action #120459
closed[security] luks1_decrypt_ssh_server fails on tumbleweed; test-logic: unlock_via_ssh_server seems flawed
100%
Description
Observation¶
The test is based on two machines, client (admin interface) and server (remote server)
The idea is that a remote server with encrypted disk can be rebooted and then the password to decrypt entered via ssh.
The test somewhat 'works' (worked) with some (unnoticed flaws):
- The server is setup with a 'strange' partition layout: /boot encrypted, but / is not
As a consequence, before the ssh server is even reachable, an admin needed to locally unlock the /boot encryption (making dracut-ssh completely useless, as an admin was already local to the system anyway)
This has now popped up as an error on openQA as recent grub forwards the key it receives to decrypt itself to the partitions - which in this case it 'auto-unlocks' during the boot process, making dracut-ssh not having anything to do (tried to unlock /boot again)
IMHO, the partitioning layout it inversed: / should be encrypted, /boot decrypted
openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-luks1_decrypt_ssh_server@64bit fails in
unlock_via_ssh_server
Test suite description¶
Maintainer: QE Security
Fails since (at least) Build 20221114
Last good: 20221109 (or more recent)
Further details¶
Always latest result in this scenario: latest
This test uses HDD Created by test suite create_hdd_gnome_encrypt_separate_boot using YAML schedule/security/autoyast_btrfs_luks1_separate_boot.yaml, which refers to autoyast_sle15/autoyast_btrfs_luks1_separate_boot.xml, and the test itself uses YAML schedule/security/luks1_decrypt_ssh_server.yaml.
Internal discussion that resulted in filing this ticket https://suse.slack.com/archives/C02CANHLANP/p1668499778430149
Related bug report https://bugzilla.suse.com/show_bug.cgi?id=1141868
Acceptance Criteria¶
- Restructure create_hdd_gnome_encrypt_separate_boot to create a qcow2 with unencrypted boot and encrypted /, accepting passphrase for / over SSH server started in initrd from /boot
- Update the maintainer of the test to be QE Security