luki-net/proxmox-scripts
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

K-114: SSH root login prompt with sshd drop-in in the install path

Browse Source 
prompt_lxc_config asks 'SSH-Root-Login erlauben? [Y/n]' (env-presettable
via SSH_ROOT_LOGIN, validated, normalized to yes|no). The bootstrap passes
the value into the container; configure_ssh_root_login writes
/etc/ssh/sshd_config.d/zz-root-login.conf (yes -> PermitRootLogin yes,
no -> prohibit-password) and reloads sshd.
This commit is contained in:
l.kirchner
2026-06-12 14:41:31 +02:00
parent 5f532fe10a
commit aa3ad2f716
8 changed files with 95 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_validation.sh
+36 -4
View File
@@ -77,6 +77,38 @@ assert_false "is_hostname lehnt 'a b' ab" is_hostname "a b"
assert_true "is_token akzeptiert local-lvm" is_token "local-lvm"
assert_false "is_token lehnt 'a;b' ab" is_token "a;b"
# ── Ja/Nein (SSH-Root-Login-Prompt) ──────────────────────────────────────────
assert_true "is_yesno akzeptiert y" is_yesno "y"
assert_true "is_yesno akzeptiert Ja" is_yesno "Ja"
assert_true "is_yesno akzeptiert NO" is_yesno "NO"
assert_true "is_yesno akzeptiert nein" is_yesno "nein"
assert_false "is_yesno lehnt 'maybe' ab" is_yesno "maybe"
assert_false "is_yesno lehnt leeren Wert ab" is_yesno ""
[[ "$(normalize_yesno "J")" == "yes" && "$(normalize_yesno "nein")" == "no" ]] \
&& ok "normalize_yesno kanonisiert J→yes, nein→no" \
|| nok "normalize_yesno kanonisiert J→yes, nein→no"
# SSH-Root-Login-Prompt: leere Eingabe = Default Y → normalisiert yes;
# explizites 'n' → no.
ssh_default="$(
printf '\n' | {
SSH_ROOT_LOGIN=""
prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y" >/dev/null 2>&1
normalize_yesno "$SSH_ROOT_LOGIN"
}
)"
[[ "$ssh_default" == "yes" ]] && ok "SSH-Root-Login: leere Eingabe → Default yes" \
|| nok "SSH-Root-Login Default (got: '$ssh_default')"
ssh_no="$(
printf 'n\n' | {
SSH_ROOT_LOGIN=""
prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y" >/dev/null 2>&1
normalize_yesno "$SSH_ROOT_LOGIN"
}
)"
[[ "$ssh_no" == "no" ]] && ok "SSH-Root-Login: 'n' → no" \
|| nok "SSH-Root-Login 'n' (got: '$ssh_no')"
# ── require_valid: env-Werte werden sanitisiert + geprüft ────────────────────
CHECKVAL=$' 7\r'
require_valid CHECKVAL is_uint "Testwert" && [[ "$CHECKVAL" == "7" ]] \
@@ -145,12 +177,12 @@ ctid_out="$(
smoke_out="$(
env CTID=999 CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \
VLAN_TAG=20 TEMPLATE_STORAGE=local ROOTFS_STORAGE=local-lvm \
IPCFG=10.11.20.99/24 GATEWAY=10.11.20.1 NAMESERVER="" \
IPCFG=10.11.20.99/24 GATEWAY=10.11.20.1 NAMESERVER="" SSH_ROOT_LOGIN=J \
NET_PROFILES_FILE="$REPO_ROOT/lib/networks.conf" \
bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK"
bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK:\$SSH_ROOT_LOGIN"
)" || true
[[ "$smoke_out" == *SMOKE-OK* ]] \
&& ok "prompt_lxc_config Dry-Run mit validen env-Werten läuft durch" \
[[ "$smoke_out" == *SMOKE-OK:yes* ]] \
&& ok "prompt_lxc_config Dry-Run mit validen env-Werten läuft durch (SSH_ROOT_LOGIN J→yes)" \
|| nok "prompt_lxc_config Dry-Run (got: '$smoke_out')"
smoke_bad="$(