mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-28 19:53:01 +02:00
107 lines
3.7 KiB
Python
Executable File
107 lines
3.7 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""
|
|
Add admin user
|
|
|
|
Test that a non-admin user is not an admin in Linux, and
|
|
check that it when added as admin it is also the case in Linux.
|
|
"""
|
|
|
|
import infamy
|
|
import infamy.ssh as ssh
|
|
import infamy.util as util
|
|
from passlib.hash import sha256_crypt
|
|
|
|
with infamy.Test() as test:
|
|
with test.step("Set up topology and attach to target DUT"):
|
|
env = infamy.Env()
|
|
target = env.attach("target", "mgmt")
|
|
tgtssh = env.attach("target", "mgmt", "ssh")
|
|
factory = env.get_password("target")
|
|
address = target.get_mgmt_ip()
|
|
|
|
with test.step("Add new user 'jacky' with no NACM access"):
|
|
USER = "jacky"
|
|
PASS = "$1$3aR7Bq2u$G9kV.8AALtKkCnaAXFyu6/"
|
|
|
|
target.put_config_dicts({
|
|
"ietf-system": {
|
|
"system": {
|
|
"authentication": {
|
|
"user": [
|
|
{
|
|
"name": USER,
|
|
"password": PASS,
|
|
"shell": "infix-system:bash"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
})
|
|
running = target.get_config_dict("/ietf-system:system")
|
|
users = running["system"]["authentication"]["user"]
|
|
|
|
with test.step("Verify regular user jacky exists"):
|
|
jacky = next((user for user in users if user['name'] == USER), None)
|
|
if not any(user['name'] == USER for user in users):
|
|
test.fail()
|
|
|
|
with test.step("Verify user jacky is not in wheel group (in Linux)"):
|
|
wheel = tgtssh.runsh("grep wheel /etc/group").stdout
|
|
if USER in wheel:
|
|
test.fail()
|
|
|
|
with test.step("Verify user jacky password is set correctly"):
|
|
if not tgtssh.runsh(f"sudo grep ':{PASS}:' /etc/shadow"):
|
|
test.fail()
|
|
|
|
with test.step("Add user jacky to admin group in NACM"):
|
|
# Don't presume 'admin' user exists, only group
|
|
nacm = target.get_config_dict("/ietf-netconf-acm:nacm")
|
|
for group in nacm["nacm"]["groups"]["group"]:
|
|
if group["name"] == "admin":
|
|
if USER not in group["user-name"]:
|
|
group["user-name"].append(USER)
|
|
target.put_config_dicts({"ietf-netconf-acm": nacm})
|
|
|
|
with test.step("Verify user jacky is now in wheel group (in Linux)"):
|
|
if not tgtssh.runsh(f"grep wheel /etc/group | grep '{USER}'"):
|
|
test.fail()
|
|
|
|
with test.step("Verify user jacky shell now is Bash"):
|
|
user = tgtssh.runsh(f"grep {USER} /etc/passwd").stdout
|
|
if "bash" not in user:
|
|
test.fail()
|
|
|
|
with test.step("Change user jacky to $factory$ password"):
|
|
running = target.get_config_dict("/ietf-system:system")
|
|
users = running["system"]["authentication"]["user"]
|
|
|
|
for user in users:
|
|
if user['name'] == USER:
|
|
user['password'] = "$factory$"
|
|
break
|
|
target.put_config_dicts({"ietf-system": running})
|
|
|
|
with test.step("Verify user jacky exists and has new password"):
|
|
operational = target.get_data("/ietf-system:system/authentication")
|
|
users = operational["system"]["authentication"]["user"]
|
|
|
|
found = None
|
|
for user in users:
|
|
if user['name'] == USER:
|
|
found = user
|
|
break
|
|
|
|
if found is None:
|
|
test.fail()
|
|
if found['password'] == "$factory$":
|
|
test.fail()
|
|
if found['password'] == PASS:
|
|
test.fail()
|
|
|
|
with test.step("Verify user jacky can log in with SSH"):
|
|
testssh=ssh.Device("target", ssh.Location(address, USER, factory))
|
|
util.until(lambda: testssh.runsh("ls").returncode == 0)
|
|
test.succeed()
|