From Fedora Project Wiki

< User:Sumantrom

Revision as of 18:12, 21 March 2018 by Jjelen (talk | contribs) (The bug should be fixed in updates testing)

Description

Verify that OpenSSH works without tcp_wrappers and is not affected by its configuration by default

Setup

Make sure OpenSSH packages (client and server) are installed. Check that tcp_wrappers package is installed:

rpm -q openssh-server openssh-clients tcp_wrappers

How to test

  1. Check openssh server is NOT linked against libwrap: ldd /usr/sbin/sshd |grep libwrap
  2. Make sure there is no allowing rule in /etc/hosts.allow (the file contains only commented-out lines)
  3. Insert the following blocking rule in the /etc/hosts.deny: sshd: localhost
  4. Attempt to connect to localhost using ssh: ssh localhost
  5. Update SELinux policy packages from Updates testing: dnf update selinux-policy* --enablerepo="*testing"
  6. Configure the socket-activated sshd service with tcpd as described in the change page, section "Migration to tcpd".
  7. Verify, that the connection is rejected with the configuration from step 3: ssh localhost
  8. Remove the blocking rule that we added in step 3 from /etc/hosts.deny
  9. Verify that you can connect successfully now: ssh localhost

Expected Results

The following must be true to consider this a successful test run. Be brief ... but explicit.

  1. Step #1 should not return anything
  2. Step #3 completes successfully (there is either password prompt or you are allowed in by public key authentication)
  3. Step #7 should reject the connection.
  4. Step #9 should connect successfully again (there is either password prompt or you are allowed in by public key authentication)

Optional

If you see some issues, investigate the logs in journal, make sure the services are running.

  1. If you have problems with tcpd, try to run with SELinux in permissive mode or look for update of selinux-policy. The bug #1482554 should be fixed in updates-testing by now.