Skip to content

Add note about fork with Proxmox support. #141

Add note about fork with Proxmox support.

Add note about fork with Proxmox support. #141

Workflow file for this run

name: LXC ssh test
# Run this workflow every time a new commit pushed to your repository
on:
push:
#branches: '**'
#branches-ignore: 'main'
pull_request:
#branches: '**'
#branches-ignore: 'main'
workflow_dispatch:
defaults:
run:
shell: bash
jobs:
pr-test-ubuntu-user:
name: Check the PR (ubuntu user)
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
# also test 'latest', eventually this will be upgraded to a newer version and might fail early
# build the matrix manually - not all versions of Ubuntu can do with all Ansible versions,
# mostly because the Python version is outdated (20.04 only has Python 3.8)
# maybe in the future this can be build with include/exclude
#os: [ubuntu-20.04, ubuntu-22.04, ubuntu-latest]
#ansible: ["stable-2.9", "stable-2.10", "stable-2.11", "stable-2.12", "stable-2.13", "stable-2.14"]
include:
- os: ubuntu-20.04
guest: 20.04
#guest-image: 20.04/amd64
ansible: "stable-2.9"
- os: ubuntu-20.04
guest: 20.04
ansible: "stable-2.10"
- os: ubuntu-20.04
guest: 20.04
ansible: "stable-2.11"
- os: ubuntu-20.04
guest: 20.04
ansible: "stable-2.12"
- os: ubuntu-20.04
guest: 20.04
ansible: "stable-2.13"
- os: ubuntu-22.04
guest: 22.04
ansible: "stable-2.9"
- os: ubuntu-22.04
guest: 22.04
ansible: "stable-2.10"
- os: ubuntu-22.04
guest: 22.04
ansible: "stable-2.11"
- os: ubuntu-22.04
guest: 22.04
ansible: "stable-2.12"
- os: ubuntu-22.04
guest: 22.04
ansible: "stable-2.13"
- os: ubuntu-22.04
guest: 22.04
ansible: "stable-2.14"
# build the latest known stable Ansible on the latest known stable Ubuntu
- os: ubuntu-latest
guest: 22.04
ansible: "stable-2.14"
# build the development version of Ansible on latest Ubuntu
- os: ubuntu-latest
guest: 22.04
ansible: "devel"
steps:
- name: Checkout code
uses: actions/checkout@v3
# check Python syntax
- name: Python syntax check
run: python3 -m py_compile lxc_ssh.py
# prepare container with LXD installation
- name: Install basic packages
run: sudo apt-get install -y iptables
- name: Install LXD (Ubuntu 20.x)
run: sudo apt-get install -y lxd lxd-client lxd-tools
if: ${{ matrix.guest == '20.04' }}
- name: Install LXD (Ubuntu >= 22.x)
run: sudo snap install lxd
if: ${{ matrix.guest != '20.04' }}
# different LXD versions need different init steps
- name: Store LXD version
run: echo "LXD_Version=$(lxd --version)" >> $GITHUB_OUTPUT
id: lxd_version
- name: Store LXD major version
run: echo "LXD_Major_Version=$(lxd --version | cut -f1 -d'.')" >> $GITHUB_OUTPUT
id: lxd__major_version
- name: Output version
run: echo "${{ steps.lxd_version.outputs.LXD_Version }} - ${{ steps.lxd__major_version.outputs.LXD_Major_Version }}"
- name: Fail for unknown older versions
run: exit 1
if: steps.lxd__major_version.outputs.LXD_Major_Version < 3
- name: Fail for unknown newer versions
run: exit 1
if: steps.lxd__major_version.outputs.LXD_Major_Version > 5
- name: Init LXD version 3
run: sudo lxd init --preseed < $GITHUB_WORKSPACE/.github/resources/lxd3-init.yml
if: steps.lxd__major_version.outputs.LXD_Major_Version == 3
- name: Init LXD version 4
run: sudo lxd init --preseed < $GITHUB_WORKSPACE/.github/resources/lxd4-init.yml
if: steps.lxd__major_version.outputs.LXD_Major_Version >= 4
- name: Show LXD status
run: sudo lxc profile show default
- name: Store IPv4 address for lxdbr0
run: echo "IP=$(ip -4 addr show lxdbr0 | grep inet | awk '{print $2}' | cut -d/ -f1)" >> $GITHUB_OUTPUT
id: lxdbr0_ipv4
- name: Show lxdbr0 IP address
run: echo "${{ steps.lxdbr0_ipv4.outputs.IP }}"
- name: Create container-pool for LXD
run: sudo lxc storage create container-pool dir
- name: Remove default storage pool from LXD
run: sudo lxc profile device remove default root
- name: Attach container storage pool to default profile
run: sudo lxc profile device add default root disk path=/ pool=container-pool
# - name: Firewall IPv6
# run: sudo lxc network set lxdbr0 ipv6.firewall false
# - name: Firewall IPv4
# run: sudo lxc network set lxdbr0 ipv4.firewall false
# - name: Firewall 1
# run: sudo ufw allow in on lxdbr0
# - name: Firewall 2
# run: sudo ufw route allow in on lxdbr0
# - name: Firewall 3
# run: sudo ufw route allow out on lxdbr0
# - name: Docker
# run: sudo docker ps
# https://linuxcontainers.org/lxd/docs/master/howto/network_bridge_firewalld/#prevent-issues-with-lxd-and-docker
- name: Show network configuration
run: sudo ip addr
- name: Docker Firewall 1
run: sudo iptables -I DOCKER-USER -i lxdbr0 -o eth0 -j ACCEPT
- name: Docker Firewall 2
run: sudo iptables -I DOCKER-USER -o lxdbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# create an actual container, and configure it
# Enable container nesting
- name: Create container
run: sudo lxc launch images:ubuntu/${{ matrix.guest }} test-container -c security.nesting=true
- name: Wait for container to start
run: sleep 10
- name: Show container
run: sudo lxc list
- name: Debug
run: sudo lxc exec test-container -- ip -4 -o link show
- name: Store Container interface name
run: echo "IF=$(sudo lxc exec test-container -- ip -4 -o link show | awk '{print $2}' | cut -f1 -d':' | cut -f1 -d'@' | grep '^e[tn]')" >> $GITHUB_OUTPUT
id: test_container_interface
- name: Request and wait for IPv4 address
run: sudo lxc exec test-container -- dhclient -v ${{ steps.test_container_interface.outputs.IF }}
- name: Store Container IPv4 address
run: echo "IPv4=$(sudo lxc exec test-container -- ip -o -4 addr show ${{ steps.test_container_interface.outputs.IF }} | awk '{print $4}' | cut -d/ -f1)" >> $GITHUB_OUTPUT
id: test_container_ipv4
- name: Output container network data
run: echo "${{ steps.test_container_interface.outputs.IF }} - ${{ steps.test_container_ipv4.outputs.IPv4 }}"
- name: Fail if no network available
run: exit 1
if: steps.test_container_ipv4.outputs.IPv4 == ''
- name: Ping test if the container is connected
run: ping -4 -c 3 -n -v ${{ steps.test_container_ipv4.outputs.IPv4 }}
- name: Add container to /etc/hosts
run: ls -ld /etc/hosts
- name: Add container to /etc/hosts
run: echo -e "${{ steps.test_container_ipv4.outputs.IPv4 }}\ttest-container" | sudo tee -a /etc/hosts
- name: Show /etc/hosts
run: cat /etc/hosts
# create ssh key for root
- name: Create ssh directory for root
run: sudo mkdir -p /root/.ssh/
- name: Update permissions for ssh directory for root
run: sudo chmod 0700 /root/.ssh/
- name: Generate OpenSSH key for root
#run: sudo ssh-keygen -t rsa -b 4096 -f /root/.ssh/id_rsa -v -N "" -P "" -C "root@host"
run: sudo ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519 -v -N "" -P "" -C "root@host"
# create ssh key for runner user
- name: Create ssh directory for runner user
run: mkdir -p $HOME/.ssh/
- name: Update permissions for ssh directory for runner user
run: chmod 0700 $HOME/.ssh/
- name: Generate OpenSSH key for runner user
#run: ssh-keygen -t rsa -b 4096 -f $HOME/.ssh/id_rsa -v -N "" -P "" -C "home/runner@host"
run: ssh-keygen -t ed25519 -f $HOME/.ssh/id_ed25519 -v -N "" -P "" -C "home/runner@host"
# 22.04 can't reach the Ubuntu servers over IPv6
# - name: Disable IPv6 (all)
# run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- sysctl -w net.ipv6.conf.all.disable_ipv6=1
# - name: Disable IPv6 (default)
# run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- sysctl -w net.ipv6.conf.default.disable_ipv6=1
# - name: Disable IPv6 (lo)
# run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- sysctl -w net.ipv6.conf.lo.disable_ipv6=1
- name: Network
run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- ip addr
- name: Network
run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- ip route
# install OpenSSH in container
- name: Install OpenSSH in container
run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- apt-get -y install -y openssh-client openssh-server openssh-sftp-server
- name: OpenSSH create root .ssh directory in container
run: sudo lxc exec test-container -- mkdir -p /root/.ssh
- name: OpenSSH permissions of root .ssh directory in container
run: sudo lxc exec test-container -- chmod 0700 /root/.ssh
- name: OpenSSH create ubuntu .ssh directory in container
run: sudo lxc exec test-container -- mkdir -p /home/ubuntu/.ssh
- name: OpenSSH permissions of ubuntu .ssh directory in container
run: sudo lxc exec test-container -- chmod 0700 /home/ubuntu/.ssh
# install root and user ssh key in container for root and user
- name: OpenSSH push authorized_keys for root into container
#run: sudo lxc file push /root/.ssh/id_rsa.pub test-container/root/.ssh/authorized_keys
run: sudo lxc file push /root/.ssh/id_ed25519.pub test-container/root/.ssh/authorized_keys
- name: OpenSSH push authorized_keys for user into container
#run: sudo lxc file push $HOME/.ssh/id_rsa.pub test-container/tmp/authorized_keys.user
run: sudo lxc file push $HOME/.ssh/id_ed25519.pub test-container/tmp/authorized_keys.user
- name: OpenSSH add user key to root authorized_keys in container
#run: sudo lxc exec test-container -- bash -c "cat /tmp/authorized_keys.user | sudo tee -a /root/.ssh/authorized_keys"
run: sudo lxc exec test-container -- sudo bash -c "cat /tmp/authorized_keys.user >> /root/.ssh/authorized_keys"
- name: Install authorized_keys for ubuntu user in container
run: sudo lxc exec test-container -- cp -ai /root/.ssh/authorized_keys /home/ubuntu/.ssh
- name: OpenSSH ownership of ubuntu .ssh directory in container
run: sudo lxc exec test-container -- chown -R ubuntu. /home/ubuntu/.ssh
# configure password & other requirements for password authentication
- name: Set root user password in container
run: sudo lxc exec test-container -- sh -c 'printf "password\npassword\n" | passwd'
- name: Set ubuntu user password in container
run: sudo lxc exec test-container -- sh -c 'printf "password\npassword\n" | passwd ubuntu'
- name: Install sshpass on runner
run: sudo apt-get -y install sshpass
# update known_hosts for root
- name: Create /root/.ssh/known_hosts
run: sudo touch /root/.ssh/known_hosts
- name: Add container to known_hosts for root
run: sudo bash -c "ssh-keyscan -4 test-container >> /root/.ssh/known_hosts"
- name: Add container IP to known_hosts for root
run: sudo bash -c "ssh-keyscan -4 ${{ steps.test_container_ipv4.outputs.IPv4 }} >> /root/.ssh/known_hosts"
# update known_hosts for user
- name: Create /user/.ssh/known_hosts
run: touch $HOME/.ssh/known_hosts
- name: Add container to known_hosts for user
run: bash -c "ssh-keyscan -4 test-container >> $HOME/.ssh/known_hosts"
- name: Add container IP to known_hosts for user
run: bash -c "ssh-keyscan -4 ${{ steps.test_container_ipv4.outputs.IPv4 }} >> $HOME/.ssh/known_hosts"
# test ssh connection in all combinations
- name: Test ssh connection from root into root
run: sudo ssh -i /root/.ssh/id_ed25519 -o PreferredAuthentications=publickey -o PasswordAuthentication=no -l root ${{ steps.test_container_ipv4.outputs.IPv4 }} uptime
- name: Test ssh connection from root into ubuntu user
run: sudo ssh -i /root/.ssh/id_ed25519 -o PreferredAuthentications=publickey -o PasswordAuthentication=no -l ubuntu ${{ steps.test_container_ipv4.outputs.IPv4 }} uptime
- name: Test ssh connection from runner into root user
run: ssh -i $HOME/.ssh/id_ed25519 -o PreferredAuthentications=publickey -o PasswordAuthentication=no -l root ${{ steps.test_container_ipv4.outputs.IPv4 }} uptime
- name: Test ssh connection from runner into ubuntu user
run: ssh -i $HOME/.ssh/id_ed25519 -o PreferredAuthentications=publickey -o PasswordAuthentication=no -l ubuntu ${{ steps.test_container_ipv4.outputs.IPv4 }} uptime
- name: Test ssh connection into root user with password authentication
run: sshpass -p 'password' ssh -i /dev/null -l ubuntu ${{ steps.test_container_ipv4.outputs.IPv4 }} uptime
# copy logfiles from container into log
- name: Show logfile in container
if: always()
run: sudo lxc exec test-container -- tail -n 500 /var/log/syslog
- name: Show logfile in container
if: always()
run: sudo lxc exec test-container -- tail -n 500 /var/log/auth.log
# - name: Stop
# run: exit 1
# install Python3 in container
- name: apt-get update
run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- apt-get update
# don't upgrade the container to the latest software version
# should work out of the box for testing, and saves time
#- name: apt-get dist-upgrade
# run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- apt-get dist-upgrade -y
- name: Ubuntu version
run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- lsb_release -a
- name: Python3
run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- apt-get -y install -y python3
# Install LXD inside container, it's missing inside container
- name: Install LXD inside container (20.04)
run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- sudo apt-get install -y lxd lxd-client lxd-tools iptables
if: ${{ matrix.guest == '20.04' }}
- name: Install Snap inside container (>= 22.04)
run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- sudo apt-get -y install snapd iptables
if: ${{ matrix.guest != '20.04' }}
- name: Install LXD inside container (>= 22.04)
run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- sudo snap install lxd
if: ${{ matrix.guest != '20.04' }}
# - name: Ping test if the container has connectivity
# run: sudo lxc exec test-container --env DEBIAN_FRONTEND=noninteractive -- ping -4 -c 3 -n -v 8.8.8.8
# container is ready
# install Ansible
- name: Install requested Ansible version using pip
run: python -m pip install --user https://github.com/ansible/ansible/archive/${{ matrix.ansible }}.tar.gz
- name: Show Ansible version
run: ansible --version
- name: Install plugin for tests
run: cp -af $GITHUB_WORKSPACE/lxc_ssh.py $GITHUB_WORKSPACE/tests/connection_plugins/lxc_ssh.py
- name: Create empty file for tests
run: touch $GITHUB_WORKSPACE/tests/test_empty.txt
- name: Create a 1000 Bytes file for tests
run: dd if=/dev/urandom of=$GITHUB_WORKSPACE/tests/test_1000b.txt bs=1KB count=1
- name: Create a 5MB file for tests
run: dd if=/dev/urandom of=$GITHUB_WORKSPACE/tests/test_5mb.txt bs=5MB count=1
- name: Create a 50MB file for tests
run: dd if=/dev/urandom of=$GITHUB_WORKSPACE/tests/test_50mb.txt bs=50MB count=1
- name: Show test directory
run: bash -c "ls -ld $GITHUB_WORKSPACE/tests/*"
# nested LXD configuration
- name: Init LXD inside container
run: sudo lxc exec test-container -- sudo lxd init --preseed < $GITHUB_WORKSPACE/.github/resources/lxd4-init.yml
# Create a nested container for lxc_ssh tests
- name: Create a nested container
run: sudo lxc exec test-container -- sudo lxc launch images:ubuntu/${{ matrix.guest }} nested-container
- name: add container user to lxd group
run: sudo lxc exec test-container -- sudo adduser ubuntu lxd
- name: Wait for container to start
run: sleep 10
- name: Generate ansible inventory
run: |
cat <<EOF > $GITHUB_WORKSPACE/tests/inventory.yml
---
all:
hosts:
testhost:
ansible_host: ${{ steps.test_container_ipv4.outputs.IPv4 }}
ansible_ssh_user: 'ubuntu'
lxc_host: "nested-container"
ansible_connection: lxc_ssh
EOF
- name: Show inventory file
run: cat $GITHUB_WORKSPACE/tests/inventory.yml
- name: Run test
run: ANSIBLE_CONFIG=$GITHUB_WORKSPACE/tests/ cd tests && ansible-playbook -i $GITHUB_WORKSPACE/tests/inventory.yml $GITHUB_WORKSPACE/tests/test-lxc_ssh.yml
# Test password authentication
- name: Add a password for the SSH connection
run: >
printf ' ansible_ssh_pass: "password"\n ansible_ssh_private_key_file: "/dev/null"' >> $GITHUB_WORKSPACE/tests/inventory.yml
- name: Run test with password
run: >
ANSIBLE_CONFIG=$GITHUB_WORKSPACE/tests/ cd tests && ansible-playbook -i $GITHUB_WORKSPACE/tests/inventory.yml $GITHUB_WORKSPACE/tests/test-lxc_ssh.yml -t short
- name: Remove sshpass
run: sudo apt-get remove -y sshpass
- name: Run test with password and without sshpass (expect command failure)
run: >
set +e;
stdout=$(ANSIBLE_CONFIG=$GITHUB_WORKSPACE/tests/ cd tests && ansible-playbook -i $GITHUB_WORKSPACE/tests/inventory.yml $GITHUB_WORKSPACE/tests/test-lxc_ssh.yml -t short);
status=$?;
set -e;
[ $status -eq 2 ] && echo "$stdout" | grep -F "to use the 'ssh' connection type with passwords, you must install the sshpass program"