92 lines
3.9 KiB
YAML
92 lines
3.9 KiB
YAML
---
|
|
- name: Verify
|
|
hosts: all
|
|
gather_facts: false
|
|
any_errors_fatal: true
|
|
vars:
|
|
sftp_username: "testusr"
|
|
sftp_pubkey: "{{ lookup('file', 'ssh/id_ed25519.pub') }}"
|
|
sftp_root: "/primary/data"
|
|
sftp_transfers_groupname: "testgrp"
|
|
|
|
tasks:
|
|
- name: Gather user SFTP directory info
|
|
ansible.builtin.stat:
|
|
path: "{{ sftp_root }}/{{ sftp_username }}-uploads"
|
|
register: sftp_share_permissions
|
|
|
|
- name: Assert that user SFTP directory has correct owner
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sftp_share_permissions.stat.pw_name == "root"
|
|
- sftp_share_permissions.stat.gr_name == "root"
|
|
success_msg: "SFTP directory {{ sftp_root }}/{{ sftp_username }}-uploads has correct owner root:root"
|
|
fail_msg: |
|
|
"SFTP directory {{ sftp_root }}/{{ sftp_username }}-uploads does not have correct owner root:root,
|
|
actual owner is {{ sftp_share_permissions.stat.pw_name }}:{{ sftp_share_permissions.stat.gr_name }}"
|
|
|
|
- name: Gather transfers directory info
|
|
ansible.builtin.stat:
|
|
path: "{{ sftp_root }}/{{ sftp_username }}-uploads/transfers"
|
|
register: sftp_share_transfers_stat
|
|
|
|
- name: Assert that transfers directory has correct owner
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sftp_share_transfers_stat.stat.pw_name == sftp_username
|
|
- sftp_share_transfers_stat.stat.gr_name == sftp_transfers_groupname
|
|
success_msg: "Directory {{ sftp_root }}/{{ sftp_username }}-uploads/transfers has correct owner {{ sftp_username }}:{{ sftp_transfers_groupname }}"
|
|
fail_msg: |
|
|
"Directory {{ sftp_root }}/{{ sftp_username }}-uploads/transfers does not have correct owner {{ sftp_username }}:{{ sftp_transfers_groupname }},
|
|
actual owner is {{ sftp_share_transfers_stat.stat.pw_name }}:{{ sftp_share_transfers_stat.stat.gr_name }}"
|
|
|
|
- name: Assert that transfers directory has correct permissions
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sftp_share_transfers_stat.stat.mode == "2770"
|
|
success_msg: "Directory {{ sftp_root }}/{{ sftp_username }}-uploads/transfers has correct permissions 2770"
|
|
fail_msg: |
|
|
"Directory {{ sftp_root }}/{{ sftp_username }}-uploads/transfers does not have correct permissions 2770,
|
|
actual permissions are {{ sftp_share_permissions.stat.mode }}"
|
|
|
|
- name: Get user info
|
|
ansible.builtin.getent:
|
|
database: passwd
|
|
key: "{{ sftp_username }}"
|
|
register: sftp_share_user_info
|
|
|
|
- name: Check user exists
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sftp_share_user_info is defined
|
|
success_msg: "User {{ sftp_username }} exists"
|
|
fail_msg: "User {{ sftp_username }} does not exist"
|
|
|
|
- name: Check that sshd refuses non-SFTP connection attempts
|
|
changed_when: false
|
|
failed_when: sftp_share_ssh.stdout != expected
|
|
register: sftp_share_ssh
|
|
vars:
|
|
expected: "This service allows sftp connections only."
|
|
ansible.builtin.command: "ssh -l {{ sftp_username }} 127.0.0.1 -o StrictHostKeyChecking=no exit"
|
|
|
|
- name: Check that sFTP chroots into /transfers
|
|
changed_when: false
|
|
register: sftp_share_sftp
|
|
failed_when: sftp_share_sftp.stdout != expected
|
|
vars:
|
|
expected: "sftp> pwd\nRemote working directory: /transfers"
|
|
ansible.builtin.shell:
|
|
executable: /bin/bash
|
|
cmd: 'set -o pipefail; echo "pwd" | sftp -b - -o StrictHostKeyChecking=no {{ sftp_username | quote }}@127.0.0.1'
|
|
|
|
- name: Check that non-whitelisted sFTP permissions are denied
|
|
changed_when: false
|
|
register: sftp_share_mkdir
|
|
failed_when: sftp_share_mkdir.stderr != expected
|
|
vars:
|
|
expected: 'remote mkdir "/transfers/foo": Permission denied'
|
|
ansible.builtin.shell:
|
|
executable: /bin/bash
|
|
cmd: 'set -o pipefail; echo "mkdir foo" | sftp -b - -o StrictHostKeyChecking=no {{ sftp_username | quote }}@127.0.0.1'
|