movefasta/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-06-09 19:13:26 +03:00
Code Issues Projects Releases Packages Wiki Activity

nixosTests.fail2ban: extend test coverage

Browse source
This commit is contained in:
Philipp Bartsch 2025-03-30 20:25:50 +02:00 • committed by Masum Reza
parent 0dbddf816a
commit cd6f6791e9
1 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

31
nixos/tests/fail2ban.nix
View file

@ -7,13 +7,40 @@
enable = true;
bantime-increment.enable = true;
};
services.openssh.enable = true;
networking.nftables.enable = true;
};
nodes.client = _: {
environment.systemPackages = [
pkgs.sshpass
pkgs.libressl.nc
];
};
testScript = ''
machine.wait_for_unit("multi-user.target")
start_all()
# Wait for everything to be ready.
machine.wait_for_unit("multi-user.target")
machine.wait_for_unit("fail2ban")
machine.wait_for_unit("sshd")
client.wait_for_unit("multi-user.target")
client_addr = "2001:db8:1::1"
machine_addr = "2001:db8:1::2"
# Verify there is not ban and the port is reachable from the client.
machine.succeed(f"test 0 -eq $(fail2ban-client get sshd banned {client_addr})")
client.succeed(f"nc -w3 -z {machine_addr} 22")
# Cause authentication failure log entries.
for _ in range(2):
client.fail(f"sshpass -p 'wrongpassword' ssh -o StrictHostKeyChecking=no {machine_addr}")
# Verify there is a ban and the port is unreachable from the client.
machine.wait_until_succeeds(f"test 1 -eq $(fail2ban-client get sshd banned {client_addr})")
client.fail(f"nc -w3 -z {machine_addr} 22")
'';
}