Skip to content

Commit 74706a4

Browse files
jonmchanfelipesantiagogoruha
authored
2025-05 Updates (#91)
* Update the dependencies as of April 2025 * Fix PAM module is unknown error * Update test Dockefile base image * make tests run more reliably on faster machines * skip chmod proc if proc is not modifiable * Removed duplicate tests * adding libqrencode; added tests to ensure qrcode is properly generated * Update feature-branch.yml * Update feature-branch.yml * Update feature-branch.yml * Update feature-branch.yml --------- Co-authored-by: Felipe Santiago <[email protected]> Co-authored-by: Igor Rodionov <[email protected]>
1 parent e13c36b commit 74706a4

File tree

11 files changed

+107
-56
lines changed

11 files changed

+107
-56
lines changed

.github/workflows/feature-branch.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@ permissions:
1313

1414
jobs:
1515
ci-readme:
16-
uses: cloudposse/github-actions-workflows/.github/workflows/ci-readme.yml@main
16+
uses: cloudposse/.github/.github/workflows/shared-readme.yml@main
1717
if: ${{ github.event_name == 'push' }}
1818
secrets: inherit
1919

2020
ci-codeowners:
21-
uses: cloudposse/github-actions-workflows/.github/workflows/ci-codeowners.yml@main
21+
uses: cloudposse/.github/.github/workflows/shared-codeowners.yml@main
2222
with:
2323
is_fork: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
2424
secrets: inherit
@@ -28,7 +28,7 @@ jobs:
2828
steps:
2929
- uses: cloudposse/github-action-release-label-validator@v1
3030

31-
ci-build-test:
31+
test:
3232
runs-on: ubuntu-latest
3333
steps:
3434
- name: Checkout
@@ -40,12 +40,12 @@ jobs:
4040

4141
- name: Run Tests
4242
shell: bash
43-
run: cd test && ./test.sh
43+
run: make test
4444

4545
- name: Cleanup
4646
if: always()
4747
shell: bash
48-
run: cd test && docker-compose down
48+
run: make cleantest
4949

5050
ci:
5151
runs-on: ubuntu-latest
@@ -54,4 +54,4 @@ jobs:
5454
- run: |
5555
echo '${{ toJSON(needs) }}' # easier debug
5656
! ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
57-
needs: [ ci-readme, ci-codeowners, ci-labels, ci-build-test ]
57+
needs: [ ci-readme, ci-codeowners, ci-labels, test ]

.github/workflows/integration-tests.yml

Lines changed: 0 additions & 21 deletions
This file was deleted.

Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ LABEL maintainer="[email protected]"
7878
USER root
7979

8080
## Install dependencies
81-
RUN apk --update add curl drill groff util-linux bash xauth gettext openssl-dev shadow linux-pam sudo && \
81+
RUN apk --update add curl drill groff util-linux bash xauth gettext openssl-dev shadow linux-pam libqrencode sudo && \
8282
rm -rf /etc/ssh/ssh_host_*_key* && \
8383
rm -f /usr/bin/ssh-agent && \
8484
rm -f /usr/bin/ssh-keyscan && \

Makefile

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ export DOCKER_IMAGE_NAME ?= $(DOCKER_IMAGE):$(DOCKER_TAG)
44
export DOCKER_BUILD_FLAGS =
55
COPYRIGHT_SOFTWARE_DESCRIPTION := A secure Bastion host implemented as Docker Container running Alpine Linux with Google Authenticator & DUO MFA support
66

7-
.PHONY: test buildtest
7+
.PHONY: test cleantest
88

99
include $(shell curl --silent -O "https://raw.githubusercontent.com/cloudposse/build-harness/master/templates/Makefile.build-harness"; echo Makefile.build-harness)
1010

@@ -29,9 +29,8 @@ run: reset
2929
-e SLACK_ENABLED=true \
3030
$(DOCKER_IMAGE_NAME)
3131

32-
buildtest:
33-
cd test > /dev/null; ./build.sh
34-
35-
3632
test:
37-
cd test > /dev/null; ./test.sh
33+
cd test && ./test.sh
34+
35+
cleantest:
36+
cd test && docker compose down

rootfs/etc/init.d/secure-proc

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,6 @@
22
echo "- Locking down /proc"
33
chmod 700 /proc
44

5-
5+
if [ "$?" == "1" ]; then
6+
echo "Do not have permissions to lockdown /proc"
7+
fi

test/build.sh

Lines changed: 0 additions & 12 deletions
This file was deleted.

test/docker-compose.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ services:
55
args:
66
VERSION: "test"
77
volumes:
8-
- "$PWD/fixtures/sshrc/sshrc_kill_test.sh:/etc/ssh/sshrc.d/sshrc_kill_test.sh"
9-
- "$PWD/fixtures/auth:/auth"
10-
- "$PWD/fixtures/server_scripts:/scripts"
8+
- "./fixtures/sshrc/sshrc_kill_test.sh:/etc/ssh/sshrc.d/sshrc_kill_test.sh"
9+
- "./fixtures/auth:/auth"
10+
- "./fixtures/server_scripts:/scripts"
1111
environment:
1212
LOG_LEVEL: "DEBUG"
1313
MFA_PROVIDER: "google-authenticator"
@@ -20,8 +20,8 @@ services:
2020
test:
2121
build: "."
2222
volumes:
23-
- "$PWD/fixtures/auth/ida_rsa:/root/.ssh/id_rsa"
24-
- "$PWD/fixtures/auth/google_authenticator_code:/code"
25-
- "$PWD/fixtures/client_scripts:/scripts"
23+
- "./fixtures/auth/ida_rsa:/root/.ssh/id_rsa"
24+
- "./fixtures/auth/google_authenticator_code:/code"
25+
- "./fixtures/client_scripts:/scripts"
2626
depends_on:
2727
- "bastion"
Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/usr/bin/expect -f
2+
#
3+
# This Expect script was generated by autoexpect on Mon May 5 15:07:42 2025
4+
# Expect and autoexpect were both written by Don Libes, NIST.
5+
#
6+
# Note that autoexpect does not guarantee a working script. It
7+
# necessarily has to guess about certain things. Two reasons a script
8+
# might fail are:
9+
#
10+
# 1) timing - A surprising number of programs (rn, ksh, zsh, telnet,
11+
# etc.) and devices discard or ignore keystrokes that arrive "too
12+
# quickly" after prompts. If you find your new script hanging up at
13+
# one spot, try adding a short sleep just before the previous send.
14+
# Setting "force_conservative" to 1 (see below) makes Expect do this
15+
# automatically - pausing briefly before sending each character. This
16+
# pacifies every program I know of. The -c flag makes the script do
17+
# this in the first place. The -C flag allows you to define a
18+
# character to toggle this mode off and on.
19+
20+
set force_conservative 0 ;# set to 1 to force conservative mode even if
21+
;# script wasn't run conservatively originally
22+
if {$force_conservative} {
23+
set send_slow {1 .1}
24+
proc send {ignore arg} {
25+
sleep .1
26+
exp_send -s -- $arg
27+
}
28+
}
29+
30+
#
31+
# 2) differing output - Some programs produce different output each time
32+
# they run. The "date" command is an obvious example. Another is
33+
# ftp, if it produces throughput statistics at the end of a file
34+
# transfer. If this causes a problem, delete these patterns or replace
35+
# them with wildcards. An alternative is to use the -p flag (for
36+
# "prompt") which makes Expect only look for the last line of output
37+
# (i.e., the prompt). The -P flag allows you to define a character to
38+
# toggle this mode off and on.
39+
#
40+
# Read the man page for more info.
41+
#
42+
# -Don
43+
44+
45+
set timeout -1
46+
spawn google-authenticator -t
47+
match_max 100000
48+
expect "Enter code from app (-1 to skip): "
49+
send -- "-1\r"
50+
expect "Do you want me to update your \"/root/.google_authenticator\" file? (y/n) "
51+
send -- "n\r"
52+
expect eof
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/sh
2+
3+
4+
cd /scripts
5+
6+
expect google-auth.exp

test/fixtures/server_scripts/setup.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@
33
# This script runs on the test bastion server to initialize and setup the test environment.
44
syslogd
55

6+
# Setup expect for google auth test
7+
apk update
8+
apk add expect
9+
610
rm -rf /var/log/sudo-io
711

812
useradd -m bastion

0 commit comments

Comments
 (0)