Jon Chery
797bc2f412
orca node join --type proxmox bootstraps a remote Proxmox VE 8/9 host
via SSH (REQ-050, REQ-051). The password is used only for initial auth;
subsequent access uses the deployed orca SSH key (D-031).
Changes:
- go.mod: add golang.org/x/crypto v0.54.0 (ssh + ssh/knownhosts + ed25519)
bump x/sys to v0.47.0, add x/term (indirect)
- internal/certpaths: SSHKeyPath, SSHPubPath, KnownHostsPath (D-037)
- internal/security/sshkey.go: GenerateOrLoadSSHKey (Ed25519, PKCS8 PEM,
0600/0644 modes, idempotent load per D-036)
- internal/proxmox/bootstrap.go: BootstrapProxmox SSH dance:
1. Generate/load SSH key
2. SSH dial (password + knownhosts.New TOFU per D-035)
3. Deploy pubkey to ~orca/.ssh/authorized_keys (idempotent)
4. useradd -m orca (idempotent)
5. pveum role add OrcaOperator --privs 'VM.Audit Datastore.AllocateSpace SDN.Use'
6. pveum user add orca@pam (AD-019: PAM realm, not @pve)
7. pveum acl modify / -user orca@pam -role OrcaOperator
8. Write /etc/sudoers.d/orca (AD-020: NOEXEC on pct/qm, no NOEXEC on
apt-get/dpkg, pvesh EXCLUDED — API execute bypasses NOEXEC)
9. visudo -cf validation (abort on failure)
All steps idempotent; audit-logged.
- internal/cli/node.go: --type/--host/--ssh-user/--password/--ssh-port/
--proxmox-user/--proxmox-role flags; joinProxmox() wires to
proxmox.BootstrapProxmox + registers node with kind=proxmox, os=pve.
Password zeroed after use (D-031).
- tests: sshkey generate/load round-trip, idempotency, file modes;
proxmox sudoers content (NOEXEC/NOPASSWD/pvesh-excluded),
privilege set, validation; node join flag wiring
---ci---
project: orca
phase: 2
milestone: v0.6
status: execute
---/ci---
94 lines
2.4 KiB
Go
94 lines
2.4 KiB
Go
package security
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
func TestGenerateOrLoadSSHKey_Generates(t *testing.T) {
|
|
dir := t.TempDir()
|
|
|
|
keyPEM, pubLine, err := GenerateOrLoadSSHKey(dir)
|
|
if err != nil {
|
|
t.Fatalf("generate: %v", err)
|
|
}
|
|
|
|
// Private key file exists with mode 0600.
|
|
keyPath := filepath.Join(dir, sshKeyFile)
|
|
info, err := os.Stat(keyPath)
|
|
if err != nil {
|
|
t.Fatalf("stat key: %v", err)
|
|
}
|
|
if info.Mode().Perm() != SSHKeyMode {
|
|
t.Errorf("key mode = %04o, want %04o", info.Mode().Perm(), SSHKeyMode)
|
|
}
|
|
|
|
// Public key file exists with mode 0644.
|
|
pubPath := filepath.Join(dir, sshPubFile)
|
|
info, err = os.Stat(pubPath)
|
|
if err != nil {
|
|
t.Fatalf("stat pub: %v", err)
|
|
}
|
|
if info.Mode().Perm() != SSHPubMode {
|
|
t.Errorf("pub mode = %04o, want %04o", info.Mode().Perm(), SSHPubMode)
|
|
}
|
|
|
|
// Public key line is ssh-ed25519 format.
|
|
if !strings.HasPrefix(string(pubLine), "ssh-ed25519 ") {
|
|
t.Errorf("pub line = %q, want ssh-ed25519 prefix", string(pubLine))
|
|
}
|
|
|
|
// Private key PEM parses with ssh.ParsePrivateKey (PKCS8).
|
|
signer, err := ssh.ParsePrivateKey(keyPEM)
|
|
if err != nil {
|
|
t.Fatalf("parse private key: %v", err)
|
|
}
|
|
if signer.PublicKey().Type() != "ssh-ed25519" {
|
|
t.Errorf("signer key type = %q, want ssh-ed25519", signer.PublicKey().Type())
|
|
}
|
|
}
|
|
|
|
func TestGenerateOrLoadSSHKey_IdempotentLoad(t *testing.T) {
|
|
dir := t.TempDir()
|
|
|
|
// First call generates.
|
|
keyPEM1, pubLine1, err := GenerateOrLoadSSHKey(dir)
|
|
if err != nil {
|
|
t.Fatalf("first generate: %v", err)
|
|
}
|
|
|
|
// Second call loads existing.
|
|
keyPEM2, pubLine2, err := GenerateOrLoadSSHKey(dir)
|
|
if err != nil {
|
|
t.Fatalf("second load: %v", err)
|
|
}
|
|
|
|
if string(keyPEM1) != string(keyPEM2) {
|
|
t.Error("key was regenerated on second call (D-036 idempotency violation)")
|
|
}
|
|
if string(pubLine1) != string(pubLine2) {
|
|
t.Error("pub was regenerated on second call (D-036 idempotency violation)")
|
|
}
|
|
}
|
|
|
|
func TestGenerateOrLoadSSHKey_EmptyDir(t *testing.T) {
|
|
_, _, err := GenerateOrLoadSSHKey("")
|
|
if err == nil {
|
|
t.Error("expected error for empty dir")
|
|
}
|
|
}
|
|
|
|
func TestGenerateOrLoadSSHKey_CreatesDir(t *testing.T) {
|
|
dir := filepath.Join(t.TempDir(), "nested", "ssh-dir")
|
|
if _, _, err := GenerateOrLoadSSHKey(dir); err != nil {
|
|
t.Fatalf("generate with nested dir: %v", err)
|
|
}
|
|
if _, err := os.Stat(dir); err != nil {
|
|
t.Errorf("nested dir not created: %v", err)
|
|
}
|
|
}
|