From 2e0269972f8bf47094842cc8d3c2e14cae4c7f87 Mon Sep 17 00:00:00 2001 From: Jan NIJDAM Date: Thu, 24 Feb 2022 14:43:42 +0100 Subject: [PATCH 1/4] feat(contributing): add SFTP configuration --- .gitignore | 2 +- .gitlab-ci.yml | 22 ++++- docs/README.rst | 6 +- kitchen.yml | 28 +++++- pillar.example | 5 + proftpd/files/proftpd.conf | 5 + proftpd/files/sftp.conf | 8 ++ proftpd/init.sls | 103 +++++++++++---------- proftpd/map.jinja | 5 + proftpd/sftp.sls | 26 ++++++ test/integration/sftp/README.md | 50 ++++++++++ test/integration/sftp/controls/sftp.rb | 46 +++++++++ test/integration/sftp/inspec.yml | 27 ++++++ test/salt/pillar/{ => default}/debian.sls | 0 test/salt/pillar/{ => default}/default.sls | 0 test/salt/pillar/{ => default}/gentoo.sls | 0 test/salt/pillar/{ => default}/redhat.sls | 0 test/salt/pillar/{ => default}/suse.sls | 0 test/salt/pillar/{ => default}/top.sls | 0 test/salt/pillar/sftp/sftp.sls | 7 ++ test/salt/pillar/sftp/top.sls | 16 ++++ 21 files changed, 300 insertions(+), 56 deletions(-) create mode 100644 proftpd/files/sftp.conf create mode 100644 proftpd/sftp.sls create mode 100644 test/integration/sftp/README.md create mode 100644 test/integration/sftp/controls/sftp.rb create mode 100644 test/integration/sftp/inspec.yml rename test/salt/pillar/{ => default}/debian.sls (100%) rename test/salt/pillar/{ => default}/default.sls (100%) rename test/salt/pillar/{ => default}/gentoo.sls (100%) rename test/salt/pillar/{ => default}/redhat.sls (100%) rename test/salt/pillar/{ => default}/suse.sls (100%) rename test/salt/pillar/{ => default}/top.sls (100%) create mode 100644 test/salt/pillar/sftp/sftp.sls create mode 100644 test/salt/pillar/sftp/top.sls diff --git a/.gitignore b/.gitignore index 39752a7..37ba876 100644 --- a/.gitignore +++ b/.gitignore @@ -127,7 +127,7 @@ tmp/ # `salt-formula` -- Vagrant Specific files .vagrant top.sls -!test/salt/pillar/top.sls +!test/salt/pillar/*/top.sls # `suricata-formula` -- Platform binaries *.rpm diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index a142807..f800ade 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -145,26 +145,46 @@ rubocop: # default-almalinux-8-tiamat-py3: {extends: '.test_instance'} # default-rockylinux-8-tiamat-py3: {extends: '.test_instance'} default-debian-11-master-py3: {extends: '.test_instance'} +sftp-debian-11-master-py3: {extends: '.test_instance'} default-debian-10-master-py3: {extends: '.test_instance'} +sftp-debian-10-master-py3: {extends: '.test_instance'} default-debian-9-master-py3: {extends: '.test_instance'} +sftp-debian-9-master-py3: {extends: '.test_instance'} default-ubuntu-2204-master-py3: {extends: '.test_instance_failure_permitted'} +sftp-ubuntu-2204-master-py3: {extends: '.test_instance_failure_permitted'} default-ubuntu-2004-master-py3: {extends: '.test_instance'} +sftp-ubuntu-2004-master-py3: {extends: '.test_instance'} default-ubuntu-1804-master-py3: {extends: '.test_instance'} +sftp-ubuntu-1804-master-py3: {extends: '.test_instance'} default-centos-stream8-master-py3: {extends: '.test_instance_failure_permitted'} +sftp-centos-stream8-master-py3: {extends: '.test_instance_failure_permitted'} default-centos-7-master-py3: {extends: '.test_instance'} +sftp-centos-7-master-py3: {extends: '.test_instance'} default-fedora-36-master-py3: {extends: '.test_instance_failure_permitted'} +sftp-fedora-36-master-py3: {extends: '.test_instance_failure_permitted'} default-fedora-35-master-py3: {extends: '.test_instance'} +sftp-fedora-35-master-py3: {extends: '.test_instance'} +default-fedora-34-master-py3: {extends: '.test_instance'} +sftp-fedora-34-master-py3: {extends: '.test_instance'} default-opensuse-leap-153-master-py3: {extends: '.test_instance'} +sftp-opensuse-leap-153-master-py3: {extends: '.test_instance'} default-opensuse-tmbl-latest-master-py3: {extends: '.test_instance_failure_permitted'} +sftp-opensuse-tmbl-latest-master-py3: {extends: '.test_instance_failure_permitted'} default-amazonlinux-2-master-py3: {extends: '.test_instance'} +sftp-amazonlinux-2-master-py3: {extends: '.test_instance'} default-oraclelinux-8-master-py3: {extends: '.test_instance'} +sftp-oraclelinux-8-master-py3: {extends: '.test_instance'} default-oraclelinux-7-master-py3: {extends: '.test_instance'} +sftp-oraclelinux-7-master-py3: {extends: '.test_instance'} # default-arch-base-latest-master-py3: {extends: '.test_instance'} # default-gentoo-stage3-latest-master-py3: {extends: '.test_instance'} default-gentoo-stage3-systemd-master-py3: {extends: '.test_instance'} +sftp-gentoo-stage3-systemd-master-py3: {extends: '.test_instance'} default-almalinux-8-master-py3: {extends: '.test_instance'} +sftp-almalinux-8-master-py3: {extends: '.test_instance'} default-rockylinux-8-master-py3: {extends: '.test_instance'} -# default-debian-11-3004-1-py3: {extends: '.test_instance'} +sftp-rockylinux-8-master-py3: {extends: '.test_instance'} +# # default-debian-11-3004-1-py3: {extends: '.test_instance'} # default-debian-10-3004-1-py3: {extends: '.test_instance'} # default-debian-9-3004-1-py3: {extends: '.test_instance'} # default-ubuntu-2204-3004-1-py3: {extends: '.test_instance_failure_permitted'} diff --git a/docs/README.rst b/docs/README.rst index 43daf11..0aad633 100644 --- a/docs/README.rst +++ b/docs/README.rst @@ -61,9 +61,13 @@ Installs the proftpd package, and starts the associated proftpd service. ``proftpd.database`` ^^^^^^^^^^^^^^^^^^^^ - Configures database authentication. +``proftpd.sftp`` +^^^^^^^^^^^^^^^^ +Set sftp configuration. +Require Modules pillar: mod_sftp + Testing ------- diff --git a/kitchen.yml b/kitchen.yml index 3d88e8b..e2e3ae9 100644 --- a/kitchen.yml +++ b/kitchen.yml @@ -22,8 +22,6 @@ provisioner: salt_copy_filter: - .kitchen - .git - pillars_from_directories: - - test/salt/pillar platforms: ## SALT `tiamat` @@ -276,6 +274,8 @@ verifier: suites: - name: default provisioner: + pillars_from_directories: + - test/salt/pillar/default dependencies: - name: epel repo: git @@ -290,3 +290,27 @@ suites: verifier: inspec_tests: - path: test/integration/default + - name: sftp + provisioner: + pillars_from_directories: + - test/salt/pillar/default + - test/salt/pillar/sftp + dependencies: + - name: epel + repo: git + source: https://github.com/saltstack-formulas/epel-formula.git + - name: openssh + repo: git + source: https://github.com/saltstack-formulas/openssh-formula.git + state_top: + base: + 'G@os:Amazon': + - epel + '*': + - proftpd._mapdata + - proftpd + - proftpd.sftp + verifier: + inspec_tests: + - path: test/integration/default + - path: test/integration/sftp diff --git a/pillar.example b/pillar.example index 6ee8427..79354c3 100644 --- a/pillar.example +++ b/pillar.example @@ -92,3 +92,8 @@ proftpd: # Modules: # - mod_ctrls_admin # - mod_radius + # - mod_sftp + # Manage SFTP configuration in sftp.conf + # SFTP: + # Default list of sftp configuration is visible in defaults.yaml + # SFTPLog: /var/log/proftpd/sftp.log diff --git a/proftpd/files/proftpd.conf b/proftpd/files/proftpd.conf index 767db56..a945520 100644 --- a/proftpd/files/proftpd.conf +++ b/proftpd/files/proftpd.conf @@ -3,6 +3,11 @@ Include {{ modules_config }} {%- endif -%} +{% if salt['pillar.get']('proftpd:Modules:mod_sftp') %} +# Includes DSO sftp +Include {{ sftp_config }} +{% endif %} + # Server settings ServerName {{ ServerName }} ServerType {{ ServerType }} diff --git a/proftpd/files/sftp.conf b/proftpd/files/sftp.conf new file mode 100644 index 0000000..fa0067b --- /dev/null +++ b/proftpd/files/sftp.conf @@ -0,0 +1,8 @@ +## File managed by Salt ## + + +{% for param, value in sftp.items() -%} + {{param}} {{value }} +{% endfor -%} + + diff --git a/proftpd/init.sls b/proftpd/init.sls index b1c5d61..899f818 100644 --- a/proftpd/init.sls +++ b/proftpd/init.sls @@ -29,54 +29,55 @@ proftpd_modules_service_restart: {% endif %} {{ proftpd.config }}: - file.managed: - - source: salt://proftpd/files/proftpd.conf - - user: root - - group: root - - mode: 644 - - template: jinja - - defaults: - modules_config: {{ salt['pillar.get']('proftpd:modules_config') }} - ServerName: {{ salt['pillar.get']('proftpd:ServerName') }} - ServerType: {{ salt['pillar.get']('proftpd:ServerType') }} - ServerIdent: {{ salt['pillar.get']('proftpd:ServerIdent', '"off"') }} - DefaultServer: {{ salt['pillar.get']('proftpd:DefaultServer') }} - Port: {{ salt['pillar.get']('proftpd:Port', 21) }} - MaxInstances: {{ salt['pillar.get']('proftpd:MaxInstances') }} - DeferWelcome: {{ salt['pillar.get']('proftpd:DeferWelcome') }} - MultilineRFC2228: {{ salt['pillar.get']('proftpd:MultilineRFC2228') }} - ShowSymlinks: {{ salt['pillar.get']('proftpd:ShowSymlinks') }} - AllowOverwrite: {{ salt['pillar.get']('proftpd:AllowOverwrite') }} - AllowStoreRestart: {{ salt['pillar.get']('proftpd:AllowStoreRestart') }} - AllowRetrieveRestart: {{ salt['pillar.get']('proftpd:AllowRetrieveRestart') }} - UseReverseDNS: {{ salt['pillar.get']('proftpd:UseReverseDNS') }} - IdentLookups: {{ salt['pillar.get']('proftpd:IdentLookups') }} - ListOptions: {{ salt['pillar.get']('proftpd:ListOptions') }} - DisplayChdir: {{ salt['pillar.get']('proftpd:DisplayChdir') }} - DelayEngine: {{ salt['pillar.get']('proftpd:DelayEngine') }} - TimeoutLogin: {{ salt['pillar.get']('proftpd:TimeoutLogin') }} - TimeoutNoTransfer: {{ salt['pillar.get']('proftpd:TimeoutNoTransfer') }} - TimeoutStalled: {{ salt['pillar.get']('proftpd:TimeoutStalled') }} - TimeoutIdle: {{ salt['pillar.get']('proftpd:TimeoutIdle') }} - RootLogin: {{ salt['pillar.get']('proftpd:RootLogin') }} - RequireValidShell: {{ salt['pillar.get']('proftpd:RequireValidShell') }} - User: {{ salt['pillar.get']('proftpd:User') }} - Group: {{ salt['pillar.get']('proftpd:Group') }} - Umask: {{ salt['pillar.get']('proftpd:Umask') }} - DefaultRoot: {{ salt['pillar.get']('proftpd:DefaultRoot') }} - DenyFilter: {{ salt['pillar.get']('proftpd:DenyFilter') }} - DirUmask: {{ salt['pillar.get']('proftpd:DirUmask') }} - DirAllowOverwrite: {{ salt['pillar.get']('proftpd:DirAllowOverwrite') }} - DirHideNoAccess: {{ salt['pillar.get']('proftpd:DirHideNoAccess') }} - DirLimit: {{ salt['pillar.get']('proftpd:DirLimit') }} - PathAllowFilter: {{ salt['pillar.get']('proftpd:PathAllowFilter') }} - PathDenyFilter: {{ salt['pillar.get']('proftpd:PathDenyFilter') }} - LogFormatDefault: {{ salt['pillar.get']('proftpd:LogFormat:default') }} - LogFormatAuth: {{ salt['pillar.get']('proftpd:LogFormat:auth') }} - LogFormatWrite: {{ salt['pillar.get']('proftpd:LogFormat:write') }} - SyslogLevel: {{ salt['pillar.get']('proftpd:SyslogLevel') }} - ExtendedLogAccess: {{ salt['pillar.get']('proftpd:ExtendedLog:Access') }} - ExtendedLogAuth: {{ salt['pillar.get']('proftpd:ExtendedLog:Auth') }} - ExtendedLogAll: {{ salt['pillar.get']('proftpd:ExtendedLog:All') }} - ClamAV: {{ salt['pillar.get']('proftpd:ClamAV') }} - ClamLocalSocket: {{ salt['pillar.get']('proftpd:ClamLocalSocket') }} + file.managed: + - source: salt://proftpd/files/proftpd.conf + - user: root + - group: root + - mode: 644 + - template: jinja + - context: + modules_config: {{ proftpd.modules_config }} + sftp_config: {{ proftpd.sftp_config }} + ServerName: {{ salt['pillar.get']('proftpd:ServerName') }} + ServerType: {{ salt['pillar.get']('proftpd:ServerType') }} + ServerIdent: {{ salt['pillar.get']('proftpd:ServerIdent', '"off"') }} + DefaultServer: {{ salt['pillar.get']('proftpd:DefaultServer') }} + Port: {{ salt['pillar.get']('proftpd:Port', 21) }} + MaxInstances: {{ salt['pillar.get']('proftpd:MaxInstances') }} + DeferWelcome: {{ salt['pillar.get']('proftpd:DeferWelcome') }} + MultilineRFC2228: {{ salt['pillar.get']('proftpd:MultilineRFC2228') }} + ShowSymlinks: {{ salt['pillar.get']('proftpd:ShowSymlinks') }} + AllowOverwrite: {{ salt['pillar.get']('proftpd:AllowOverwrite') }} + AllowStoreRestart: {{ salt['pillar.get']('proftpd:AllowStoreRestart') }} + AllowRetrieveRestart: {{ salt['pillar.get']('proftpd:AllowRetrieveRestart') }} + UseReverseDNS: {{ salt['pillar.get']('proftpd:UseReverseDNS') }} + IdentLookups: {{ salt['pillar.get']('proftpd:IdentLookups') }} + ListOptions: {{ salt['pillar.get']('proftpd:ListOptions') }} + DisplayChdir: {{ salt['pillar.get']('proftpd:DisplayChdir') }} + DelayEngine: {{ salt['pillar.get']('proftpd:DelayEngine') }} + TimeoutLogin: {{ salt['pillar.get']('proftpd:TimeoutLogin') }} + TimeoutNoTransfer: {{ salt['pillar.get']('proftpd:TimeoutNoTransfer') }} + TimeoutStalled: {{ salt['pillar.get']('proftpd:TimeoutStalled') }} + TimeoutIdle: {{ salt['pillar.get']('proftpd:TimeoutIdle') }} + RootLogin: {{ salt['pillar.get']('proftpd:RootLogin') }} + RequireValidShell: {{ salt['pillar.get']('proftpd:RequireValidShell') }} + User: {{ salt['pillar.get']('proftpd:User') }} + Group: {{ salt['pillar.get']('proftpd:Group') }} + Umask: {{ salt['pillar.get']('proftpd:Umask') }} + DefaultRoot: {{ salt['pillar.get']('proftpd:DefaultRoot') }} + DenyFilter: {{ salt['pillar.get']('proftpd:DenyFilter') }} + DirUmask: {{ salt['pillar.get']('proftpd:DirUmask') }} + DirAllowOverwrite: {{ salt['pillar.get']('proftpd:DirAllowOverwrite') }} + DirHideNoAccess: {{ salt['pillar.get']('proftpd:DirHideNoAccess') }} + DirLimit: {{ salt['pillar.get']('proftpd:DirLimit') }} + PathAllowFilter: {{ salt['pillar.get']('proftpd:PathAllowFilter') }} + PathDenyFilter: {{ salt['pillar.get']('proftpd:PathDenyFilter') }} + LogFormatDefault: {{ salt['pillar.get']('proftpd:LogFormat:default') }} + LogFormatAuth: {{ salt['pillar.get']('proftpd:LogFormat:auth') }} + LogFormatWrite: {{ salt['pillar.get']('proftpd:LogFormat:write') }} + SyslogLevel: {{ salt['pillar.get']('proftpd:SyslogLevel') }} + ExtendedLogAccess: {{ salt['pillar.get']('proftpd:ExtendedLog:Access') }} + ExtendedLogAuth: {{ salt['pillar.get']('proftpd:ExtendedLog:Auth') }} + ExtendedLogAll: {{ salt['pillar.get']('proftpd:ExtendedLog:All') }} + ClamAV: {{ salt['pillar.get']('proftpd:ClamAV') }} + ClamLocalSocket: {{ salt['pillar.get']('proftpd:ClamLocalSocket') }} diff --git a/proftpd/map.jinja b/proftpd/map.jinja index c90b7fe..4d23deb 100644 --- a/proftpd/map.jinja +++ b/proftpd/map.jinja @@ -5,6 +5,7 @@ 'sql_config': '/etc/proftpd/sql.conf', 'modules_config': '/etc/proftpd/modules.conf', 'mysql': 'proftpd-mod-mysql', + 'sftp_config': '/etc/proftpd/sftp.conf', 'postgres': 'proftpd-mod-pgsql', 'service': 'proftpd', }, @@ -13,6 +14,7 @@ 'config': '/etc/proftpd/proftpd.conf', 'sql_config': '/etc/proftpd/sql.conf', 'modules_config': '/etc/proftpd/modules.conf', + 'sftp_config': '/etc/proftpd/sftp.conf', 'mysql': 'proftpd-mod-mysql', 'postgres': 'proftpd-mod-pgsql', 'service': 'proftpd', @@ -21,18 +23,21 @@ 'pkg': 'proftpd', 'config': '/etc/proftpd.conf', 'modules_config': '/etc/proftpd/modules.conf', + 'sftp_config': '/etc/proftpd/sftp.conf', 'service': 'proftpd', }, 'Suse': { 'pkg': 'proftpd', 'config': '/etc/proftpd/proftpd.conf', 'modules_config': '/etc/proftpd/modules.conf', + 'sftp_config': '/etc/proftpd/sftp.conf', 'service': 'proftpd', }, 'Gentoo': { 'pkg': 'net-ftp/proftpd', 'config': '/etc/proftpd/proftpd.conf', 'modules_config': '/etc/proftpd/modules.conf', + 'sftp_config': '/etc/proftpd/sftp.conf', 'service': 'proftpd', }, }, merge=salt['pillar.get']('proftpd:lookup')) diff --git a/proftpd/sftp.sls b/proftpd/sftp.sls new file mode 100644 index 0000000..3224385 --- /dev/null +++ b/proftpd/sftp.sls @@ -0,0 +1,26 @@ +{% from "proftpd/map.jinja" import proftpd with context %} + +{% if not salt['pillar.get']('proftpd:Modules:mod_sftp') %} +missing_sftp_require_pillar: + test.fail_without_changes +{% endif %} + +proftpd_sftp_config_file: + file.managed: + - name: {{ proftpd.sftp_config }} + - source: salt://proftpd/files/sftp.conf + - user: root + - group: root + - mode: 644 + - makedirs: true + - show_changes: true + - template: jinja + - context: + sftp_config: {{ proftpd.sftp_config }} + sftp: {{ proftpd.SFTP }} + +proftpd_sftp_service_restart: + service.running: + - name: proftpd + - watch: + - file: {{ proftpd.sftp_config }} diff --git a/test/integration/sftp/README.md b/test/integration/sftp/README.md new file mode 100644 index 0000000..e0a9d8d --- /dev/null +++ b/test/integration/sftp/README.md @@ -0,0 +1,50 @@ +# InSpec Profile: `sftp` + +This shows the implementation of the `sftp` InSpec [profile](https://github.com/inspec/inspec/blob/master/docs/profiles.md). + +## Verify a profile + +InSpec ships with built-in features to verify a profile structure. + +```bash +$ inspec check default +Summary +------- +Location: sftp +Profile: profile +Controls: 1 +Timestamp: 2022-04-14T23:09:01+00:00 +Valid: true + +Errors +------ + +Warnings +-------- +``` + +## Execute a profile + +To run all **supported** controls on a local machine use `inspec exec /path/to/profile`. + +```bash +$ inspec exec default +.. + +Finished in 0.0025 seconds (files took 0.12449 seconds to load) +1 examples, 0 failures +``` + +## Execute a specific control from a profile + +To run one control from the profile use `inspec exec /path/to/profile --controls name`. + +```bash +$ inspec exec default --controls package +. + +Finished in 0.0025 seconds (files took 0.12449 seconds to load) +1 examples, 0 failures +``` + +See an [example control here](https://github.com/inspec/inspec/blob/master/examples/profile/controls/example.rb). diff --git a/test/integration/sftp/controls/sftp.rb b/test/integration/sftp/controls/sftp.rb new file mode 100644 index 0000000..617320a --- /dev/null +++ b/test/integration/sftp/controls/sftp.rb @@ -0,0 +1,46 @@ +# frozen_string_literal: true + +control 'SFTP configuration' do + title 'should match desired lines' + + spec_config_file = + case platform[:family] + when 'debian', 'suse', 'linux' + '/etc/proftpd/proftpd.conf' + when 'redhat', 'fedora' + '/etc/proftpd.conf' + end + + describe file('/etc/proftpd/sftp.conf') do + it { should be_file } + its('content') { should include '## File managed by Salt' } + its('content') { should include 'SFTPEngine' } + its('content') { should include 'SFTPLog' } + its('content') { should include 'SFTPOptions' } + its('content') { should include 'SFTPHostKey' } + its('content') { should include 'SFTPAuthMethods' } + its('content') { should include 'SFTPAuthorizedUserKeys' } + its('content') { should include 'Port 4000' } + its('content') { should include 'SFTPCompression delayed' } + end + + describe file(spec_config_file) do + it { should be_file } + its('content') { should include 'Include /etc/proftpd/sftp.conf' } + end + + describe file('/etc/proftpd/modules.conf') do + it { should be_file } + its('content') { should include '## File managed by Salt' } + its('content') { should include 'LoadModule mod_sftp.c' } + end + + describe service('proftpd') do + it { should be_enabled } + it { should be_running } + end + + describe port(4000) do + it { should be_listening } + end +end diff --git a/test/integration/sftp/inspec.yml b/test/integration/sftp/inspec.yml new file mode 100644 index 0000000..ce2c640 --- /dev/null +++ b/test/integration/sftp/inspec.yml @@ -0,0 +1,27 @@ +# -*- coding: utf-8 -*- +# vim: ft=yaml +--- +name: sftp +title: sftp proftpd formula +maintainer: SaltStack Formulas +license: Apache-2.0 +summary: Verify that the proftpd sftp is setup and configured correctly +depends: + - name: share + path: test/integration/share +supports: + - platform-name: debian + - platform-name: ubuntu + - platform-name: centos + - platform-name: fedora + - platform-name: opensuse + - platform-name: suse + - platform-name: freebsd + - platform-name: openbsd + - platform-name: amazon + - platform-name: oracle + - platform-name: arch + - platform-name: gentoo + - platform-name: almalinux + - platform-name: rocky + - platform: windows diff --git a/test/salt/pillar/debian.sls b/test/salt/pillar/default/debian.sls similarity index 100% rename from test/salt/pillar/debian.sls rename to test/salt/pillar/default/debian.sls diff --git a/test/salt/pillar/default.sls b/test/salt/pillar/default/default.sls similarity index 100% rename from test/salt/pillar/default.sls rename to test/salt/pillar/default/default.sls diff --git a/test/salt/pillar/gentoo.sls b/test/salt/pillar/default/gentoo.sls similarity index 100% rename from test/salt/pillar/gentoo.sls rename to test/salt/pillar/default/gentoo.sls diff --git a/test/salt/pillar/redhat.sls b/test/salt/pillar/default/redhat.sls similarity index 100% rename from test/salt/pillar/redhat.sls rename to test/salt/pillar/default/redhat.sls diff --git a/test/salt/pillar/suse.sls b/test/salt/pillar/default/suse.sls similarity index 100% rename from test/salt/pillar/suse.sls rename to test/salt/pillar/default/suse.sls diff --git a/test/salt/pillar/top.sls b/test/salt/pillar/default/top.sls similarity index 100% rename from test/salt/pillar/top.sls rename to test/salt/pillar/default/top.sls diff --git a/test/salt/pillar/sftp/sftp.sls b/test/salt/pillar/sftp/sftp.sls new file mode 100644 index 0000000..0e38ce8 --- /dev/null +++ b/test/salt/pillar/sftp/sftp.sls @@ -0,0 +1,7 @@ +--- +proftpd: + Modules: + enabled: + - mod_sftp + SFTP: + Port: 4000 diff --git a/test/salt/pillar/sftp/top.sls b/test/salt/pillar/sftp/top.sls new file mode 100644 index 0000000..2cf7daf --- /dev/null +++ b/test/salt/pillar/sftp/top.sls @@ -0,0 +1,16 @@ +# -*- coding: utf-8 -*- +# vim: ft=yaml +--- +base: + '*': + - ../default + - sftp + 'G@os_family:Debian': + - ../debian + 'G@os_family:RedHat': + - ../redhat + 'G@os_family:Suse': + - ../suse + 'G@os_family:Gentoo': + - ../gentoo +... From d2c1e5e1bd7c6a5c0d2cc156acb4e515c26cac76 Mon Sep 17 00:00:00 2001 From: Eric Veiras Galisson Date: Wed, 13 Jul 2022 11:34:07 +0200 Subject: [PATCH 2/4] fix: SFTP configuration, module verification --- proftpd/sftp.sls | 6 ++++-- test/salt/pillar/sftp/sftp.sls | 3 +-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/proftpd/sftp.sls b/proftpd/sftp.sls index 3224385..789b689 100644 --- a/proftpd/sftp.sls +++ b/proftpd/sftp.sls @@ -1,6 +1,8 @@ {% from "proftpd/map.jinja" import proftpd with context %} -{% if not salt['pillar.get']('proftpd:Modules:mod_sftp') %} +{% set SFTP = proftpd.get('SFTP', {}) %} + +{% if not 'mod_sftp' in salt['pillar.get']('proftpd:Modules', []) %} missing_sftp_require_pillar: test.fail_without_changes {% endif %} @@ -17,7 +19,7 @@ proftpd_sftp_config_file: - template: jinja - context: sftp_config: {{ proftpd.sftp_config }} - sftp: {{ proftpd.SFTP }} + sftp: {{ SFTP }} proftpd_sftp_service_restart: service.running: diff --git a/test/salt/pillar/sftp/sftp.sls b/test/salt/pillar/sftp/sftp.sls index 0e38ce8..0786d1d 100644 --- a/test/salt/pillar/sftp/sftp.sls +++ b/test/salt/pillar/sftp/sftp.sls @@ -1,7 +1,6 @@ --- proftpd: Modules: - enabled: - - mod_sftp + - mod_sftp SFTP: Port: 4000 From 4fe57f319283ab183343b51b77a6efe5b7171c1a Mon Sep 17 00:00:00 2001 From: Eric Veiras Galisson Date: Wed, 13 Jul 2022 14:43:58 +0200 Subject: [PATCH 3/4] wip --- proftpd/files/proftpd.conf | 3 +++ proftpd/init.sls | 1 + proftpd/sftp.sls | 4 ++-- test/salt/pillar/sftp/sftp.sls | 3 +++ 4 files changed, 9 insertions(+), 2 deletions(-) diff --git a/proftpd/files/proftpd.conf b/proftpd/files/proftpd.conf index a945520..4aac88a 100644 --- a/proftpd/files/proftpd.conf +++ b/proftpd/files/proftpd.conf @@ -90,3 +90,6 @@ ExtendedLog {{ ExtendedLogAll }} # Specify the UNIX Local Socket #ClamLocalSocket {{ ClamLocalSocket }} +{% if sftp %} +Include /etc/proftpd/sftp.conf +{% endif %} diff --git a/proftpd/init.sls b/proftpd/init.sls index 899f818..421c240 100644 --- a/proftpd/init.sls +++ b/proftpd/init.sls @@ -81,3 +81,4 @@ proftpd_modules_service_restart: ExtendedLogAll: {{ salt['pillar.get']('proftpd:ExtendedLog:All') }} ClamAV: {{ salt['pillar.get']('proftpd:ClamAV') }} ClamLocalSocket: {{ salt['pillar.get']('proftpd:ClamLocalSocket') }} + sftp: {{ salt['pillar.get']('proftpd:SFTP', False) }} diff --git a/proftpd/sftp.sls b/proftpd/sftp.sls index 789b689..3b1bcff 100644 --- a/proftpd/sftp.sls +++ b/proftpd/sftp.sls @@ -18,8 +18,8 @@ proftpd_sftp_config_file: - show_changes: true - template: jinja - context: - sftp_config: {{ proftpd.sftp_config }} - sftp: {{ SFTP }} + # sftp_config: {{ proftpd.sftp_config }} + sftp: {{ SFTP }} proftpd_sftp_service_restart: service.running: diff --git a/test/salt/pillar/sftp/sftp.sls b/test/salt/pillar/sftp/sftp.sls index 0786d1d..57ecd47 100644 --- a/test/salt/pillar/sftp/sftp.sls +++ b/test/salt/pillar/sftp/sftp.sls @@ -4,3 +4,6 @@ proftpd: - mod_sftp SFTP: Port: 4000 + SFTPHostKey: + - '/etc/ssh/ssh_host_rsa_key' + - '/etc/ssh/ssh_host_dsa_key' From 8d95d2eb964e91bfe14e8b3bdb589a7e9a81a6b5 Mon Sep 17 00:00:00 2001 From: Eric Veiras Galisson Date: Mon, 18 Jul 2022 11:33:18 +0200 Subject: [PATCH 4/4] wip --- proftpd/files/sftp.conf | 6 ++++++ test/integration/sftp/controls/sftp.rb | 1 + 2 files changed, 7 insertions(+) diff --git a/proftpd/files/sftp.conf b/proftpd/files/sftp.conf index fa0067b..935f6ff 100644 --- a/proftpd/files/sftp.conf +++ b/proftpd/files/sftp.conf @@ -2,7 +2,13 @@ {% for param, value in sftp.items() -%} + {% if value is iterable and (value is not string and value is not mapping) %} + {% for v in value|sort %} + {{param}} {{v}} + {% endfor %} + {% else %} {{param}} {{value }} + {% endif %} {% endfor -%} diff --git a/test/integration/sftp/controls/sftp.rb b/test/integration/sftp/controls/sftp.rb index 617320a..7bed4a4 100644 --- a/test/integration/sftp/controls/sftp.rb +++ b/test/integration/sftp/controls/sftp.rb @@ -22,6 +22,7 @@ its('content') { should include 'SFTPAuthorizedUserKeys' } its('content') { should include 'Port 4000' } its('content') { should include 'SFTPCompression delayed' } + its('content') { should include 'SFTPHostKey /etc/ssh/ssh_host_rsa_key\nSFTPHostKey /etc/ssh/ssh_host_dsa_key' %} end describe file(spec_config_file) do