-
Notifications
You must be signed in to change notification settings - Fork 31
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Case RE-112: For sshd, the default value for PermitRootLogin changes from "yes" to "no" when upgrading from CentOS 7 to a CentOS 8 variant. We used to block if PermitRootLogin was not explicitly set; but, instead it is more desirable to simply emit a warning that we are going to set it to "yes" and go ahead and set it so the behavior stays the same post upgrade. I've altered the SSH blocker module to emit the warning and not block. I've also moved the SSH blocker execution to happen earlier so the warning is more visible. And, I've added a component that will provide the autofix for the sshd configuration file. Changelog: Set PermitRootLogin for sshd to 'yes' if not explicitly set in the configuration file so that the behavior does not change after the upgrade.
- Loading branch information
Showing
7 changed files
with
203 additions
and
54 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| package Elevate::Components::SSH; | ||
|
|
||
| =encoding utf-8 | ||
| =head1 NAME | ||
| Elevate::Components::SSH | ||
| Ensure that the sshd config file has 'PermitRootLogin' set to 'yes' | ||
| if it is not set. | ||
| =cut | ||
|
|
||
| use cPstrict; | ||
|
|
||
| use Elevate::Constants (); | ||
|
|
||
| use Cwd (); | ||
| use File::Slurper (); | ||
| use Log::Log4perl qw(:easy); | ||
|
|
||
| use parent qw{Elevate::Components::Base}; | ||
|
|
||
| sub pre_leapp ($self) { | ||
|
|
||
| my $sshd_config = q[/etc/ssh/sshd_config]; | ||
|
|
||
| my $setup = File::Slurper::read_binary($sshd_config) // ''; | ||
|
|
||
| # PermitRootLogin is explicitly set, no need for changes | ||
| return if ( $setup =~ m{^\s*PermitRootLogin\b}m ); | ||
|
|
||
| # Add ending newline if file does not end with newline | ||
| if ( $setup !~ m{\n$} && length $setup ) { | ||
| $setup .= "\n"; | ||
| } | ||
|
|
||
| $setup .= "PermitRootLogin yes\n"; | ||
|
|
||
| File::Slurper::write_binary( $sshd_config, $setup ); | ||
|
|
||
| return; | ||
| } | ||
|
|
||
| sub post_leapp ($self) { | ||
|
|
||
| # Nothing to do | ||
| return; | ||
| } | ||
|
|
||
| 1; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| #!/usr/local/cpanel/3rdparty/bin/perl | ||
|
|
||
| package test::cpev::components; | ||
|
|
||
| use FindBin; | ||
|
|
||
| use Test2::V0; | ||
| use Test2::Tools::Explain; | ||
| use Test2::Plugin::NoWarnings; | ||
| use Test2::Tools::Exception; | ||
|
|
||
| use Test::MockFile 0.032; | ||
| use Test::MockModule qw/strict/; | ||
|
|
||
| use lib $FindBin::Bin . "/lib"; | ||
| use Test::Elevate; | ||
|
|
||
| use cPstrict; | ||
|
|
||
| my $ssh = bless {}, 'Elevate::Components::SSH'; | ||
|
|
||
| { | ||
| note "checking pre_leapp"; | ||
|
|
||
| my $mock_sshd_cfg = Test::MockFile->file(q[/etc/ssh/sshd_config]); | ||
|
|
||
| $mock_sshd_cfg->contents(''); | ||
| $ssh->pre_leapp(); | ||
| is $mock_sshd_cfg->contents(), "PermitRootLogin yes\n", 'Added PermitRootLogin to empty config'; | ||
|
|
||
| my $pre_contents = "PasswordAuthentication no\nUseDNS no\nDenyGroups cpaneldemo\n"; | ||
| $mock_sshd_cfg->contents($pre_contents); | ||
| $ssh->pre_leapp(); | ||
| is $mock_sshd_cfg->contents(), $pre_contents . "PermitRootLogin yes\n", 'Added PermitRootLogin when ommited, trailing newline'; | ||
|
|
||
| $pre_contents = "PasswordAuthentication no\nUseDNS no\nDenyGroups cpaneldemo"; | ||
| $mock_sshd_cfg->contents($pre_contents); | ||
| $ssh->pre_leapp(); | ||
| is $mock_sshd_cfg->contents(), $pre_contents . "\nPermitRootLogin yes\n", 'Added PermitRootLogin when ommited, no trailing newline'; | ||
|
|
||
| $pre_contents = "PasswordAuthentication no\nPermitRootLogin yes\nUseDNS no\nDenyGroups cpaneldemo"; | ||
| $mock_sshd_cfg->contents($pre_contents); | ||
| $ssh->pre_leapp(); | ||
| is $mock_sshd_cfg->contents(), $pre_contents, 'Contents unchanged when PermitRootLogin present and active'; | ||
|
|
||
| $pre_contents = "PermitRootLogin no\nPasswordAuthentication no\nUseDNS no\nDenyGroups cpaneldemo\n"; | ||
| $mock_sshd_cfg->contents($pre_contents); | ||
| $ssh->pre_leapp(); | ||
| is $mock_sshd_cfg->contents(), $pre_contents, 'Contents unchanged when PermitRootLogin present and active'; | ||
|
|
||
| $pre_contents = "PasswordAuthentication no\n#PermitRootLogin yes\nUseDNS no\nDenyGroups cpaneldemo"; | ||
| $mock_sshd_cfg->contents($pre_contents); | ||
| $ssh->pre_leapp(); | ||
| is $mock_sshd_cfg->contents(), $pre_contents . "\nPermitRootLogin yes\n", 'Contents updated when PermitRootLogin present but commented out'; | ||
|
|
||
| $pre_contents = "# PermitRootLogin no\nPasswordAuthentication no\nUseDNS no\nDenyGroups cpaneldemo\n"; | ||
| $mock_sshd_cfg->contents($pre_contents); | ||
| $ssh->pre_leapp(); | ||
| is $mock_sshd_cfg->contents(), $pre_contents . "PermitRootLogin yes\n", 'Contents updated when PermitRootLogin present but commented out'; | ||
| } | ||
|
|
||
| done_testing(); |