diff options
| author | Craig Jennings <c@cjennings.net> | 2026-06-25 01:24:33 -0400 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-06-25 01:24:33 -0400 |
| commit | 3bbfc94cdcc0b63fcad08df6fb954a37e612c0ec (patch) | |
| tree | e012d7d0e01b206fe05568f2a71e4c547d4d4858 /scripts/testing/tests/test_hardening.py | |
| parent | ea5ba1469f7003d739de8a28f1b293a323863141 (diff) | |
| download | archsetup-3bbfc94cdcc0b63fcad08df6fb954a37e612c0ec.tar.gz archsetup-3bbfc94cdcc0b63fcad08df6fb954a37e612c0ec.zip | |
fix(testing): authorize a root key so make test survives sshd hardening
The VM test SSHes into the guest as root with a password for the whole run. archsetup hardens sshd to PermitRootLogin prohibit-password and reloads it partway through the install, so every SSH after that step failed with "Permission denied" and the run aborted before any validation — make test had been silently broken since the hardening landed.
inject_root_key authorizes a throwaway root key right after the first SSH (before archsetup runs) and the ssh/scp helpers now add -i <key> via SSH_KEY_OPT. prohibit-password still allows root key auth, so the harness survives the very hardening it validates. Password stays as the fallback, so the change is additive.
Diffstat (limited to 'scripts/testing/tests/test_hardening.py')
0 files changed, 0 insertions, 0 deletions