From 71a02a6035f13127a4422e6e686a038ef60282da Mon Sep 17 00:00:00 2001
From: Alexander Gorelyshev <corvus-migratorius@proton.me>
Date: Mon, 18 May 2026 20:13:56 +0400
Subject: [PATCH] Rework Molecule tests to support checking the `AllowUsers`
 directive

---
 roles/sshd/molecule/default/converge.yml |  1 +
 roles/sshd/molecule/default/verify.yml   | 93 +++++++++++++-----------
 2 files changed, 53 insertions(+), 41 deletions(-)

diff --git a/roles/sshd/molecule/default/converge.yml b/roles/sshd/molecule/default/converge.yml
index bea06f8..bb22a32 100644
--- a/roles/sshd/molecule/default/converge.yml
+++ b/roles/sshd/molecule/default/converge.yml
@@ -3,3 +3,4 @@
   hosts: all
   roles:
     - role: "genlab.common.sshd"
+      sshd_allow_users: "testusr"
diff --git a/roles/sshd/molecule/default/verify.yml b/roles/sshd/molecule/default/verify.yml
index 29b09d7..2e6f948 100644
--- a/roles/sshd/molecule/default/verify.yml
+++ b/roles/sshd/molecule/default/verify.yml
@@ -5,20 +5,36 @@
   gather_facts: false
   any_errors_fatal: true
 
-  tasks:
+  pre_tasks:
     - name: Gather service facts
       ansible.builtin.service_facts:
 
+    - name: Set up users and keys for testing
+      loop:
+        - testusr
+        - testusr_notallowed
+      loop_control:
+        loop_var: username
+      ansible.builtin.include_tasks: mkuser.yml
+
+  tasks:
     - name: Ensure sshd is running
+      vars:
+        sshd_state: "{{ ansible_facts.services['ssh.service'].state | default('unknown') }}"
       ansible.builtin.assert:
-        that:
-          - ansible_facts.services['ssh.service'].state == 'running'
+        that: sshd_state == 'running'
+        success_msg: "OK, sshd state: '{{ sshd_state }}'"
+        fail_msg: "FAIL, sshd state: '{{ sshd_state }}'"
 
     - name: Ensure sshd_config syntax is OK
-      ansible.builtin.command: sshd -t -f /etc/ssh/sshd_config
       changed_when: false
+      ansible.builtin.command:
+        cmd: sshd -t -f /etc/ssh/sshd_config
 
     - name: Ensure main parameteres are applied
+      args:
+        executable: /bin/bash
+      changed_when: false
       ansible.builtin.shell: |
         set -o pipefail ;
         sshd -T | egrep -i '
@@ -27,50 +43,45 @@
           ^passwordauthentication no|
           ^pubkeyauthentication yes
         '
-      args:
-        executable: /bin/bash
-      changed_when: false
 
     - name: Get sshd_config stats
+      register: sshd_conf
       ansible.builtin.stat:
         path: /etc/ssh/sshd_config
-      register: sshd_conf
 
     - name: Ensure sshd_config file is secure
+      vars:
+        uid: "{{ sshd_conf.stat.uid }}"
+        gid: "{{ sshd_conf.stat.gid }}"
+        mode: "{{ sshd_conf.stat.mode }}"
       ansible.builtin.assert:
         that:
-          - sshd_conf.stat.uid == 0
-          - sshd_conf.stat.gid == 0
-          - sshd_conf.stat.mode == '0600'
+          - uid == '0'
+          - gid == '0'
+          - mode == '0600'
+        success_msg: "OK, sshd_config file uid: '{{ uid }}', gid: '{{ gid }}', mode: '{{ mode }}'"
+        fail_msg: "FAIL, sshd_config file uid: '{{ uid }}', gid: '{{ gid }}', mode: '{{ mode }}'"
 
-    - name: Create test user
-      ansible.builtin.user:
-        name: test
-        create_home: true
-        shell: /bin/bash
-
-    - name: Create .ssh directory
-      ansible.builtin.file:
-        path: /home/test/.ssh/
-        state: directory
-        mode: '0700'
-        owner: test
-        group: test
-
-    - name: Generate ssh keys
-      community.crypto.openssh_keypair:
-        path: /home/test/.ssh/id_rsa
-        owner: test
-        group: test
-        mode: '0600'
-      register: sshd_key_result
-
-    - name: Put public key to test user
-      ansible.posix.authorized_key:
-        user: test
-        key: "{{ sshd_key_result.public_key }}"
-        state: present
-
-    - name: Test ssh connection
-      ansible.builtin.command: ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /home/test/.ssh/id_rsa test@localhost hostname
+    - name: Test ssh connection with an allowed user
       changed_when: false
+      ansible.builtin.command:
+        cmd: >-
+          ssh
+          -o StrictHostKeyChecking=no
+          -o UserKnownHostsFile=/dev/null
+          -i /home/testusr/.ssh/id_rsa
+          testusr@localhost
+          hostname
+
+    - name: Test ssh connection with a disallowed user
+      register: result
+      changed_when: false
+      failed_when: result.rc == 0
+      ansible.builtin.command:
+        cmd: >-
+          ssh
+          -o StrictHostKeyChecking=no
+          -o UserKnownHostsFile=/dev/null
+          -i /home/testusrnotallowed/.ssh/id_rsa
+          testusrnotallowed@localhost
+          hostname