add sftp_share role

roles/sftp_share/molecule/default/verify.yml

@@ -0,0 +1,91 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: false
+  any_errors_fatal: true
+  vars:
+    sftp_username: "testusr"
+    sftp_pubkey: "{{ lookup('file', 'ssh/id_ed25519.pub') }}"
+    sftp_root: "/primary/data"
+    sftp_transfers_groupname: "testgrp"
+
+  tasks:
+    - name: Gather user SFTP directory info
+      ansible.builtin.stat:
+        path: "{{ sftp_root }}/{{ sftp_username }}-uploads"
+      register: sftp_root_stat
+
+    - name: Assert that user SFTP directory has correct owner
+      ansible.builtin.assert:
+        that:
+          - sftp_root_stat.stat.pw_name == "root"
+          - sftp_root_stat.stat.gr_name == "root"
+        success_msg: "SFTP directory {{ sftp_root }}/{{ sftp_username }}-uploads has correct owner root:root"
+        fail_msg: |
+         "SFTP directory {{ sftp_root }}/{{ sftp_username }}-uploads does not have correct owner root:root,
+          actual owner is {{ sftp_root_stat.stat.pw_name }}:{{ sftp_root_stat.stat.gr_name }}"
+
+    - name: Gather transfers directory info
+      ansible.builtin.stat:
+        path: "{{ sftp_root }}/{{ sftp_username }}-uploads/transfers"
+      register: transfers_stat
+
+    - name: Assert that transfers directory has correct owner
+      ansible.builtin.assert:
+        that:
+          - transfers_stat.stat.pw_name == sftp_username
+          - transfers_stat.stat.gr_name == sftp_transfers_groupname
+        success_msg: "Directory {{ sftp_root }}/{{ sftp_username }}-uploads/transfers has correct owner {{ sftp_username }}:{{ sftp_transfers_groupname }}"
+        fail_msg: |
+         "Directory {{ sftp_root }}/{{ sftp_username }}-uploads/transfers does not have correct owner {{ sftp_username }}:{{ sftp_transfers_groupname }},
+          actual owner is {{ transfers_stat.stat.pw_name }}:{{ transfers_stat.stat.gr_name }}"
+
+    - name: Assert that transfers directory has correct permissions
+      ansible.builtin.assert:
+        that:
+          - transfers_stat.stat.mode == "2770"
+        success_msg: "Directory {{ sftp_root }}/{{ sftp_username }}-uploads/transfers has correct permissions 2770"
+        fail_msg: |
+         "Directory {{ sftp_root }}/{{ sftp_username }}-uploads/transfers does not have correct permissions 2770,
+          actual permissions are {{ sftp_root_stat.stat.mode }}"
+
+    - name: Get user info
+      ansible.builtin.getent:
+        database: passwd
+        key: "{{ sftp_username }}"
+      register: user_info
+
+    - name: Check user exists
+      ansible.builtin.assert:
+        that:
+          - user_info is defined
+        success_msg: "User {{ sftp_username }} exists"
+        fail_msg: "User {{ sftp_username }} does not exist"
+
+    - name: Check that sshd refuses non-SFTP connection attempts
+      changed_when: false
+      failed_when: ssh.stdout != expected
+      register: ssh
+      vars:
+        expected: "This service allows sftp connections only."
+      ansible.builtin.command: "ssh -l {{ sftp_username }} 127.0.0.1 -o StrictHostKeyChecking=no exit"
+
+    - name: Check that sFTP chroots into /transfers
+      changed_when: false
+      register: sftp
+      failed_when: sftp.stdout != expected
+      vars:
+        expected: "sftp> pwd\nRemote working directory: /transfers"
+      ansible.builtin.shell:
+        executable: /bin/bash
+        cmd: 'set -o pipefail; echo "pwd" | sftp -b - -o StrictHostKeyChecking=no {{ sftp_username | quote }}@127.0.0.1'
+
+    - name: Check that non-whitelisted sFTP permissions are denied
+      changed_when: false
+      register: sftp_mkdir
+      failed_when: sftp_mkdir.stderr != expected
+      vars:
+        expected: 'remote mkdir "/transfers/foo": Permission denied'
+      ansible.builtin.shell:
+        executable: /bin/bash
+        cmd: 'set -o pipefail; echo "mkdir foo" | sftp -b - -o StrictHostKeyChecking=no {{ sftp_username | quote }}@127.0.0.1'