124 lines
2.3 KiB
Go
124 lines
2.3 KiB
Go
/*
|
|
©AngelaMos | 2026
|
|
ssh_test.go
|
|
*/
|
|
|
|
package scanner
|
|
|
|
import (
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/CarterPerez-dev/sentinel/pkg/types"
|
|
)
|
|
|
|
func TestSSHScanner_CleanKeys(t *testing.T) {
|
|
s := &SSHScanner{}
|
|
path := filepath.Join(
|
|
testdataDir(), "ssh", "clean-authorized-keys",
|
|
)
|
|
|
|
findings := s.scanAuthorizedKeys(path)
|
|
if len(findings) > 0 {
|
|
t.Errorf(
|
|
"clean keys produced %d findings, want 0",
|
|
len(findings),
|
|
)
|
|
}
|
|
}
|
|
|
|
func TestSSHScanner_CommandKeys(t *testing.T) {
|
|
s := &SSHScanner{}
|
|
path := filepath.Join(
|
|
testdataDir(), "ssh", "command-authorized-keys",
|
|
)
|
|
|
|
findings := s.scanAuthorizedKeys(path)
|
|
if len(findings) < 2 {
|
|
t.Fatalf(
|
|
"command keys: got %d findings, want >= 2",
|
|
len(findings),
|
|
)
|
|
}
|
|
|
|
hasCommand := false
|
|
hasEnv := false
|
|
for _, f := range findings {
|
|
if f.Severity == types.SeverityHigh {
|
|
switch {
|
|
case strings.Contains(f.Title, "Forced command"):
|
|
hasCommand = true
|
|
case strings.Contains(
|
|
f.Title, "Environment override",
|
|
):
|
|
hasEnv = true
|
|
}
|
|
}
|
|
}
|
|
|
|
if !hasCommand {
|
|
t.Error("expected finding for command= option")
|
|
}
|
|
if !hasEnv {
|
|
t.Error("expected finding for environment= option")
|
|
}
|
|
}
|
|
|
|
func TestSSHScanner_SSHDConfigDangerous(t *testing.T) {
|
|
s := &SSHScanner{}
|
|
path := filepath.Join(
|
|
testdataDir(), "ssh", "sshd_config-dangerous",
|
|
)
|
|
|
|
findings := s.scanSSHDConfig(path)
|
|
if len(findings) < 2 {
|
|
t.Fatalf(
|
|
"dangerous sshd_config: got %d findings, want >= 2",
|
|
len(findings),
|
|
)
|
|
}
|
|
|
|
hasRootLogin := false
|
|
hasKeysFile := false
|
|
for _, f := range findings {
|
|
switch {
|
|
case strings.Contains(
|
|
f.Title, "PermitRootLogin",
|
|
):
|
|
hasRootLogin = true
|
|
case strings.Contains(
|
|
f.Title, "AuthorizedKeysFile",
|
|
):
|
|
hasKeysFile = true
|
|
}
|
|
}
|
|
|
|
if !hasRootLogin {
|
|
t.Error("expected finding for PermitRootLogin yes")
|
|
}
|
|
if !hasKeysFile {
|
|
t.Error(
|
|
"expected finding for non-standard AuthorizedKeysFile",
|
|
)
|
|
}
|
|
}
|
|
|
|
func TestSSHScanner_SSHDConfigClean(t *testing.T) {
|
|
s := &SSHScanner{}
|
|
path := filepath.Join(
|
|
testdataDir(), "ssh", "sshd_config-clean",
|
|
)
|
|
|
|
findings := s.scanSSHDConfig(path)
|
|
if len(findings) > 0 {
|
|
t.Errorf(
|
|
"clean sshd_config produced %d findings, want 0",
|
|
len(findings),
|
|
)
|
|
for _, f := range findings {
|
|
t.Logf(" finding: %s (%s)", f.Title, f.Evidence)
|
|
}
|
|
}
|
|
}
|