640 - assert tls_file.content_string == open("tests/data/x509/%s_smtp.key.pem" % hostname, "r").read().rstrip() - - tls_file = host.file('/etc/ssl/certs/%s_smtp.pem' % hostname) - assert tls_file.is_file - assert tls_file.user == 'root' - assert tls_file.group == 'root' - assert tls_file.mode == 0o644 - assert tls_file.content_string == open("tests/data/x509/%s_smtp.cert.pem" % hostname, "r").read().rstrip() - - tls_file = host.file('/etc/ssl/private/%s_imap.key' % hostname) - assert tls_file.is_file - assert tls_file.user == 'root' - assert tls_file.group == 'root' - assert tls_file.mode == 0o640 - assert tls_file.content_string == open("tests/data/x509/%s_imap.key.pem" % hostname, "r").read().rstrip() - - tls_file = host.file('/etc/ssl/certs/%s_imap.pem' % hostname) - assert tls_file.is_file - assert tls_file.user == 'root' - assert tls_file.group == 'root' - assert tls_file.mode == 0o644 - assert tls_file.content_string == open("tests/data/x509/%s_imap.cert.pem" % hostname, "r").read().rstrip() - - def test_certificate_validity_check_configuration(host): """ Tests if certificate validity check configuration file has been deployed diff --git a/roles/mail_server/molecule/default/tests/test_optional.py b/roles/mail_server/molecule/default/tests/test_optional.py index f5d26e81446d139876be7bfd73c488811c561164..ba5f621400cdf1f0246d4e8c03498b0146b2b0d3 100644 --- a/roles/mail_server/molecule/default/tests/test_optional.py +++ b/roles/mail_server/molecule/default/tests/test_optional.py @@ -10,44 +10,6 @@ testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('parameters-optional') -def test_smtp_tls_files(host): - """ - Tests if SMTP TLS private key has been deployed correctly. - """ - - hostname = host.run('hostname').stdout.strip() - - with host.sudo(): - - tls_file = host.file('/etc/ssl/private/%s_smtp.key' % hostname) - assert tls_file.is_file - assert tls_file.user == 'root' - assert tls_file.group == 'root' - assert tls_file.mode == 0o640 - assert tls_file.content_string == open("tests/data/x509/parameters-optional_smtp.key.pem", "r").read().rstrip() - - tls_file = host.file('/etc/ssl/certs/%s_smtp.pem' % hostname) - assert tls_file.is_file - assert tls_file.user == 'root' - assert tls_file.group == 'root' - assert tls_file.mode == 0o644 - assert tls_file.content_string == open("tests/data/x509/parameters-optional_smtp.cert.pem", "r").read().rstrip() - - tls_file = host.file('/etc/ssl/private/%s_imap.key' % hostname) - assert tls_file.is_file - assert tls_file.user == 'root' - assert tls_file.group == 'root' - assert tls_file.mode == 0o640 - assert tls_file.content_string == open("tests/data/x509/parameters-optional_imap.key.pem", "r").read().rstrip() - - tls_file = host.file('/etc/ssl/certs/%s_imap.pem' % hostname) - assert tls_file.is_file - assert tls_file.user == 'root' - assert tls_file.group == 'root' - assert tls_file.mode == 0o644 - assert tls_file.content_string == open("tests/data/x509/parameters-optional_imap.cert.pem", "r").read().rstrip() - - def test_certificate_validity_check_configuration(host): """ Tests if certificate validity check configuration file has been deployed