Project

General

Profile

Actions
Copy link

action #120459

closed

[security] luks1_decrypt_ssh_server fails on tumbleweed; test-logic: unlock_via_ssh_server seems flawed

Added by dimstar about 2 years ago. Updated 11 months ago.

Status:
Resolved
Priority:
Normal
Assignee:
pstivanin
Category:
Bugs in existing tests
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
1.00 h
Difficulty:
Tags:
fail

Description

Observation

The test is based on two machines, client (admin interface) and server (remote server)
The idea is that a remote server with encrypted disk can be rebooted and then the password to decrypt entered via ssh.

The test somewhat 'works' (worked) with some (unnoticed flaws):

  • The server is setup with a 'strange' partition layout: /boot encrypted, but / is not

As a consequence, before the ssh server is even reachable, an admin needed to locally unlock the /boot encryption (making dracut-ssh completely useless, as an admin was already local to the system anyway)

This has now popped up as an error on openQA as recent grub forwards the key it receives to decrypt itself to the partitions - which in this case it 'auto-unlocks' during the boot process, making dracut-ssh not having anything to do (tried to unlock /boot again)

IMHO, the partitioning layout it inversed: / should be encrypted, /boot decrypted

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-luks1_decrypt_ssh_server@64bit fails in
unlock_via_ssh_server

Test suite description

Maintainer: QE Security

Fails since (at least) Build 20221114

Last good: 20221109 (or more recent)

Further details

Always latest result in this scenario: latest

This test uses HDD Created by test suite create_hdd_gnome_encrypt_separate_boot using YAML schedule/security/autoyast_btrfs_luks1_separate_boot.yaml, which refers to autoyast_sle15/autoyast_btrfs_luks1_separate_boot.xml, and the test itself uses YAML schedule/security/luks1_decrypt_ssh_server.yaml.

Internal discussion that resulted in filing this ticket https://suse.slack.com/archives/C02CANHLANP/p1668499778430149

Related bug report https://bugzilla.suse.com/show_bug.cgi?id=1141868

Acceptance Criteria

  1. Restructure create_hdd_gnome_encrypt_separate_boot to create a qcow2 with unencrypted boot and encrypted /, accepting passphrase for / over SSH server started in initrd from /boot
  2. Update the maintainer of the test to be QE Security

Related issues 1 (0 open — 1 closed)

Related to openQA Tests - action #152455: [security][15-SP6] GRUB now passes through unlocking, test needs to be changedResolvedpstivanin

Actions
Actions
Copy link
 #1

Updated by maritawerner about 2 years ago

  • Subject changed from test-logic: unlock_via_ssh_server seems flawed to [security] test-logic: unlock_via_ssh_server seems flawed
Actions
Copy link
 #2

Updated by tjyrinki_suse about 2 years ago

  • Subject changed from [security] test-logic: unlock_via_ssh_server seems flawed to [security] luks1_decrypt_ssh_server fails on tumbleweed; test-logic: unlock_via_ssh_server seems flawed
  • Description updated (diff)
  • Start date deleted (2022-11-15)
  • Estimated time set to 48.00 h

Added more further details and also acceptance criteria (debatable..). I've checked and the HDD in question seems to be only used for this one particular test, so the restructuring should be possible.

Actions
Copy link
 #3

Updated by tjyrinki_suse about 2 years ago

  • Description updated (diff)
Actions
Copy link
 #4

Updated by openqa_review almost 2 years ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: luks1_decrypt_ssh_server
https://openqa.opensuse.org/tests/2913543#step/unlock_via_ssh_server/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 28 days if nothing changes in this ticket.

Actions
Copy link
 #5

Updated by punkioudi almost 2 years ago

  • Status changed from New to In Progress
  • Assignee set to punkioudi
Actions
Copy link
 #6

Updated by openqa_review almost 2 years ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: luks1_decrypt_ssh_server
https://openqa.opensuse.org/tests/3129396#step/unlock_via_ssh_server/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 108 days if nothing changes in this ticket.

Actions
Copy link
 #7

Updated by punkioudi over 1 year ago

  • Assignee deleted (punkioudi)
Actions
Copy link
 #8

Updated by openqa_review over 1 year ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: luks1_decrypt_ssh_server
https://openqa.opensuse.org/tests/3247808#step/unlock_via_ssh_server/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 88 days if nothing changes in this ticket.

Actions
Copy link
 #9

Updated by openqa_review over 1 year ago

This is an autogenerated message for openQA integration by the openqa_review script:

This bug is still referenced in a failing openQA test: luks1_decrypt_ssh_server
https://openqa.opensuse.org/tests/3454401#step/unlock_via_ssh_server/1

To prevent further reminder comments one of the following options should be followed:

  1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted
  2. The openQA job group is moved to "Released" or "EOL" (End-of-Life)
  3. The bugref in the openQA scenario is removed or replaced, e.g. label:wontfix:boo1234

Expect the next reminder at the earliest in 176 days if nothing changes in this ticket.

Actions
Copy link
 #10

Updated by pstivanin 11 months ago

  • Status changed from In Progress to Resolved
  • Assignee set to pstivanin
  • Estimated time changed from 48.00 h to 1.00 h
Actions
Copy link
 #11

Updated by pstivanin 11 months ago

  • Related to action #152455: [security][15-SP6] GRUB now passes through unlocking, test needs to be changed added
Actions
Copy link

Also available in: Atom PDF