From f50fc1def85c1dbbb0ec781be4071b7ec9285785 Mon Sep 17 00:00:00 2001
From: Craig Jennings <c@cjennings.net>
Date: Thu, 25 Jun 2026 01:24:33 -0400
Subject: fix(testing): authorize a root key so make test survives sshd
 hardening
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VM test SSHes into the guest as root with a password for the whole run. archsetup hardens sshd to PermitRootLogin prohibit-password and reloads it partway through the install, so every SSH after that step failed with "Permission denied" and the run aborted before any validation — make test had been silently broken since the hardening landed.

inject_root_key authorizes a throwaway root key right after the first SSH (before archsetup runs) and the ssh/scp helpers now add -i <key> via SSH_KEY_OPT. prohibit-password still allows root key auth, so the harness survives the very hardening it validates. Password stays as the fallback, so the change is additive.
---
 scripts/testing/lib/vm-utils.sh | 39 +++++++++++++++++++++++++++++++++++----
 1 file changed, 35 insertions(+), 4 deletions(-)

(limited to 'scripts/testing/lib/vm-utils.sh')

diff --git a/scripts/testing/lib/vm-utils.sh b/scripts/testing/lib/vm-utils.sh
index d029d58..f86e583 100755
--- a/scripts/testing/lib/vm-utils.sh
+++ b/scripts/testing/lib/vm-utils.sh
@@ -18,6 +18,11 @@ VM_DISK_SIZE="${VM_DISK_SIZE:-50}"  # GB
 SSH_PORT="${SSH_PORT:-2222}"
 SSH_OPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10"
 ROOT_PASSWORD="${ROOT_PASSWORD:-archsetup}"
+# Set by inject_root_key once a root key is authorized in the VM. When set, the
+# ssh/scp helpers add "-i <key>" so they keep working after archsetup hardens
+# sshd to PermitRootLogin prohibit-password (which kills root *password* login
+# but still allows key auth). Left unquoted at use sites, like SSH_OPTS.
+SSH_KEY_OPT="${SSH_KEY_OPT:-}"
 
 # OVMF firmware paths
 OVMF_CODE="/usr/share/edk2/x64/OVMF_CODE.4m.fd"
@@ -351,7 +356,7 @@ wait_for_ssh() {
 
     progress "Waiting for SSH on localhost:$SSH_PORT..."
     while [ "$elapsed" -lt "$timeout" ]; do
-        if sshpass -p "$password" ssh $SSH_OPTS -p "$SSH_PORT" root@localhost true 2>/dev/null; then
+        if sshpass -p "$password" ssh $SSH_OPTS $SSH_KEY_OPT -p "$SSH_PORT" root@localhost true 2>/dev/null; then
             success "SSH is available"
             return 0
         fi
@@ -367,7 +372,7 @@ wait_for_ssh() {
 vm_exec() {
     local password="${1:-$ROOT_PASSWORD}"
     shift
-    sshpass -p "$password" ssh $SSH_OPTS \
+    sshpass -p "$password" ssh $SSH_OPTS $SSH_KEY_OPT \
         -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
         -p "$SSH_PORT" root@localhost "$@" 2>> "$LOGFILE"
 }
@@ -379,7 +384,7 @@ copy_to_vm() {
     local password="${3:-$ROOT_PASSWORD}"
 
     step "Copying $(basename "$local_file") to VM:$remote_path"
-    if sshpass -p "$password" scp $SSH_OPTS -P "$SSH_PORT" \
+    if sshpass -p "$password" scp $SSH_OPTS $SSH_KEY_OPT -P "$SSH_PORT" \
         "$local_file" "root@localhost:$remote_path" >> "$LOGFILE" 2>&1; then
         success "File copied to VM"
         return 0
@@ -396,7 +401,7 @@ copy_from_vm() {
     local password="${3:-$ROOT_PASSWORD}"
 
     step "Copying $remote_file from VM"
-    if sshpass -p "$password" scp $SSH_OPTS -P "$SSH_PORT" \
+    if sshpass -p "$password" scp $SSH_OPTS $SSH_KEY_OPT -P "$SSH_PORT" \
         "root@localhost:$remote_file" "$local_path" >> "$LOGFILE" 2>&1; then
         success "File copied from VM"
         return 0
@@ -405,3 +410,29 @@ copy_from_vm() {
         return 1
     fi
 }
+
+# inject_root_key <key_path>
+# Authorize a throwaway root key over the initial password session and switch
+# all the helpers above to key auth (sets SSH_KEY_OPT + ROOT_SSH_KEY). Call once,
+# right after wait_for_ssh and before running archsetup: archsetup sets
+# PermitRootLogin prohibit-password and reloads sshd partway through, which kills
+# root *password* login. Without a key in place first, every SSH after that step
+# fails and the run aborts before any validation. Key auth survives the hardening.
+inject_root_key() {
+    local key="$1"
+    rm -f "$key" "$key.pub"
+    if ! ssh-keygen -t ed25519 -N "" -q -f "$key"; then
+        warn "Root key generation failed - run may break at sshd hardening"
+        return 1
+    fi
+    if sshpass -p "$ROOT_PASSWORD" ssh $SSH_OPTS -p "$SSH_PORT" root@localhost \
+        "mkdir -p /root/.ssh && chmod 700 /root/.ssh && cat >> /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys" \
+        < "$key.pub" >> "$LOGFILE" 2>&1; then
+        SSH_KEY_OPT="-i $key"
+        export ROOT_SSH_KEY="$key"
+        success "Root SSH key authorized (survives sshd prohibit-password hardening)"
+        return 0
+    fi
+    warn "Root key authorization failed - run may break at sshd hardening"
+    return 1
+}
-- 
cgit v1.2.3